Live Threat Intelligence
Monitor, filter, and investigate recent new and updated vulnerability records.
Live monitoring active
Automatic refresh every ~30 seconds
Records loaded
100
New CVEs
61
Updated CVEs
39
Known Exploited
0
CISA ADP KEV only
Live feed
100 of 100 records
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability
User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter
Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback
Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`
WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail
Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection
Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript
Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement
WP2LEADS <= 3.5.6 - Authenticated (Subscriber+) SQL Injection via order Parameter
User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter
SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag
Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter
Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log
WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name
Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint
Hive: exposure of vcenter credentials via clusterprovision in hive / mce / acm
Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter
Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX Action
Welcart e-Commerce <= 2.12.5 - Account Takeover via Insecure Direct Object Reference to Unauthenticated User Input via 'member[ID]' Parameter
Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter
PDF Invoices & Packing Slips for WooCommerce <= 5.16.5 - Unauthenticated Sensitive Information Exposure via Yearly-Reset Invoice Attachment Cache
VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter
Photo Reviews for WooCommerce <= 1.2.31 - Unauthenticated File Deletion via 'wcpr_image_upload_id' Parameter
WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action
Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter
PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout
Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter
UsersWP <= 1.2.78 - Unauthenticated Account Access via Predictable Dummy User Password Disclosed through Registration Form Hash
Seraphinite Accelerator <= 2.29.24 - Unauthenticated Sensitive Information Exposure in Object Cache Directory
User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field
Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email Disclosure
WP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter
Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter
PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checkout Field
Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters
Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback
Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download
Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route
All-in-One Video Gallery < 5.0.0 - Unauthenticated Private and Draft Video Disclosure
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
BuddyForms 2.8.8 - 2.10.0 - Unauthenticated Guest Attachment Deletion
Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting
Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation
Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal
Essential Addons for Elementor 6.6.0 - 6.8.7 - Author+ Privilege Escalation via register_user_role
Payment Forms for Paystack < 4.0.6 - Contributor+ Sensitive Information Disclosure via Settings Page
PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision
Ninja Forms <= 3.15.5 - Unauthenticated Arbitrary Shortcode Execution via 'formData' Field Value via Success Message Merge Tag
Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters
Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution
Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
Ninja Forms <= 3.15.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via '{wp:user_display_name}' Merge Tag via display_name
Enforce maximum recursion depth in encoding/asn1
Quadratic complexity in WordDecoder.DecodeHeader in mime
Tempo-operator: tempo operator: query rbac bypass
Coreutils: heap buffer under-read in gnu coreutils sort via key specification
Vulnerability in the Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Applications Platform Engineering executes to compromise Applications Platform Engineering. Successful attacks of this vulnerability can result in takeover of Applications Platform Engineering. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Applications DBA executes to compromise Applications DBA. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Applications DBA. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Gimp: gimp: stack buffer overflow in psd image resource header loader
gettext: Directory traversal via the LANGUAGE environment variable
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Improper certificate validation in the HTTPS listener in LXD
Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.