VYPR

CVEs

401,567 total · page 1043 of 8,032

AllCriticalHighKEV
  • CVE-2026-12077HigJun 25, 2026
    WordPress
    Dokan Pro
    risk 0.00cvss 7.5epss 0.00

    The Dokan Pro plugin for WordPress is vulnerable to time-based SQL Injection via the via 'latitude' and 'longitude' parameters in all versions up to, and including, 5.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…

  • CVE-2026-10833MedJun 25, 2026
    WordPress
    Essential Blocks
    risk 0.00cvss 6.4epss 0.00

    The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'configurablePrefix' Block Attribute in all versions up to, and including, 6.1.4 due to insufficient input sanitization and…

  • CVE-2026-8662LowJun 25, 2026
    Rapid7
    Insightconnect Compression
    risk 0.00cvss 3.3epss 0.00

    Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled…

  • CVE-2026-8658MedJun 25, 2026
    Rapid7
    Insightconnect Tcpdump
    risk 0.00cvss 6.0epss 0.01

    OS Command Injection vulnerability in Rapid7 InsightConnect Tcpdump Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the options or filter parameters due to insufficient input sanitization in shell command construction.

  • CVE-2026-8666HigJun 25, 2026
    Rapid7
    Insightconnect Traceroute
    risk 0.00cvss 7.7epss 0.01

    OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host, port, max_ttl, count, or time_out request parameters due to insufficient input validation when…

  • CVE-2026-8665HigJun 25, 2026
    Rapid7
    Insightconnect Translate
    risk 0.00cvss 7.7epss 0.01

    OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to insufficient input sanitization in shell command construction.

  • CVE-2026-8664MedJun 25, 2026
    Rapid7
    Insightconnect Finger
    risk 0.00cvss 6.0epss 0.01

    OS Command Injection vulnerability in Rapid7 InsightConnect Finger Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the user or host parameters due to insufficient input validation in shell command construction.

  • CVE-2026-8660HigJun 25, 2026
    Rapid7
    Insightconnect Ping
    risk 0.00cvss 7.7epss 0.01

    OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbitrary OS commands via the host parameter due to insufficient input validation when constructing shell commands.

  • CVE-2026-8592HigJun 25, 2026
    Rapid7
    Insightconnect Awk
    risk 0.00cvss 7.7epss 0.01

    OS Command Injection vulnerability in the process_string action of Rapid7 InsightConnect AWK Plugin on Linux allows remote attackers to execute arbitrary OS commands via the text or expression parameters due to unsafe shell command construction in the processing pipeline.

  • CVE-2026-9155HigJun 25, 2026
    Rapid7
    InsightConnect Sed Plugin
    risk 0.57cvss 8.8epss 0.02

    OS Command Injection vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the expression parameter due to insufficient input validation.

  • CVE-2026-9154HigJun 25, 2026
    Rapid7
    InsightConnect Sed Plugin
    risk 0.46cvss 7.1epss 0.00

    Arbitrary File Write vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to write attacker-controlled content to arbitrary file paths via the expression parameter.

  • CVE-2026-9153MedJun 25, 2026
    Rapid7
    InsightConnect Sed Plugin
    risk 0.42cvss 6.5epss 0.00

    Arbitrary File Read vulnerability in Rapid7 InsightConnect Sed Plugin on Linux allows authenticated attackers to read arbitrary files via the expression parameter due to insufficient input validation.

  • CVE-2026-57589HigJun 25, 2026
    OpenBSD
    OpenBSD
    risk 0.41cvss 7.4epss 0.00

    sys/kern/sysv_sem.c in OpenBSD through 7.9 has a use-after-free allowing local privilege escalation to root. This is a context switch use-after-free after tsleep in sys_semget().

  • CVE-2026-9787HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.05

    Quest NetVault Backup NVBULogDaemon Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability,…

  • CVE-2026-9786HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.01

    Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the…

  • CVE-2026-9785HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.01

    Quest NetVault Backup NVBULibrarySlot SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability,…

  • CVE-2026-9784HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.01

    Quest NetVault Backup NVBULibraryPort SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability,…

  • CVE-2026-9783HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.01

    Quest NetVault Backup NVBURemovableMedia SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability,…

  • CVE-2026-9782HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.01

    Quest NetVault Backup NVBUDeviceDrive SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability,…

  • CVE-2026-9781HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.01

    Quest NetVault Backup NVBURASDevice SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the…

  • CVE-2026-9780HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.01

    Quest NetVault Backup addclient3 Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that…

  • CVE-2026-8663MedJun 25, 2026
    Rapid7
    Insightconnect Rpm
    risk 0.39cvss 6.0epss 0.01

    OS Command Injection vulnerability in Rapid7 InsightConnect RPM Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the repo, key, or name parameters due to insufficient input sanitization in shell command construction.

  • CVE-2026-8659MedJun 25, 2026
    Rapid7
    Insightconnect Sqlmap
    risk 0.39cvss 6.0epss 0.01

    OS Command Injection vulnerability in Rapid7 InsightConnect SQLmap Plugin on Linux allows authenticated attackers to execute arbitrary OS commands via the api_host or api_port parameters during connection configuration due to insufficient input validation.

  • CVE-2026-7570HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.01

    Quest NetVault Backup NVBUDashboard SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest NetVault Backup. Although authentication is required to exploit this vulnerability, the…

  • CVE-2026-7569HigJun 25, 2026
    Quest
    Netvault Backup
    risk 0.57cvss 8.8epss 0.01

    Quest NetVault Backup viewclient Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of Quest NetVault Backup. User interaction is required to exploit this vulnerability in that…

  • CVE-2026-40079CriJun 25, 2026
    Cacti (software)
    Cacti
    risk 0.57cvss 9.8epss 0.02

    Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Command Injection due to lack of sanitization in the escape_command() function. The escape_command() function at lib/rrd.php is a no-op: it returns $command unchanged.…

  • CVE-2026-39951HigJun 25, 2026
    Cacti (software)
    Cacti
    risk 0.42cvss 7.6epss 0.00

    Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_regexp in the Reports feature. This issue has been fixed in version 1.2.31.

  • CVE-2025-60473MedJun 25, 2026
    Gpac
    Gpac
    risk 0.29cvss 5.5epss 0.00

    A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file.

  • CVE-2025-60466MedJun 25, 2026
    Gpac
    Gpac
    risk 0.26cvss 5.0epss 0.00

    A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

  • CVE-2026-39955CriJun 24, 2026
    Cacti (software)
    Cacti
    risk 0.57cvss 9.8epss 0.01

    Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have pre-authentication SQL Injection via unanchored FILTER_VALIDATE_REGEXP in graph_view.php. This issue has been fixed in version 1.2.31.

  • CVE-2026-39948CriJun 24, 2026
    Cacti (software)
    Cacti
    risk 0.57cvss 9.8epss 0.01

    Cacti is an open source performance and fault management framework. In versions 1.2.30 and prior, the rfilter request parameter is retrieved via the raw accessor grv() (rather than gfrv() with FILTER_VALIDATE_IS_REGEX validation) and concatenated directly into RLIKE SQL clauses…

  • CVE-2026-39938CriJun 24, 2026
    Cacti (software)
    Cacti
    risk 0.57cvss 9.8epss 0.01

    Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graph_theme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31.

  • CVE-2026-39900MedJun 24, 2026
    Cacti (software)
    Cacti
    risk 0.33cvss 6.1epss 0.00

    Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the auth_profile.php JavaScript context. This issue has been fixed in version 1.2.31.

  • CVE-2026-39899MedJun 24, 2026
    Cacti (software)
    Cacti
    risk 0.27cvss 5.3epss 0.00

    Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Path Traversal via filename parameter in package_import.php. This issue has been fixed in version 1.2.31.

  • CVE-2025-8106Jun 24, 2026
    risk 0.00cvss —epss —

    Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • CVE-2025-60474HigJun 24, 2026
    Gpac
    Gpac
    risk 0.42cvss 7.5epss 0.01

    A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.

  • CVE-2025-60467HigJun 24, 2026
    Gpac
    Gpac
    risk 0.42cvss 7.5epss 0.01

    A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted media file.

  • CVE-2026-9779HigJun 24, 2026
    Aten
    Unizon
    risk 0.47cvss 7.2epss 0.01

    ATEN Unizon doCryptoHugeFileToFile Improper Verification of Cryptographic Signature Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this…

  • CVE-2026-9778HigJun 24, 2026
    Aten
    Unizon
    risk 0.47cvss 7.2epss 0.02

    ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw…

  • CVE-2026-9777HigJun 24, 2026
    Aten
    Unizon
    risk 0.47cvss 7.2epss 0.02

    ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists…

  • CVE-2026-9776HigJun 24, 2026
    Aten
    Unizon
    risk 0.49cvss 7.5epss 0.02

    ATEN Unizon writeFileToHttpServletResponse Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ATEN Unizon. Authentication is not required to exploit this…

  • CVE-2026-9775MedJun 24, 2026
    Aten
    Unizon
    risk 0.43cvss 6.5epss 0.02

    ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists…

  • CVE-2026-9774MedJun 24, 2026
    Aten
    Unizon
    risk 0.42cvss 6.5epss 0.02

    ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of ATEN Unizon. Authentication is required to exploit this vulnerability. The specific flaw exists…

  • CVE-2026-9773HigJun 24, 2026
    Unraid
    Unraid
    risk 0.57cvss 8.8epss 0.02

    Unraid Web Server ToggleState Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists…

  • CVE-2026-9772HigJun 24, 2026
    Unraid
    Unraid
    risk 0.57cvss 8.8epss 0.02

    Unraid Web Server FileUpload Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Unraid. Authentication is required to exploit this vulnerability. The specific flaw exists…

  • CVE-2026-55762HigJun 24, 2026
    RocketChat
    Rocket.chat
    risk 0.46cvss 8.1epss 0.00

    Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /api/v1/fingerprint REST endpoint enforces authentication (authRequired: true) but performs no authorization check. Any…

  • CVE-2026-55759HigJun 24, 2026
    RocketChat
    Rocket.chat
    risk 0.41cvss 7.4epss 0.00

    Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, Rocket.Chat's Apple Sign-In handler verifies JWT signatures but skips claims validation. Any Apple-signed JWT with a non-empty iss…

  • CVE-2026-55666CriJun 24, 2026
    RocketChat
    Rocket.chat
    risk 0.53cvss —epss 0.00

    Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in apps/meteor/app/apple/server/loginHandler.ts, handleIdentityToken parses a JWT issued by Apple during the OAuth flow. The try…

  • CVE-2026-55570CriJun 24, 2026
    Siyuan Note
    Siyuan
    risk 0.52cvss 9.0epss 0.01

    SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, it does not escape the untrusted fields (name, version, author, description) when they are serialized into the data-obj HTML attribute of each marketplace card. Because the attribute is single-quoted…

  • CVE-2026-55455CriJun 24, 2026
    Appsmithorg
    Appsmith
    risk 0.52cvss 9.1epss 0.00

    Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 2.1, the outbound HTTP host filter applied by WebClientUtils (used by the REST API and GraphQL datasource plugins) validates hosts against an exact-match string denylist. The comprehensive…