Zero Radar
Live, last checked 41 of 42 sources reachablelast new information

Every vulnerability from the last 7 days, including minor ones. Exploited means attackers already use it, Fixed means a patched version exists. How we rate entries

Today, Monday 2 November UTC

  1. High
    A vulnerability was identified in Termix-SSH Termix up to 2.9.2.
    NewOfficial sourceCVE-2026-120322
  2. Critical
    Linksys E8450 router can be crashed or taken over remotely
    NewNo fix yetOfficial sourceCVE-2026-120283
  3. High
    A vulnerability was determined in WAVLINK WN536AX6-A V260507.
    NewOfficial sourceCVE-2026-120282
  4. Critical
    WAVLINK WN536AX6-A router: remote stack overflow in OpenVPN handler
    NewOfficial sourceCVE-2026-120281
  5. Critical
    WAVLINK WN536AX6-A router lets remote attackers run system commands
    NewOfficial sourceCVE-2026-120280
  6. Critical
    WAVLINK WN536AX6-A router: remote command injection flaw
    NewOfficial sourceCVE-2026-120279
  7. Critical
    WAVLINK WN536AX6-A router: remote command injection via WireGuard group name
    NewOfficial sourceCVE-2026-120277
  8. Critical
    WAVLINK WN536AX6-A router web interface can run attacker commands
    NewOfficial sourceCVE-2026-120276

Yesterday, Sunday 1 November UTC

  1. High
    Improper neutralization of input during web page generation in Apache Wicket.
    NewOfficial sourceCVE-2026-95863
  2. High
    Improper neutralization of input during web page generation in Apache Wicket.
    NewOfficial sourceCVE-2026-84231
  3. High
    Allocation of resources without limits or throttling in Apache Wicket.
    NewOfficial sourceCVE-2026-84170
  4. High
    Memory allocation with an excessive size value in Apache Wicket.
    NewOfficial sourceCVE-2026-83594
  5. High
    Improper encoding or escaping of output in Apache Wicket.
    NewOfficial sourceCVE-2026-83559
  6. High
    Improper neutralization of input during web page generation in Apache Wicket.
    NewOfficial sourceCVE-2026-83539
  7. High
    Improper neutralization of input during web page generation in Apache Wicket.
    NewOfficial sourceCVE-2026-82956
  8. High
    Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of…
    NewOfficial sourceCVE-2026-111089
  9. High
    Session fixation in Apache Wicket.
    NewOfficial sourceCVE-2026-82840
  10. High
    Apache Wicket: 19 security flaws fixed in 8.20.0, 9.25.0, 10.12.0
    New1 source, unconfirmed
  11. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2025-53905
  12. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2025-53906
  13. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-25749
  14. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-26269
  15. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-28417
  16. High
    A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48.
    Official sourceCVE-2026-120241
  17. High
    A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120240
  18. High
    A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120239
  19. High
    A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0.
    Official sourceCVE-2026-120238
  20. Medium
    Google::Auth Perl: SSRF via credential_source URLs; missing OAuth state check
    1 source, unconfirmedCVE-2026-74759
  21. Medium
    Google::Auth Perl: SSRF via credential_source URLs; missing OAuth state check
    1 source, unconfirmedCVE-2026-74760
  22. High
    Perl HTTP::Session lets attackers inject commands into memcached
    Fixed in HTTP::Session 0.54 or later · out Official, 2 sourcesCVE-2026-13575
  23. Leak
    Alleged leak of Anthropic model checkpoint on Hugging Face
    Unverified
  24. High
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File…
    Official sourceCVE-2026-66570
  25. Critical
    BookIt WordPress plugin has SQL injection flaw
    Official, 2 sourcesCVE-2026-62048
  26. Critical
    Prefab UI sandbox lets callers read and write server files
    Fix available · out Official sourceCVE-2026-120338
  27. High
    A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2.
    Official sourceCVE-2026-120232
  28. High
    A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120231
  29. High
    A vulnerability was found in WAVLINK WN701AE 260105.
    Official sourceCVE-2026-120230
  30. High
    A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0.
    Official sourceCVE-2026-120229
  31. High
    A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120228
  32. Critical
    Beta9: tenants can reach other tenants' volumes on the worker machine
    Fix available · out Official sourceCVE-2026-120308
  33. Critical
    Beta9 worker file API lets tenants reach worker host files
    Fixed in Beta9 worker 0.1.756 · out Official sourceCVE-2026-120307
  34. Critical
    Beta9 image builds let tenants reach build worker internals
    Fixed in Beta9 worker 0.1.756 · out Official sourceCVE-2026-120306
  35. High
    A vulnerability was detected in WAVLINK WN701AE M01AE_V260105.
    Official sourceCVE-2026-120227
  36. High
    A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1.
    Official sourceCVE-2026-120225
  37. High
    A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1.
    Official sourceCVE-2026-120224
  38. Critical
    WAVLINK WL-WN530BE1-A router: remote command injection flaw
    Official, 2 sourcesCVE-2026-120198
  39. High
    A flaw has been found in WAVLINK WL-WN530HG4B M_V260724.
    Official sourceCVE-2026-120197
  40. High
    A vulnerability was detected in WAVLINK WN579X3-D V250402.
    Official sourceCVE-2026-120196
  41. Critical
    WAVLINK WL-WN579A3-A router lets remote attackers run system commands
    Official, 2 sourcesCVE-2026-120195
  42. High
    XS::libbrotli (Perl) before 1.2.1.0: out-of-bounds write in bundled brotli decoder
    1 source, unconfirmedCVE-2026-115946
  43. Critical
    D-Link DIR-505 router: remote memory overflow in file upload service
    Official, 2 sourcesCVE-2026-120189

Saturday 31 October UTC

  1. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78188
  2. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78189
  3. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78190
  4. Critical
    AJ-Report signs share links with a secret built into the code, allowing remote code execution
    Official, 2 sourcesCVE-2026-120209
  5. High
    libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in…
    Official sourceCVE-2026-120208
  6. High
    Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete…
    Official sourceCVE-2026-120207
  7. High
    Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows…
    Official sourceCVE-2026-120205
  8. High
    ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to…
    Official sourceCVE-2026-120203
  9. High
    Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious…
    Official sourceCVE-2026-120202
  10. Critical
    Jpom lets anyone without a login become a super admin
    Official, 2 sourcesCVE-2026-120201
  11. High
    Northflank breach exposed customers' AI API keys to misuse
    Attacks reported (BleepingComputer)1 source, unconfirmed
  12. Unrated
    Chromium SVG improper input validation flaw (CVE-2026-118304) affects Edge and Chrome
    Official sourceCVE-2026-118304
  13. Unrated
    Chromium: use-after-free in Video component (CVE-2026-118313) affects Edge
    Official sourceCVE-2026-118313
  14. Unrated
    Chromium/Edge: memory corruption in Media component (CVE-2026-118311)
    Official sourceCVE-2026-118311
  15. High
    Chromium HTML memory corruption flaw (CVE-2026-118317) affects Chrome and Edge
    Official sourceCVE-2026-118317
  16. Unrated
    Chromium SVG input validation flaw (CVE-2026-118315) affects Chrome and Edge
    Official sourceCVE-2026-118315
  17. Unrated
    Chromium Paint memory corruption (CVE-2026-118312) affects Chrome and Edge
    Official sourceCVE-2026-118312
  18. Unrated
    Chromium V8 improper input validation flaw affects Chrome and Edge
    Official sourceCVE-2026-118316
  19. Unrated
    Chromium V8: improper access control flaw (CVE-2026-118318) affects Edge and Chrome
    Official sourceCVE-2026-118318
  20. High
    Chromium/Microsoft Edge: use-after-free in SVG handling (CVE-2026-118308)
    Official sourceCVE-2026-118308
  21. Unrated
    Chromium Views: improper input validation flaw (CVE-2026-118310)
    Official sourceCVE-2026-118310
  22. Unrated
    Chromium/Edge: CVE-2026-118305 memory corruption in Turbolev
    Official sourceCVE-2026-118305
  23. Unrated
    Chromium Paint use-after-free (CVE-2026-118307) fixed in Chrome and Edge
    Official sourceCVE-2026-118307
  24. Unrated
    Chromium FileSystem memory corruption flaw (CVE-2026-118306) affects Chrome and Edge
    Official sourceCVE-2026-118306
  25. High
    Chromium Skia memory corruption (CVE-2026-118319) affects Chrome and Edge
    Official sourceCVE-2026-118319
  26. Unrated
    Chromium ANGLE memory corruption flaw affects Chrome and Microsoft Edge
    Official sourceCVE-2026-118322
  27. Unrated
    Chromium WebRTC improper input validation flaw affects Chrome and Edge
    Official sourceCVE-2026-118328
  28. Unrated
    Chromium: memory corruption in Media component (CVE-2026-118327), fixed in Edge
    Official sourceCVE-2026-118327
  29. Unrated
    Chromium V8 memory corruption flaw (CVE-2026-118320) affects Chrome and Edge
    Official sourceCVE-2026-118320
  30. High
    Chromium ImageCapture use-after-free (CVE-2026-118334) affects Chrome and Edge
    Official sourceCVE-2026-118334
  31. Unrated
    Chromium: use-after-free in Browser component (CVE-2026-118330), affects Edge
    Official sourceCVE-2026-118330
  32. Unrated
    Chromium: missing authorization in Video component (CVE-2026-118333)
    Official sourceCVE-2026-118333
  33. Unrated
    Chromium Metrics component: improper input validation (CVE-2026-118335)
    Official sourceCVE-2026-118335
  34. Unrated
    Chromium ANGLE improper input validation flaw (CVE-2026-118329) fixed in Edge and Chrome
    Official sourceCVE-2026-118329
  35. Unrated
    Chromium Headless: improper input validation flaw (CVE-2026-118336)
    Official sourceCVE-2026-118336
  36. Unrated
    Chromium/Edge: improper access control in Forms (CVE-2026-118337)
    Official sourceCVE-2026-118337
  37. Unrated
    Chromium/Edge: use-after-free in Animation component (CVE-2026-118338)
    Official sourceCVE-2026-118338
  38. Unrated
    Chromium Skia memory corruption flaw (CVE-2026-118340) affects Chrome and Edge
    Official sourceCVE-2026-118340
  39. High
    Chromium: use-after-free in Modularization lets web pages run code
    Official sourceCVE-2026-118341
  40. Unrated
    Chromium Editing out-of-bounds write (CVE-2026-118342) affects Chrome and Edge
    Official sourceCVE-2026-118342
  41. Unrated
    Chromium ReadingList improper input validation flaw (CVE-2026-118343)
    Official sourceCVE-2026-118343
  42. High
    Chromium Layout use-after-free (CVE-2026-118344) affects Chrome and Edge
    Official sourceCVE-2026-118344
  43. Unrated
    Chromium PDFium use-after-free (CVE-2026-118345) fixed in Edge and Chrome
    Official sourceCVE-2026-118345
  44. Unrated
    Chromium FileSystem use-after-free (CVE-2026-118347) affects Chrome and Edge
    Official sourceCVE-2026-118347
  45. Unrated
    Chromium Skia improper input validation flaw (CVE-2026-118348) fixed in Edge
    Official sourceCVE-2026-118348
  46. High
    Chromium Payments memory corruption flaw (CVE-2026-118349) affects Chrome and Edge
    Official sourceCVE-2026-118349
  47. Unrated
    Chromium Turbolev use-after-free (CVE-2026-118350) affects Microsoft Edge
    Official sourceCVE-2026-118350
  48. Unrated
    Chromium Skia memory corruption flaw (CVE-2026-118351) affects Chrome and Edge
    Official sourceCVE-2026-118351
  49. Unrated
    Chromium/Edge: memory corruption in Cache component (CVE-2026-118352)
    Official sourceCVE-2026-118352
  50. Unrated
    Chromium: use-after-free in Paint component (CVE-2026-118353)
    Official sourceCVE-2026-118353
  51. Unrated
    Chromium Skia improper input validation flaw (CVE-2026-118354) affects Edge
    Official sourceCVE-2026-118354
  52. High
    Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server…
    Official sourceCVE-2026-102212
  53. High
    Android SMS of Death: public PoC lets texts crash unpatched phones
    1 source, unconfirmedCVE-2026-58882
  54. High
    Chainalysis customer contact data exposed in breach
    Attacks reported (The Hacker News, BleepingComputer)2 independent sources
  55. High
    The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution…
    Official sourceCVE-2026-76010
  56. High
    A flaw was found in json-glib.
    Official sourceCVE-2026-120194
  57. High
    The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site…
    Official sourceCVE-2026-120114
  58. High
    The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions…
    Official sourceCVE-2026-109197
  59. High
    The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including,…
    Official sourceCVE-2026-120075
  60. Critical
    SimpleForm WordPress plugin lets anyone upload executable files
    Official, 2 sourcesCVE-2026-118235
  61. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-117681
  62. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-116964
  63. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-116086
  64. High
    A flaw was found in konflux-ci.
    Official sourceCVE-2026-114217
  65. High
    The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…
    Official sourceCVE-2026-110530
  66. Critical
    Acadlix LMS WordPress plugin lets logged-in users delete server files
    Official, 2 sourcesCVE-2026-103882
  67. High
    The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post…
    Official sourceCVE-2026-120070
  68. Critical
    Uncanny Toolkit for LearnDash WordPress plugin lets attackers skip login checks
    Official, 2 sourcesCVE-2026-119096
  69. High
    The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to…
    Official sourceCVE-2026-118057
  70. Critical
    Project Manager WordPress plugin lets anyone run code on the server
    Official, 2 sourcesCVE-2026-116512
  71. High
    The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject…
    Official sourceCVE-2026-107759
  72. High
    The Rox Appointment Booking – Appointment Booking Scheduling Solution plugin for WordPress is vulnerable to Privilege…
    Official sourceCVE-2026-104012
  73. High
    The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Authentication Bypass in all versions up…
    Official sourceCVE-2026-103898
  74. Critical
    Apache MINA 3.0 codec can let attackers run code via untrusted Java objects
    No fix yetOfficial, 3 sourcesCVE-2026-118636
  75. Critical
    Popup Builder WordPress plugin lets anyone trash your popups
    Official, 2 sourcesCVE-2026-89270
  76. High
    The Mail logging & Catcher plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and…
    Official sourceCVE-2026-120040
  77. High
    The FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce plugin for WordPress is vulnerable…
    Official sourceCVE-2026-119163
  78. High
    The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored…
    Official sourceCVE-2026-119162
  79. High
    The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to…
    Official sourceCVE-2026-119089
  80. High
    The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-119065
  81. High
    The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all…
    Official sourceCVE-2026-118070
  82. Critical
    WP Booking System plugin lets low-level users delete calendar notes
    Official, 2 sourcesCVE-2026-116557
  83. High
    The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-116548
  84. High
    The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter…
    Official sourceCVE-2026-116522
  85. High
    The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-115840
  86. High
    The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all…
    Official sourceCVE-2026-111254
  87. Critical
    PDF Invoice for WooCommerce plugin lets anonymous attackers run code
    Official, 2 sourcesCVE-2026-109220
  88. High
    The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…
    Official sourceCVE-2026-107750
  89. High
    The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments…
    Official sourceCVE-2026-107653
  90. High
    WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3.
    Official sourceCVE-2026-119977
  91. High
    The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment /…
    Official sourceCVE-2026-116520
  92. High
    The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is…
    Official sourceCVE-2026-109997
  93. High
    The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply…
    Official sourceCVE-2026-109234
  94. High
    ChatGPT shared links can run attacker code and read private chats
    1 source, unconfirmed
  95. Leak
    Scribd reportedly breached, customer data may be exposed
    Unverified
  96. High
    Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of SoftIron…
    Official sourceCVE-2026-116755
  97. High
    Apache Thrift Java library can be made to recurse without limit
    Fixed in 0.24.0 · out Official, 2 sourcesCVE-2026-120135
  98. High
    The File Force Download module for Drupal 7 implements hook_file_download() to add a Content-Disposition header when a file…
    Official sourceCVE-2026-110176
  99. High
    GNU mtools: memory write error when parsing FAT disk entries
    Fixed in GNU mtools 4.0.50 · out Official, 2 sourcesCVE-2026-118384
  100. Critical
    Assent Sign in with Apple lets attackers impersonate other users
    Fixed in assent 0.3.2 · out Official sourceCVE-2026-117656

Friday 30 October UTC

  1. Unrated
    Debian DSA-6598-1: Thunderbird security update fixes code execution flaws
    Official source
  2. High
    Coop is an open source review and moderation tool from ROOST.
    Official sourceCVE-2026-63398
  3. High
    Coop is an open source review and moderation tool from ROOST.
    Official sourceCVE-2026-63396
  4. High
    OpenSearch SQL supports querying OpenSearch data using SQL and Piped Processing Language.
    Official sourceCVE-2026-63393
  5. High
    TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language.
    Official sourceCVE-2026-63378
  6. Critical
    TAKO Okta AI agent lets strangers create the admin account before setup
    Fixed in 3.0.1-beta · out Official sourceCVE-2026-63377
  7. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63346
  8. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63345
  9. High
    Refitter is a tool for generating a C# REST API client using the Refit library.
    Official sourceCVE-2026-63344
Show 100 more