Zero Radar
Live, last checked 41 of 42 sources reachablelast new information

Every vulnerability from the last 7 days, including minor ones. Exploited means attackers already use it, Fixed means a patched version exists. How we rate entries

Today, Monday 2 November UTC

  1. Critical
    Linksys E8450 router can be crashed or taken over remotely
    NewNo fix yetOfficial sourceCVE-2026-120283
  2. High
    A vulnerability was determined in WAVLINK WN536AX6-A V260507.
    NewOfficial sourceCVE-2026-120282
  3. Critical
    WAVLINK WN536AX6-A router: remote stack overflow in OpenVPN handler
    NewOfficial sourceCVE-2026-120281
  4. Critical
    WAVLINK WN536AX6-A router lets remote attackers run system commands
    NewOfficial sourceCVE-2026-120280
  5. Critical
    WAVLINK WN536AX6-A router: remote command injection flaw
    NewOfficial sourceCVE-2026-120279
  6. Critical
    WAVLINK WN536AX6-A router: remote command injection via WireGuard group name
    NewOfficial sourceCVE-2026-120277
  7. Critical
    WAVLINK WN536AX6-A router web interface can run attacker commands
    NewOfficial sourceCVE-2026-120276

Yesterday, Sunday 1 November UTC

  1. High
    Improper neutralization of input during web page generation in Apache Wicket.
    NewOfficial sourceCVE-2026-95863
  2. High
    Improper neutralization of input during web page generation in Apache Wicket.
    NewOfficial sourceCVE-2026-84231
  3. High
    Allocation of resources without limits or throttling in Apache Wicket.
    NewOfficial sourceCVE-2026-84170
  4. High
    Memory allocation with an excessive size value in Apache Wicket.
    NewOfficial sourceCVE-2026-83594
  5. High
    Improper encoding or escaping of output in Apache Wicket.
    NewOfficial sourceCVE-2026-83559
  6. High
    Improper neutralization of input during web page generation in Apache Wicket.
    NewOfficial sourceCVE-2026-83539
  7. High
    Improper neutralization of input during web page generation in Apache Wicket.
    NewOfficial sourceCVE-2026-82956
  8. High
    Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of…
    NewOfficial sourceCVE-2026-111089
  9. High
    Session fixation in Apache Wicket.
    NewOfficial sourceCVE-2026-82840
  10. High
    Apache Wicket: 19 security flaws fixed in 8.20.0, 9.25.0, 10.12.0
    New1 source, unconfirmed
  11. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2025-53905
  12. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2025-53906
  13. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-25749
  14. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-26269
  15. High
    Debian DSA-6600-1: multiple Vim flaws allow code execution via crafted files
    Official sourceCVE-2026-28417
  16. High
    A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48.
    Official sourceCVE-2026-120241
  17. High
    A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120240
  18. High
    A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120239
  19. High
    A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0.
    Official sourceCVE-2026-120238
  20. Medium
    Google::Auth Perl: SSRF via credential_source URLs; missing OAuth state check
    1 source, unconfirmedCVE-2026-74759
  21. Medium
    Google::Auth Perl: SSRF via credential_source URLs; missing OAuth state check
    1 source, unconfirmedCVE-2026-74760
  22. High
    Perl HTTP::Session lets attackers inject commands into memcached
    Fixed in HTTP::Session 0.54 or later · out Official, 2 sourcesCVE-2026-13575
  23. Leak
    Alleged leak of Anthropic model checkpoint on Hugging Face
    Unverified
  24. High
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File…
    Official sourceCVE-2026-66570
  25. Critical
    BookIt WordPress plugin has SQL injection flaw
    Official, 2 sourcesCVE-2026-62048
  26. Critical
    Prefab UI sandbox lets callers read and write server files
    Fix available · out Official sourceCVE-2026-120338
  27. High
    A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2.
    Official sourceCVE-2026-120232
  28. High
    A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120231
  29. High
    A vulnerability was found in WAVLINK WN701AE 260105.
    Official sourceCVE-2026-120230
  30. High
    A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0.
    Official sourceCVE-2026-120229
  31. High
    A flaw has been found in WAVLINK WN553X1-B V260403_2.0.0.
    Official sourceCVE-2026-120228
  32. Critical
    Beta9: tenants can reach other tenants' volumes on the worker machine
    Fix available · out Official sourceCVE-2026-120308
  33. Critical
    Beta9 worker file API lets tenants reach worker host files
    Fixed in Beta9 worker 0.1.756 · out Official sourceCVE-2026-120307
  34. Critical
    Beta9 image builds let tenants reach build worker internals
    Fixed in Beta9 worker 0.1.756 · out Official sourceCVE-2026-120306
  35. High
    A vulnerability was detected in WAVLINK WN701AE M01AE_V260105.
    Official sourceCVE-2026-120227
  36. High
    A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.1.
    Official sourceCVE-2026-120225
  37. High
    A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.1.
    Official sourceCVE-2026-120224
  38. Critical
    WAVLINK WL-WN530BE1-A router: remote command injection flaw
    Official, 2 sourcesCVE-2026-120198
  39. High
    A flaw has been found in WAVLINK WL-WN530HG4B M_V260724.
    Official sourceCVE-2026-120197
  40. High
    A vulnerability was detected in WAVLINK WN579X3-D V250402.
    Official sourceCVE-2026-120196
  41. Critical
    WAVLINK WL-WN579A3-A router lets remote attackers run system commands
    Official, 2 sourcesCVE-2026-120195
  42. High
    XS::libbrotli (Perl) before 1.2.1.0: out-of-bounds write in bundled brotli decoder
    1 source, unconfirmedCVE-2026-115946
  43. Critical
    D-Link DIR-505 router: remote memory overflow in file upload service
    Official, 2 sourcesCVE-2026-120189

Saturday 31 October UTC

  1. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78188
  2. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78189
  3. High
    WebDyne for Perl: path traversal runs out-of-root .psp files; cookie and XSS flaws
    1 source, unconfirmedCVE-2026-78190
  4. Critical
    AJ-Report signs share links with a secret built into the code, allowing remote code execution
    Official, 2 sourcesCVE-2026-120209
  5. High
    libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in…
    Official sourceCVE-2026-120208
  6. High
    Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete…
    Official sourceCVE-2026-120207
  7. High
    Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows…
    Official sourceCVE-2026-120205
  8. High
    ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to…
    Official sourceCVE-2026-120203
  9. High
    Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious…
    Official sourceCVE-2026-120202
  10. Critical
    Jpom lets anyone without a login become a super admin
    Official, 2 sourcesCVE-2026-120201
Show 100 more