Trending Vulnerabilities

CVE-2026-19478 is a critical code injection vulnerability in GitLab Community Edition and Enterprise Edition affecting self-managed installations. It impacts versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4. Under certain conditions, GitLab’s GraphQL handling allowed attacker-controlled input associated with a GraphQL directive to reach unsafe server-side method resolution, enabling unauthorized state-changing operations. Publicly available technical analysis indicates the issue is tied to the @gl_introduced directive and fallback field resolution behavior in GitLab’s GraphQL implementation, where attacker-controlled missing field names could be turned into method invocations on backend objects without proper authorization safeguards. Because public projects are queryable without authentication and the vulnerable directive processing occurred before effective field-level authorization in the described conditions, the flaw could be exploited remotely by an unauthenticated attacker.

CVE-2026-12569 is a critical remote code execution vulnerability affecting PTC Windchill PDMLink and PTC FlexPLM, including all CPS versions and releases prior to 11.0 M030. The flaw is attributed to deserialization of untrusted data and has also been described as an improper input validation issue in network-exposed request handling. A remote attacker can send a specially crafted request to a vulnerable instance and trigger arbitrary code execution without authentication. Reporting on in-the-wild exploitation indicates the vulnerability has been used to deploy JSP-based server-side implants and to execute attacker-supplied Java code within the application context.

CVE-2026-65400 is an improper authentication vulnerability in Apple macOS affecting the built-in Screen Sharing service. The issue stems from flawed authentication state management that can allow a network-based attacker to authenticate to Screen Sharing without valid credentials. The vulnerable path is reachable prior to successful authentication, and reporting indicates the flaw can be triggered through crafted network interaction with the Screen Sharing service. Apple fixed the issue by improving state management in macOS Sonoma 14.8.9, macOS Sequoia 15.7.9, and macOS Tahoe 26.6.1.

CVE-2026-33824 is a critical remote code execution vulnerability in Microsoft Windows Internet Key Exchange (IKE) Service Extensions, also referred to as the Windows IKE Extension or MS-IKEE. The flaw is a double free condition in the IKEv2 processing path within the IKE service extensions component, reported as affecting supported Windows 10, Windows 11, and Windows Server releases. An unauthenticated remote attacker can trigger the vulnerable condition by sending specially crafted network packets to a target system with IKEv2 enabled. Public reporting indicates the vulnerable surface is exposed on systems acting as IKEv2 responders, such as VPN and IPsec infrastructure, and that exploitation is reachable over the standard IKE/IPsec UDP ports. Successful exploitation can result in arbitrary code execution in the context of LocalSystem.

CVE-2026-24301 is a critical information disclosure vulnerability in Microsoft Copilot Personal, also referred to as CoSnitch. The issue is classified by Microsoft as improper neutralization of special elements used in a command. Reported exploitation involved a crafted Copilot URL that combined prompt-related parameters to cause attacker-supplied instructions to execute automatically within the victim’s authenticated Copilot session after a single click. The injected prompt operated with the same access already granted to the user’s Copilot instance and could query connected services and Copilot-held data, including mail, calendar information, cloud storage metadata, prior Copilot conversations, and persistent memory content. The retrieved data could then be encoded and exfiltrated through Copilot’s built-in URL retrieval capability, producing outbound traffic that resembled normal assistant activity. Reporting on the issue also associated the broader CoSnitch research with a separate persistent memory-poisoning path through web summarization, but the CVE record specifically describes the command-injection-driven information disclosure flaw in Microsoft Copilot.

CVE-2026-64849 is a critical unauthenticated server-side request forgery vulnerability in MLflow affecting versions prior to 3.15.0. The flaw is exposed through the POST /api/2.0/mlflow/webhooks/{id}/test endpoint used for model-registry webhook testing. MLflow validates only the originally supplied webhook URL via _validate_webhook_url() in mlflow/utils/validation.py, but the webhook delivery logic in mlflow/webhooks/delivery.py follows redirects and re-resolves the hostname without pinning the previously validated destination address. As a result, an attacker can supply an initially acceptable external URL that redirects, or leverage DNS rebinding, to cause the MLflow server to issue requests to internal, loopback, link-local, or cloud metadata services. Because the webhook test behavior returns the upstream HTTP status and response body, the SSRF is not blind and can be used as a full-read primitive against reachable internal resources.

CVE-2026-59310 is a critical directory traversal vulnerability in the Syslog server component of VMware vCenter. The flaw allows a remote, unauthenticated attacker with network access to a vulnerable vCenter instance to exploit improper restriction of pathnames and write attacker-controlled content to unintended locations on the underlying appliance. Reporting on observed exploitation indicates the issue can be leveraged to place malicious cron content into privileged execution paths, resulting in arbitrary command execution on the vCenter Server Appliance, including root-level execution without a normal login. The vulnerability affects VMware vCenter and related VMware by Broadcom offerings that embed the vulnerable vCenter component, and carries a CVSS v3.1 score of 9.8.

CVE-2026-55040 is a critical weak-authentication vulnerability in on-premises Microsoft SharePoint Server that allows remote unauthenticated attackers to bypass SharePoint’s authentication protections by exploiting flaws in the JSON Web Token validation pipeline. The issue affects SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition prior to the fixed builds released in July 2026; SharePoint Online is not affected. Public technical analysis attributes the bypass to multiple validation weaknesses in SharePoint’s JWT handling, including acceptance of an outer token using an unsigned algorithm mode, improper key resolution based on certificate thumbprint data, insufficient trust validation of the resolved certificate, and failure to properly verify a non-empty token signature. By forging a token that SharePoint accepts as legitimate, an attacker can impersonate arbitrary site users, including administrators, and perform authenticated operations without valid credentials.

CVE-2026-42897 is an actively exploited cross-site scripting vulnerability in the Outlook Web Access component of on-premises Microsoft Exchange Server. The flaw is caused by improper neutralization of attacker-controlled input during web page generation when Exchange renders email content in OWA, allowing malicious HTML or script content embedded in a specially crafted email to execute in the victim’s browser. Exploitation occurs in the context of the victim’s authenticated OWA session after the target opens, and in some reporting previews, the crafted message in a vulnerable OWA client. Affected products include on-premises Exchange Server Subscription Edition, Exchange Server 2016, and Exchange Server 2019; Exchange Online is not affected. The vulnerability has been described by Microsoft as a spoofing issue, but the observed exploitation behavior is browser-side arbitrary JavaScript execution within OWA.

CVE-2026-19490 is a critical authentication bypass vulnerability in NetScaler ADC and NetScaler Gateway. The issue has been described as an authentication bypass using an alternate path, indicating that an attacker can reach protected functionality through an unintended request path or authentication flow that does not correctly enforce access controls. The vulnerability affects NetScaler ADC versions 14.1 through 73.32 and 13.1 through 63.21, and NetScaler Gateway versions 14.1 through 73.32 and 13.1 through 63.21. Available information indicates the vulnerable condition is associated with deployments using SAML authentication together with authentication or VPN virtual server configurations.

CVE-2026-15748 is a critical arbitrary file upload vulnerability in the Forminator Forms plugin for WordPress affecting all versions up to and including 1.56.1. The flaw is centered in the plugin’s file upload handling, particularly the handle_file_upload function, and is caused by insufficient file type validation combined with unsafe trust in attacker-controlled form field configuration during public form submission processing. Exploitation involves forging upload-related field metadata through a Select field so that the submission handler treats attacker-supplied data as a legitimate upload configuration. The dangerous-extension filtering logic can then be bypassed because it relies on exact-key matching and fails to properly handle pipe-separated alternative MIME type keys. As a result, an unauthenticated attacker can upload files of a dangerous type, including executable PHP content. Where the uploaded file is stored in a web-accessible location that permits script execution, the vulnerability can be escalated to remote code execution under the web server context.

CVE-2025-62593 is a critical remote code execution vulnerability in Ray affecting versions prior to 2.52.0. The flaw is rooted in insufficient protection of Ray’s dashboard and job-management HTTP API against browser-originated requests. Affected versions relied on a weak browser-detection mechanism that treated requests as browser traffic based on whether the User-Agent header began with "Mozilla". In Firefox and Safari, this assumption can be bypassed because the attack scenario allows modification of the User-Agent value, defeating the intended guard. When combined with DNS rebinding, an attacker-controlled webpage can cause a victim’s browser to send unauthorized requests to a locally running or otherwise reachable Ray instance and submit malicious jobs for execution. Because Ray’s job interface is designed to launch workloads, successful exploitation can result in arbitrary command execution with the privileges of the Ray process. The issue is especially relevant to developers using Ray in development or testing environments and to reachable internal Ray instances exposed to the victim browser.

CVE-2026-60702 is a critical vulnerability in the Core component of Oracle WebLogic Server affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw is remotely exploitable over the T3 and IIOP protocols by an attacker who has low-privileged authenticated access. Successful exploitation allows compromise of Oracle WebLogic Server and can lead to complete server takeover. Oracle indicates scope change, meaning exploitation may also significantly affect additional connected or dependent products beyond the vulnerable WebLogic instance. The vulnerability has a CVSS 3.1 base score of 9.9 with high impact to confidentiality, integrity, and availability.

CVE-2026-76008 is a remotely exploitable stack-based buffer overflow in Comfast CF-N1-S version 2.6.0.1. The flaw is in the URI parameter parsing component, specifically in the get_para_from_uri function within the /cgi-bin/mbox-config CGI handler. By supplying crafted values for the width or height parameters, an attacker can trigger improper bounds handling on stack-allocated memory, resulting in memory corruption. The issue is reachable over the network without prior authentication according to the available vulnerability metadata.

CVE-2026-75976 is a remotely exploitable stack-based buffer overflow vulnerability in TRENDnet TEW-823DRU firmware version 1.1.02b01. The flaw is located in the strcpy handling within /cgi-bin/wan.cgi in the NVRAM-related processing path. By supplying a crafted value to the wan_l2tp_password parameter, an attacker can trigger an out-of-bounds write on the stack due to unsafe copying of attacker-controlled data into a fixed-size stack buffer without proper bounds checking. The vulnerability is reachable over the network and has been reported as requiring low privileges. Successful exploitation can compromise confidentiality, integrity, and availability, and public exploit code is available.

CVE-2026-19650 is a high-severity cross-site request forgery vulnerability in GitLab Community Edition and Enterprise Edition. It affects the GraphQL multiplex query handler due to improper request validation that can allow state-changing GraphQL mutations to be executed through GET requests under certain conditions. Available technical reporting indicates the flaw is tied to multiplex query handling in which validation and execution can become inconsistent, breaking the intended protection that permits GET only for read-only GraphQL operations. As a result, an unauthenticated attacker can induce a victim browser to send a crafted request that causes unauthorized GraphQL mutations to run against the server.

CVE-2026-47627 is a path traversal vulnerability in NVIDIA Triton Inference Server for Linux affecting versions 0.0 through 26.05. The flaw is classified as CWE-22, indicating improper limitation of a pathname to a restricted directory. Specific vulnerable functions or code paths are not publicly described in the available information. NVIDIA states that successful exploitation may lead to denial of service.

CVE-2026-73930 is a critical vulnerability in Oracle Fusion Middleware Helidon, specifically the Imperative Web Server component, affecting supported version 4.5.3. The issue is remotely exploitable over HTTP by an unauthenticated attacker and requires no user interaction. Oracle describes the flaw as easily exploitable and indicates that successful exploitation can compromise Helidon, with scope change implying potential impact beyond the vulnerable component itself. Publicly available information does not provide the precise vulnerable function or root-cause class, so a more specific technical characterization is currently not available.

CVE-2026-66602 is a Cross-Site Request Forgery vulnerability in the DevItems HashBar – WordPress Notification Bar plugin for WordPress. The issue affects versions through 2.0.0, while version 2.0.1 is identified as unaffected. The available information indicates that the plugin exposes one or more state-changing actions that can be triggered through forged requests submitted in the browser context of an authenticated WordPress user. No specific vulnerable function or endpoint has been identified in the available information.

CVE-2026-74804 is a critical unauthenticated SQL injection vulnerability affecting the Zoo extension for Joomla before version 4.1.64. The flaw is present in ItemController::element(), where attacker-controlled request data from the filter_type parameter and the type_filter array is incorporated directly into SQL conditions equivalent to a.type = "..." and a.type IN ("..."), without proper quoting or escaping. Because the vulnerable code path accepts untrusted input and concatenates it into database queries, a remote attacker can manipulate the resulting SQL statement. The issue is exploitable over the network without authentication and can lead to unauthorized interaction with the backend database.

CVE-2026-76003 is a remotely exploitable stack-based buffer overflow vulnerability in UTT HiPER 1200GW through version 2.5.3-170306. The flaw is present in the handling of input to the strcpy function within the /goform/formGroupConfig component. By supplying a crafted value to the timestart parameter, an attacker can trigger an out-of-bounds write on the stack due to insufficient bounds checking during string copying. Public exploit information is available.

CVE-2026-55166 affects Netflix Lemur versions prior to 1.9.2. The vulnerability includes a server-side request forgery condition in Lemur's ACME authority handling that allows an authenticated user to influence the ACME authority URL and cause AcmeHandler.setup_acme_client to initiate backend requests without effective server-side destination restriction. From the Lemur host's network context, those requests can be directed toward cloud instance metadata services or internal network services. The advisory also describes an authorization weakness in creator-equality behavior that can preserve access to certificate key material after ownership or role changes, while private-key export auditing lacks sufficient context to clearly distinguish that access path. In combination, these weaknesses can expose cloud credentials and undermine control over long-lived PKI private keys. The issue is fixed in Lemur 1.9.2 by adding ACME_DIRECTORY_HOST_ALLOWLIST validation and enriching key-export audit events with creator and current-owner context.

CVE-2026-76004 is a remotely exploitable stack-based buffer overflow in UTT HiPER 1250GW devices up to version 3.2.7-210907-180535. The flaw is in the HTTP Handler component, specifically in the use of the strcpy function within the /goform/aspApBasicConfigUrcp handler. By supplying a crafted value in the pvid argument, an attacker can trigger an out-of-bounds write on the stack. Public disclosure indicates exploit details are available. Successful exploitation can compromise process integrity and may enable further control over the affected device.

CVE-2026-25895 is a critical vulnerability in FUXA, a web-based SCADA/HMI/dashboard platform, affecting versions through 1.2.9. The flaw is caused by a missing authentication check on a critical upload function combined with path traversal in the upload destination handling. In vulnerable versions, the upload endpoint can be reached without authentication, and attacker-controlled path input is resolved without sufficient containment validation, allowing traversal outside the intended application directory. As a result, a remote unauthenticated attacker can write arbitrary files to arbitrary locations on the server filesystem. Because the primitive permits overwriting application code, configuration, startup material, or other executable content, the issue can be leveraged beyond file corruption and may lead to remote code execution.