🔍 Filter Threats
| Title | Severity | PoC | Actively Exploited | Source | Date |
|---|---|---|---|---|---|
| CVE-2026-125398 HIGH Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated users to skip table-level access ch... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125397 HIGH NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users acce... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125396 HIGH Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forcep... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125395 MEDIUM Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song... | MEDIUM | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125394 MEDIUM FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retai... | MEDIUM | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125393 HIGH MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated users to ov... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125392 MEDIUM Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escap... | MEDIUM | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125391 HIGH Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125390 HIGH Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue t... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125389 MEDIUM Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed ... | MEDIUM | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125388 HIGH Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to downloa... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125387 MEDIUM Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets out... | MEDIUM | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125386 MEDIUM langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageController that allows authenticated... | MEDIUM | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125385 HIGH INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentNam... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125384 CRITICAL INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access bec... | CRITICAL | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125383 CRITICAL INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-c... | CRITICAL | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125382 HIGH Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the c... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125381 MEDIUM DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying ... | MEDIUM | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125380 HIGH DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute datase... | HIGH | ????? | ????? | NVD | 4 days ago |
| CVE-2026-125379 LOW Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by s... | LOW | ????? | ????? | NVD | 4 days ago |