Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-112905 Truy cập trái phép | Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft | 9.0 CRITICAL | givanz Vvveb | NVD, CVE.org | |
| CVE-2026-110799 Truy cập trái phép | Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover | 9.8 CRITICAL | givanz Vvveb | NVD, CVE.org | |
| CVE-2026-119662 Truy cập trái phép | Songloft 2.9.0 before 2.13.6 Hardcoded Admin Credentials in Embedded Backend | 8.8 HIGH | songloft-org songloft | NVD, CVE.org | |
| CVE-2026-119660 Truy cập trái phép | MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key | 9.8 CRITICAL | yincongcyincong MuseBot | NVD, CVE.org | |
| CVE-2026-119654 Truy cập trái phép | DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization | 8.8 HIGH | devlive-community DataCap | NVD, CVE.org | |
| CVE-2026-91913 RCE | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker ... | 8.8 HIGH | Dell OpenManage Enterprise | NVD, CVE.org | |
| CVE-2026-119572 Truy cập trái phép | Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider | 8.7 HIGH | traefik traefik | NVD, CVE.org | |
| CVE-2026-118992 RCE | CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup | 8.4 HIGH | NVD, CVE.org | ||
| CVE-2026-75882 Truy cập trái phép | Improper access control vulnerability in ESET Encryption products for Windows | 8.5 HIGH | ESET spol. s.r.o. ESET Endpoint Encryption, ESET spol. s.r.o. ESET Full Disk Encryption | NVD, CVE.org | |
| CVE-2026-111505 RCE | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker ... | 8.8 HIGH | Dell OpenManage Enterprise | NVD, CVE.org | |
| CVE-2025-68394 Lộ dữ liệu | SQL Injection in Protectel | 8.4 HIGH | ARKETEAM PROTECTELMAJ, ARKETEAM BDF | NVD, CVE.org | |
| CVE-2025-68393 Lộ dữ liệu | SQL Injection in Protectel | 8.4 HIGH | ARKETEAM PROTECTELMAJ, ARKETEAM BDF | NVD, CVE.org | |
| CVE-2026-119420 Truy cập trái phép | Lago through 1.55.0 Authentication Bypass via acceptInvite GraphQL Mutation | 8.8 HIGH | getlago lago | NVD, CVE.org | |
| CVE-2026-119418 Lộ dữ liệu | CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() | 8.1 HIGH | cakephp cakephp | NVD, CVE.org | |
| CVE-2026-119419 Lộ dữ liệu | CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation | 8.1 HIGH | cakephp cakephp | NVD, CVE.org | |
| CVE-2026-119408 RCE | n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes | 8.8 HIGH | n8n-io n8n | NVD, CVE.org | |
| CVE-2026-116366 RCE | Unauthenticated RCE vulnerability against ClickHouse Server | 9.5 CRITICAL | ClickHouse ClickHouse, ClickHouse ClickHouse Cloud | NVD, CVE.org | |
| CVE-2026-22110 Truy cập trái phép | Missing authentication check on POST/PUT requests | 8.7 HIGH | Delta Electronics Delta UFC500 | NVD, CVE.org | |
| CVE-2026-22105 Truy cập trái phép | Use of default password based on serial number | 8.7 HIGH | Delta Electronics Delta UFC500 | NVD, CVE.org | |
| CVE-2026-22109 Truy cập trái phép | Default WebUI passwords stored in plaintext | 8.4 HIGH | Delta Electronics Delta UFC500 | NVD, CVE.org | |
| CVE-2025-31704 RCE | Dahua Intelligent Connection Center command injection | 9.8 CRITICAL | Dahua Intelligent Connection Center | NVD, CVE.org | |
| CVE-2026-14467 Lộ dữ liệu | Display of information in the Forocoches comments editor | 8.2 HIGH | Forocoches Forocoches comments editor | NVD, CVE.org | |
| CVE-2026-59387 Truy cập trái phép | Broken access control restriction in Cloud Controller API | 8.8 HIGH | Cloud Foundry CAPI (Cloud Controller API), Cloud Foundry cf-deployment | NVD, CVE.org | |
| CVE-2026-82104 Truy cập trái phép | API permission bypass via logic bug | 9.4 CRITICAL | Teltonika Networks RUT, Teltonika Networks RUTX +12 | NVD, CVE.org | |
| CVE-2026-103039 RCE | Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field | 9.8 CRITICAL | Gravity Forms Gravity Forms | NVD, CVE.org | |
| CVE-2026-104368 Truy cập trái phép | Export and Import Users and Customers <= 2.7.5 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via Biographical Info Field | 8.8 HIGH | webtoffee Export and Import Users and Customers | NVD, CVE.org | |
| CVE-2026-119270 RCE | Improper input validation in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromi... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119271 RCE | Use after free in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119263 RCE | Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium... | 9.6 CRITICAL | Google Chrome | NVD, CVE.org | |
| CVE-2026-119264 RCE | Memory corruption in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security seve... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119265 RCE | Memory corruption in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sev... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119266 RCE | Use after free in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severi... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119267 RCE | Memory corruption in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security sever... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119268 RCE | Integer overflow in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security se... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119269 RCE | Use after free in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119260 RCE | Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-119261 RCE | Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu... | 9.6 CRITICAL | Google Chrome | NVD, CVE.org | |
| CVE-2026-119262 RCE | Improper input validation in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76028 RCE | Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76029 RCE | Memory corruption in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security s... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76030 RCE | Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium securit... | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76031 RCE | Use after free in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76025 RCE | Use after free in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-76026 RCE | Memory corruption in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | 8.8 HIGH | Google Chrome | NVD, CVE.org | |
| CVE-2026-92744 RCE Truy cập trái phép | Delinea Privilege Manager agent unauthenticated remote code execution vulnerability | 8.7 HIGH | Delinea Privilege Manager | NVD, CVE.org | |
| CVE-2023-22793 RCE | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft Sys... | 9.3 CRITICAL | Veeam Management Pack for Microsoft System Center | NVD, CVE.org | |
| CVE-2026-107238 RCE | A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Coll... | 8.7 HIGH | Veeam Management Pack for Microsoft System Center | NVD, CVE.org | |
| CVE-2026-107239 RCE Lộ dữ liệu | A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center ... | 8.8 HIGH | Veeam Management Pack for Microsoft System Center | NVD, CVE.org | |
| CVE-2026-61707 RCE Truy cập trái phép | SOCFortress CoPilot: Stored case-report template injection permits backend code execution | 9.0 CRITICAL | socfortress CoPilot | NVD, CVE.org | |
| CVE-2026-61671 Truy cập trái phép | WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes | 8.1 HIGH | LabRedesCefetRJ WeGIA | NVD, CVE.org |