Lỗ hổng mới

Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.

/
RCE171 Truy cập trái phép108 Lộ dữ liệu62

221 lỗ hổng

ID Tóm tắt CVSS Sản phẩm / package Công bố Nguồn
CVE-2026-111850 Lộ dữ liệu WordPress BuddyPress plugin <= 14.5.2 - SQL Injection vulnerability 8.5 HIGH BuddyPress BuddyPress NVD, CVE.org
CVE-2026-111411 Lộ dữ liệu WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability 9.3 CRITICAL Aman FunnelKit Automations NVD, CVE.org
CVE-2026-115607 Lộ dữ liệu WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability 9.3 CRITICAL Crowd Favorite DXP ToolKit NVD, CVE.org
CVE-2026-115904 RCE Topluyo Desktop for Linux has an OS Command Injection issue 9.6 CRITICAL topluyo App NVD, CVE.org
CVE-2026-67073 RCE Truy cập trái phép Lộ dữ liệu HCL BigFix AEX is affected by multiple security vulnerabilities. 8.6 HIGH HCL Software BigFix AEX NVD, CVE.org
CVE-2026-67074 RCE HCL BigFix AEX is affected by multiple security vulnerabilities. 9.1 CRITICAL HCL Software BigFix AEX NVD, CVE.org
CVE-2026-114278 RCE Unauthenticated Command Injection via kubeconfig Username in che-machine-exec 9.8 CRITICAL Eclipse Foundation Eclipse Che NVD, CVE.org
CVE-2026-118485 Lộ dữ liệu Axel Download Accelerator Path Traversal via URL Filename Decoding 8.1 HIGH Axel Download Accelerator Axel NVD, CVE.org
CVE-2026-118477 RCE KaliFast Project Management Platform ei_git_repo_url OS Command Injection 9.8 CRITICAL EISGE Kalifast NVD, CVE.org
CVE-2026-103792 Lộ dữ liệu Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40... 9.6 CRITICAL Dell PowerProtect Data Domain Management Center NVD, CVE.org
CVE-2026-112198 Lộ dữ liệu Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App 8.3 HIGH Tactis NoviGest Desktop App NVD, CVE.org
CVE-2026-103780 RCE Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... 9.8 CRITICAL Dell PowerProtect Data Domain NVD, CVE.org
CVE-2026-86378 RCE Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... 8.8 HIGH Dell PowerProtect Data Domain NVD, CVE.org
CVE-2026-14571 Lộ dữ liệu SQL injection (SQLi) in the user authentication module of Futurum Software 9.1 CRITICAL Futurum Software Futurum Software User Authentication Module NVD, CVE.org
CVE-2026-86396 RCE Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... 8.8 HIGH Dell PowerProtect Data Domain NVD, CVE.org
CVE-2026-86398 Lộ dữ liệu Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... 8.8 HIGH Dell PowerProtect Data Domain NVD, CVE.org
CVE-2026-86400 RCE Truy cập trái phép Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... 9.8 CRITICAL Dell PowerProtect Data Domain NVD, CVE.org
CVE-2026-109218 RCE Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass 9.8 CRITICAL kleor Contact Manager NVD, CVE.org
CVE-2026-109384 RCE The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multipart Upload 8.8 HIGH melograno The Innovative Form Builder – IvyForms NVD, CVE.org
CVE-2026-111120 RCE VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task 8.8 HIGH e4jvikwp VikRentCar Car Rental Management System NVD, CVE.org
CVE-2026-97229 KEV RCE GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability — GitLab Community Edition and Enterprise Edition CISA KEV