Published vulnerability pages

Website Security Risk Index — Page 62

Current vulnerabilities, affected platforms, and fix guidance for website owners and developers.

Last week Critical this week

Browse by topic

Security risk categories

46 categories with published guidance

Memory Corruption

409

Browse published Memory Corruption vulnerabilities, affected products, and practical fix guidance.

Authorization Bypass

373

Browse published Authorization Bypass vulnerabilities, affected products, and practical fix guidance.

WordPress

350

Browse published WordPress vulnerabilities, affected products, and practical fix guidance.

Information Disclosure

320

Browse published Information Disclosure vulnerabilities, affected products, and practical fix guidance.

Remote Code Execution

303

Browse published Remote Code Execution vulnerabilities, affected products, and practical fix guidance.

Cross-site Scripting

260

Browse published Cross-site Scripting vulnerabilities, affected products, and practical fix guidance.

Network Security

253

Browse published Network Security vulnerabilities, affected products, and practical fix guidance.

Input Validation

243

Browse published Input Validation vulnerabilities, affected products, and practical fix guidance.

Web Application

239

Browse published Web Application vulnerabilities, affected products, and practical fix guidance.

Windows

216

Browse published Windows vulnerabilities, affected products, and practical fix guidance.

API Security

215

Browse published API Security vulnerabilities, affected products, and practical fix guidance.

Browser

215

Browse published Browser vulnerabilities, affected products, and practical fix guidance.

Denial of Service

215

Browse published Denial of Service vulnerabilities, affected products, and practical fix guidance.

Microsoft

212

Browse published Microsoft vulnerabilities, affected products, and practical fix guidance.

PHP

199

Browse published PHP vulnerabilities, affected products, and practical fix guidance.

Path Traversal

167

Browse published Path Traversal vulnerabilities, affected products, and practical fix guidance.

Authentication Bypass

118

Browse published Authentication Bypass vulnerabilities, affected products, and practical fix guidance.

Arbitrary File Write

116

Browse published Arbitrary File Write vulnerabilities, affected products, and practical fix guidance.

Privilege Escalation

113

Browse published Privilege Escalation vulnerabilities, affected products, and practical fix guidance.

Linux

Browse published Linux vulnerabilities, affected products, and practical fix guidance.

DevOps

Browse published DevOps vulnerabilities, affected products, and practical fix guidance.

SQL Injection

Browse published SQL Injection vulnerabilities, affected products, and practical fix guidance.

Cryptography

Browse published Cryptography vulnerabilities, affected products, and practical fix guidance.

SSRF

Browse published SSRF vulnerabilities, affected products, and practical fix guidance.

Python

Browse published Python vulnerabilities, affected products, and practical fix guidance.

Java

Browse published Java vulnerabilities, affected products, and practical fix guidance.

IDOR

Browse published IDOR vulnerabilities, affected products, and practical fix guidance.

WooCommerce

Browse published WooCommerce vulnerabilities, affected products, and practical fix guidance.

Unsafe Deserialization

Browse published Unsafe Deserialization vulnerabilities, affected products, and practical fix guidance.

File Upload

Browse published File Upload vulnerabilities, affected products, and practical fix guidance.

npm

Browse published npm vulnerabilities, affected products, and practical fix guidance.

Joomla

Browse published Joomla vulnerabilities, affected products, and practical fix guidance.

Supply Chain

Browse published Supply Chain vulnerabilities, affected products, and practical fix guidance.

Cloud Security

Browse published Cloud Security vulnerabilities, affected products, and practical fix guidance.

CSRF

Browse published CSRF vulnerabilities, affected products, and practical fix guidance.

Race Condition

Browse published Race Condition vulnerabilities, affected products, and practical fix guidance.

PDF Editor

Browse published PDF Editor vulnerabilities, affected products, and practical fix guidance.

Industrial Control

Browse published Industrial Control vulnerabilities, affected products, and practical fix guidance.

.NET

Browse published .NET vulnerabilities, affected products, and practical fix guidance.

File Deletion

Browse published File Deletion vulnerabilities, affected products, and practical fix guidance.

Open Redirect

Browse published Open Redirect vulnerabilities, affected products, and practical fix guidance.

Node.js

Browse published Node.js vulnerabilities, affected products, and practical fix guidance.

SAML

Browse published SAML vulnerabilities, affected products, and practical fix guidance.

Virtualization

Browse published Virtualization vulnerabilities, affected products, and practical fix guidance.

Drupal

Browse published Drupal vulnerabilities, affected products, and practical fix guidance.

Unix Domain Sockets

Browse published Unix Domain Sockets vulnerabilities, affected products, and practical fix guidance.

Published security risks

Showing 2197–2230 of 2230 published risks.

criticalCISA KEVEPSS 0.046

Microsoft Windows Link Following Vulnerability

Microsoft Windows contains a link following vulnerability that allows for privilege escalation

CVE-2025-60710windowsmicrosoftpath-traversalprivilege-escalation

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.122

Microsoft Windows Out-of-Bounds Read Vulnerability

Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation

CVE-2023-36424windowsmicrosoftinformation-disclosure

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.210

Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.

CVE-2012-1854microsoftsupply-chainremote-code-execution

Updated Jul 9, 2026

criticalCISA KEVEPSS 1.000

JetBrains TeamCity Relative Path Traversal Vulnerability

JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.

CVE-2024-27199devopspath-traversal

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.075

SimpleHelp Path Traversal Vulnerability

SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.

CVE-2024-57728remote-code-executionpath-traversalfile-write

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.093

SimpleHelp Missing Authorization Vulnerability

SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.

CVE-2024-57726api-securityauthorization-bypass

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.242

Microsoft SharePoint Server Improper Input Validation Vulnerability

Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-32201microsoftinput-validation

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.876

ConnectWise ScreenConnect Path Traversal Vulnerability

ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.

CVE-2024-1708path-traversal

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.362

Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability

Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.

CVE-2026-0300network-securityremote-code-executionmemory-corruption

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.431

Microsoft Office Remote Code Execution

Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.

CVE-2009-0238microsoftremote-code-execution

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.784

PaperCut NG/MF Improper Authentication Vulnerability

PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.

CVE-2023-27351authentication-bypass

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.056

Microsoft Exchange Server Cross-Site Scripting Vulnerability

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.

CVE-2026-42897npmbrowsermicrosoftxss

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.956

Marimo Remote Code Execution Vulnerability

Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.

CVE-2026-39987remote-code-executionauthentication-bypass

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.919

Samsung MagicINFO 9 Server Path Traversal Vulnerability

Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.

CVE-2024-7399path-traversalfile-uploadfile-write

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.039

Kentico Xperience Path Traversal Vulnerability

Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.

CVE-2025-2749path-traversalfile-upload

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.024

Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability

Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.

CVE-2025-32975authentication-bypass

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.885

Fortinet FortiClient EMS Improper Access Control Vulnerability

Fortinet FortiClient EMS contains an improper access control vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests.

CVE-2026-35616network-securityauthorization-bypass

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.941

Fortinet FortiClient EMS SQL Injection Vulnerability

Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.

CVE-2026-21643network-securitysql-injection

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.621

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.

CVE-2023-21529microsoftremote-code-executionunsafe-deserialization

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.345

Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.

CVE-2026-6973remote-code-executioninput-validation

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.840

Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability

Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.

CVE-2026-1340remote-code-execution

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.872

D-Link DIR-823X Command Injection Vulnerability

D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding function. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.

CVE-2025-29635remote-code-execution

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.631

Microsoft Defender Denial of Service Vulnerability

Microsoft Defender contains an unspecified vulnerability that allows for denial of service.

CVE-2026-45498microsoftdenial-of-service

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.084

Microsoft Defender Link Following Vulnerability

Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.

CVE-2026-41091microsoftpath-traversal

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.067

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.

CVE-2026-33825microsoftauthorization-bypass

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.981

WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.

CVE-2026-41940wordpressauthentication-bypass

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.058

TrueConf Client Download of Code Without Integrity Check Vulnerability

TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or installed by the updater, this may result in arbitrary code execution in the context of the updating process or user.

CVE-2026-3502supply-chainremote-code-executioncryptography

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.070

Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.

CVE-2026-20122network-securityapi-securityfile-writeprivilege-escalation

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.102

Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.

CVE-2026-20133network-securityinformation-disclosure

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.053

Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability

Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.

CVE-2026-20128network-securityprivilege-escalation

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.877

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.

CVE-2026-20182network-securityauthentication-bypass

Updated Jul 9, 2026

criticalCISA KEVEPSS 0.967