Security Vulnerabilities - Known exploited
CVE-2026-60137
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Known exploited
CVSS Score
5.9
EPSS Score
0.783
Published
2026-07-17
CVE-2026-9198
IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments
Known exploited
CVSS Score
9.8
EPSS Score
0.347
Published
2026-07-17
CVE-2021-27137
An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would overflow an internal fixed buffer. Exploitation requires the DD-WRT user to enable UPnP (which is off by default, and only listens on internal interfaces by default). This occurs in ssdp_msearch (reachable by an M-SEARCH request).
Known exploited
CVSS Score
8.1
EPSS Score
0.04
Published
2026-07-16
CVE-2026-15409
A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.
Known exploited
CVSS Score
10.0
EPSS Score
0.837
Published
2026-07-14
CVE-2026-15410
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
Known exploited
CVSS Score
7.2
EPSS Score
0.118
Published
2026-07-14
CVE-2026-55040
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
Known exploited
CVSS Score
9.1
EPSS Score
0.397
Published
2026-07-14
CVE-2026-58644
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Known exploited
CVSS Score
9.8
EPSS Score
0.159
Published
2026-07-14
CVE-2026-56155
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
Known exploited
CVSS Score
7.8
EPSS Score
0.003
Published
2026-07-14
CVE-2026-56164
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Known exploited
CVSS Score
5.3
EPSS Score
0.266
Published
2026-07-14
CVE-2026-50522
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Known exploited
CVSS Score
9.8
EPSS Score
0.846
Published
2026-07-14