CVE Radar.

You can follow the current trends of security vulnerabilities.

CVE Radar (290)

Detected during the last 30 days

CVE-2026-43633

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remote attackers to achieve root-level code execution. Attackers can inject crafted data into HTTP headers that are processed by the PHP session handler but incorrectly deserialized by the Node.js web terminal component as trusted session values, resulting in arbitrary command execution on systems with the web terminal feature enabled. Continue Reading

CRITICAL

CVE-2026-8602

CVSS: 9.1

In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings. Continue Reading

CRITICAL

CVE-2026-8603

CVSS: 9.8

In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system. Continue Reading

CRITICAL

CVE-2026-8605

CVSS: 9.8

In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin. Continue Reading

CRITICAL

CVE-2026-33642

CVSS: 9.9

Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic that is subject to integer wrapping, potentially leading to Heap Buffer Over-Read/Write. An attacker who can write escape sequences to a kitty terminal (e.g., via a malicious file, SSH login banner, or piped content) can supply crafted x_offset/y_offset values that pass the bounds check after wrapping but cause massive out-of-bounds heap memory access in compose_rectangles(). No user interaction is required. No non-default configuration is required. The attacker only needs the ability to produce output in a kitty terminal window. This issue has been fixed in version 0.47.0. Continue Reading

CRITICAL

CVE-2026-6555

CVSS: 9.8

The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in the upload array undergoes extension and MIME type validation, while all files are processed and uploaded to a web-accessible directory. This makes it possible for unauthenticated attackers to upload malicious PHP files and achieve remote code execution by sending a valid first file followed by a malicious file. Continue Reading

CRITICAL

CVE-2026-7284

CVSS: 9.8

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Continue Reading

CRITICAL

CVE-2025-33255

CVSS: 7.5

NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclosure. Continue Reading

HIGH

CVE-2026-24142

CVSS: 6.3

NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. Continue Reading

MEDIUM

CVE-2026-24163

CVSS: 7.5

NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclosure. Continue Reading

HIGH

Description

News

Affected

References

Attack Vector:

Attack Complexity (AC):

Privileges Required (PR):

User Interaction (UI):

Scope (S):

Availability Impact (A):

Confidentiality Impact (C):

Integrity Impact (I):

Exploitability:

Impact:

Vector String:

Get Free 100 Credits Monthly

Try first, decide later! Get started with a free plan. You can cancel at any time.

Start Free Trial

Ponarize offers an online tool that allows you to check whether a URL & IP address categorization and reputation scoring solution is classified in our Databases. Our goal is to offer you this service at the most affordable prices. We are happy to help you and enjoy working tog.

Spam Check IP Lookup Domain Lookup About Pricing Blog

Contact FAQ GDPR Privacy Policy Terms & Conditions

[email protected]