⚠️ 0-Day Vulnerabilities

Real-time intelligence on actively exploited zero-day vulnerabilities from the world's leading security researchers.

102
Total
53
Critical
6
High
0
Medium
4
Low

⚡ All Sources Combined

VU#385711

VU#385711: PrestaShop Performance Debug Configuration Contains a PHP Code Injection Vulnerability

CRITICAL
Overview PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration ...
⚠️ Exploit Available PHP CERT/CC
Type 0-DAY
1 day ago (November 9, 2026 at 12:00 AM)
CVE-2026-121685

VU#188754: FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities

CRITICAL
Overview Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sens...
⚠️ Exploit Available Android CERT/CC
Type 0-DAY
1 day ago (November 9, 2026 at 12:00 AM)
MITRE
VU#124705

VU#124705: BaseChat – Audio Dating App, Android version 9.8.1, contains multiple vulnerabilities

CRITICAL
Overview Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and...
⚠️ Exploit Available Android CERT/CC
Type 0-DAY
1 week ago (November 3, 2026 at 12:00 AM)
CVE-2026-16305

VU#203719: INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities

HIGH
Overview INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare has remedia...
⚠️ Exploit Available CERT/CC
Type 0-DAY
1 week ago (November 2, 2026 at 12:00 AM)
MITRE
VU#701544

VU#701544: Retraction of mpc-lib hardened derivation fails to protect ancestor isolation

HIGH
Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the anc...
CERT/CC
Type 0-DAY
1 week ago (October 28, 2026 at 12:00 AM)
CVE-2026-90975

VU#701544: mpc-lib hardened derivation fails to protect ancestor isolation

HIGH
Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the anc...
CERT/CC
Type 0-DAY
2 weeks ago (October 27, 2026 at 12:00 AM)
MITRE
CVE-2026-91141

VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling

CRITICAL
Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip r...
⚠️ Exploit Available CERT/CC
Type 0-DAY
2 weeks ago (October 26, 2026 at 12:00 AM)
MITRE
CVE-2026-109618

VU#763488: Memory corruption vulnerabilities in PHP

CRITICAL
Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web servic...
⚠️ Exploit Available Apache CERT/CC
Type 0-DAY
2 weeks ago (October 23, 2026 at 12:00 AM)
MITRE
CVE-2026-109618

[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

CRITICAL
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
PHP Exploit-DB
Type 0-DAY
2 weeks ago (October 22, 2026 at 12:00 AM)
Reference MITRE
17ef5a8b3556caea846a11049dbfe634

[webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover

CRITICAL
Keycloak 26.7.2 - Unauthenticated Account Takeover
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
be2a622d52a0119f5074831f20dbbbc7

[webapps] Open eClass 3.15 - RCE

CRITICAL
Open eClass 3.15 - RCE
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
CVE-2026-82987

VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise

CRITICAL
Overview ViewSonic vCast software, which is included in ViewBoard smartboard devices, contains multiple vulnerabilities that an attacker can chained to achieve full device compromise. Description Vi...
⚠️ Exploit Available Android CERT/CC
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
MITRE
c9c4e2ed9ae04f5ede9588cb0ac7e8be

[remote] Edimax BR-6478AC firmware v2.20 - authenticated command injection

UNKNOWN
Edimax BR-6478AC firmware v2.20 - authenticated command injection
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
4c46e3441ddab7a0ce13ad388b078caf

[remote] Exasol Database 7.1.30 - command execution

UNKNOWN
Exasol Database 7.1.30 - command execution
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
a1457162b09b6364520940b6e6fd0808

[remote] Parasoft Continuous Testing Platform 10.7.5 - JSP command execution

UNKNOWN
Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
e120235060939526b19448bc13af3b13

[remote] ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root

UNKNOWN
ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
6fac2da4c2a81782902612f4ed59cd11

[webapps] pizzafy-1.0 - SQLi

UNKNOWN
pizzafy-1.0 - SQLi
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
f3e5575f9380306797cf4d9cec11902c

[remote] South River Technologies Titan MFT Server 26.0.0 - code execution

UNKNOWN
South River Technologies Titan MFT Server 26.0.0 - code execution
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
de76cc1b8b3ad4cb482855bb91410005

[remote] Synametrics Syncrify 6.2 - command execution

UNKNOWN
Synametrics Syncrify 6.2 - command execution
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
772eac1817551bc013e2798e8f7d2fed

[webapps] Automotive Shop Management System 1.0 - SQLi

UNKNOWN
Automotive Shop Management System 1.0 - SQLi
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference

Exploit-DB P100

Visit Source
CVE-2026-109618

[remote] PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE

CRITICAL
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
PHP Exploit-DB
Type 0-DAY
2 weeks ago (October 22, 2026 at 12:00 AM)
Reference MITRE
be2a622d52a0119f5074831f20dbbbc7

[webapps] Open eClass 3.15 - RCE

CRITICAL
Open eClass 3.15 - RCE
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
17ef5a8b3556caea846a11049dbfe634

[webapps] Keycloak 26.7.2 - Unauthenticated Account Takeover

CRITICAL
Keycloak 26.7.2 - Unauthenticated Account Takeover
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
e120235060939526b19448bc13af3b13

[remote] ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root

UNKNOWN
ProSoft RLX-IFH24E v2.2.44 - Unsigned Firmware Upgrade Package Executed as Root
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
c9c4e2ed9ae04f5ede9588cb0ac7e8be

[remote] Edimax BR-6478AC firmware v2.20 - authenticated command injection

UNKNOWN
Edimax BR-6478AC firmware v2.20 - authenticated command injection
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
4c46e3441ddab7a0ce13ad388b078caf

[remote] Exasol Database 7.1.30 - command execution

UNKNOWN
Exasol Database 7.1.30 - command execution
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
a1457162b09b6364520940b6e6fd0808

[remote] Parasoft Continuous Testing Platform 10.7.5 - JSP command execution

UNKNOWN
Parasoft Continuous Testing Platform 10.7.5 - JSP command execution
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
6fac2da4c2a81782902612f4ed59cd11

[webapps] pizzafy-1.0 - SQLi

UNKNOWN
pizzafy-1.0 - SQLi
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
772eac1817551bc013e2798e8f7d2fed

[webapps] Automotive Shop Management System 1.0 - SQLi

UNKNOWN
Automotive Shop Management System 1.0 - SQLi
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference
de76cc1b8b3ad4cb482855bb91410005

[remote] Synametrics Syncrify 6.2 - command execution

UNKNOWN
Synametrics Syncrify 6.2 - command execution
Exploit-DB
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
Reference

CERT/CC P85

Visit Source
CVE-2026-121685

VU#188754: FrodoBots EarthRover Mini+ firmware contains multiple vulnerabilities

CRITICAL
Overview Multiple vulnerabilities in the FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) may allow remote code execution, unauthorized access to onboard sensors, disclosure of sens...
⚠️ Exploit Available Android CERT/CC
Type 0-DAY
1 day ago (November 9, 2026 at 12:00 AM)
MITRE
VU#385711

VU#385711: PrestaShop Performance Debug Configuration Contains a PHP Code Injection Vulnerability

CRITICAL
Overview PrestaShop's back-office Performance > Debug mode functionality contains a PHP code injection vulnerability. An authenticated attacker with permission to modify debug-mode configuration ...
⚠️ Exploit Available PHP CERT/CC
Type 0-DAY
1 day ago (November 9, 2026 at 12:00 AM)
VU#124705

VU#124705: BaseChat – Audio Dating App, Android version 9.8.1, contains multiple vulnerabilities

CRITICAL
Overview Multiple vulnerabilities have been identified in the Android application, BaseChat – Audio Dating App, version 9.8.1, which ultimately compromise the privacy of users’ personal data and...
⚠️ Exploit Available Android CERT/CC
Type 0-DAY
1 week ago (November 3, 2026 at 12:00 AM)
CVE-2026-16305

VU#203719: INFINITT PACS System Manager Contains Multiple Code Execution Vulnerabilities

HIGH
Overview INFINITT PACS installations using System Manager versions 3.0.11.3 and 3.0.11.5 contain vulnerabilities that may allow an attacker to execute arbitrary code. INFINITT Healthcare has remedia...
⚠️ Exploit Available CERT/CC
Type 0-DAY
1 week ago (November 2, 2026 at 12:00 AM)
MITRE
VU#701544

VU#701544: Retraction of mpc-lib hardened derivation fails to protect ancestor isolation

HIGH
Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the anc...
CERT/CC
Type 0-DAY
1 week ago (October 28, 2026 at 12:00 AM)
CVE-2026-90975

VU#701544: mpc-lib hardened derivation fails to protect ancestor isolation

HIGH
Overview Fireblocks' mpc-lib library contains a cryptographic fail-open vulnerability in its BIP32 hardened derivation implementation in the case of a missing private parent key. This breaks the anc...
CERT/CC
Type 0-DAY
2 weeks ago (October 27, 2026 at 12:00 AM)
MITRE
CVE-2026-91141

VU#128947: COVESA vsomeip excessive memory allocation in reliable (TCP) endpoint buffer handling

CRITICAL
Overview vsomeip, COVESA's open source implementation of the SOME/IP automotive communication middleware, contained a memory allocation vulnerability present in versions 3.7.3 and below. A vsomeip r...
⚠️ Exploit Available CERT/CC
Type 0-DAY
2 weeks ago (October 26, 2026 at 12:00 AM)
MITRE
CVE-2026-109618

VU#763488: Memory corruption vulnerabilities in PHP

CRITICAL
Overview Two memory-related vulnerabilities have been identified in PHP versions prior to 8.2.35, 8.3.36, 8.4.27, and 8.5.12. An unauthenticated remote attacker with network access to PHP web servic...
⚠️ Exploit Available Apache CERT/CC
Type 0-DAY
2 weeks ago (October 23, 2026 at 12:00 AM)
MITRE
CVE-2026-82987

VU#234131: ViewSonic vCast media streaming service allows unauthenticated screen exfiltration and device compromise

CRITICAL
Overview ViewSonic vCast software, which is included in ViewBoard smartboard devices, contains multiple vulnerabilities that an attacker can chained to achieve full device compromise. Description Vi...
⚠️ Exploit Available Android CERT/CC
Type 0-DAY
2 weeks ago (October 21, 2026 at 12:00 AM)
MITRE
CVE-2026-97406

VU#645818: Xerj Console API authentication bypass leads to unauthorized credential minting

CRITICAL
Overview An authentication bypass vulnerability in the Xerj Console API allows sessions to bypass passkey-backed requirements during token issuance. By exploiting this flaw, an attacker with an exis...
⚠️ Exploit Available CERT/CC
Type 0-DAY
3 weeks ago (October 20, 2026 at 12:00 AM)
MITRE