Zero Day Monitor

Zero Day MonitorZDM

Dashboard Vulnerabilities Trending Zero-Days News About

Impressum Privacy Policy

Zero Day Monitor © 2026

4992 articles · 188948 vulns · 37/41 feeds (7d)

186,352 vulnerabilities total

microsoft · CVE-2026-68820 — Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityKEVEXPLOITEDPATCHED

windows 10 version· CVSS 7.0· CWE-416

microsoft · CVE-2026-55040 — Microsoft SharePoint Server Security Feature Bypass VulnerabilityKEVEXPLOITEDPATCHED

sharepoint_server· CVSS 9.1· CWE-1390

microsoft · CVE-2026-45659 — Microsoft SharePoint Remote Code Execution VulnerabilityKEVEXPLOITEDPATCHED

sharepoint_server· CVSS 8.8· CWE-502

fortinet · CVE-2024-55591 — CVE-2024-55591: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 throKEVEXPLOITEDPATCHED

fortiproxy· CVSS 9.6· CWE-288

VMware · CVE-2026-59310 — vCenter directory-traversal vulnerabilityKEVEXPLOITEDPATCHED

Cloud Foundation· CVSS 9.8· CWE-22

f5 · CVE-2026-42945 — NGINX ngx_http_rewrite_module vulnerabilityKEVEXPLOITEDPATCHED

dos· CVSS 8.1· CWE-122

microsoft · CVE-2026-33825 — Microsoft Defender Elevation of Privilege VulnerabilityKEVEXPLOITEDPATCHED

defender_antimalware_platform· CVSS 7.8· CWE-1220

fortinet · CVE-2025-24472 — CVE-2025-24472: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS 7.0.0 through 7.0.KEVEXPLOITEDPATCHED

fortiproxy· CVSS 8.1· CWE-288

siemens · CVE-2023-44487 — CVE-2023-44487: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset manyKEVEXPLOITEDPATCHED

simatic_s7-1500_cpu_1518f-4_pn\/dp_mfp_firmware· CVSS 7.5

roundcube · CVE-2025-49113 — Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.phpKEVEXPLOITEDPATCHED

webmail· CVSS 9.9· CWE-502

freetype · CVE-2025-27363 — CVE-2025-27363: An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whenKEVEXPLOITEDPATCHED

freetype· CVSS 8.1

metaba · CVE-2026-72898 — Metabase SQL injection via password reset endpointKEVEXPLOITEDPATCHED

metaba· CVSS 10.0· CWE-89

google · CVE-2024-50302 — HID: core: zero-initialize the report bufferKEVEXPLOITEDPATCHED

android· CVSS 5.5

wordpress · CVE-2026-63030 — WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code ExecutionKEVEXPLOITEDPATCHED

wordpress· CVSS 9.8

jetbrains · CVE-2026-63077 — CVE-2026-63077: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent pollinKEVEXPLOITEDPATCHED

teamcity· CVSS 9.8· CWE-502

rarlab · CVE-2025-8088 — Path traversal vulnerability in WinRARKEVEXPLOITEDPATCHED

winrar· CVSS 8.8· CWE-35

apache · CVE-2023-46604 — The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a Java-based OpenWire broker or client to rKEVEXPLOITEDPATCHED

activemq· CVSS 10.0· CWE-502

progress · CVE-2026-8037 — OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAFKEVEXPLOITEDPATCHED

connection_manager_for_objectscale· CVSS 9.6· CWE-77

aquasec · CVE-2026-33634 — Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 76 of 77 version tags in `aquasecurity/trivy-actionKEVEXPLOITEDPATCHED

setup-trivy· CVSS 8.8· CWE-506

langflow · CVE-2026-9198 — Unauthenticated Remote Code Execution via Auto-Login Bypass and Code ValidationKEVEXPLOITEDPATCHED

langflow· CVSS 9.8· CWE-94