Live feed · cooey

2026-08-25 CISA KEV

Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the...

cisa-kevcode-injectioncve-2026-60004diffpatch-apiexecutable-git-hookgit-hookgiteamalicious-patches

2026-08-24 CISA KEV

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability HIGH

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as...

cisa-kev

2026-08-21 CISA KEV

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability HIGH

Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary...

arbitrary-command-executioncisa-kevcollaboration-suitecve-2026-73570email-serveros-command-injectionsecurity-vulnerabilitysmtp

2026-08-21 CISA KEV

Microsoft Entra ID Deserialization of Untrusted Data Vulnerability HIGH ◈ 2 sources · orig. NVD CVE

Microsoft Entra ID formerly known as Azure Active Directory contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

code-executioncve-2026-69836deserializationentra-ididentity-managementmicrosoftmicrosofts-entrasnetworks-attacks

2026-08-20 NVD CVE

CVE-2026-17060: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to a kernel heap over-read.

2026-08-20 NVD CVE

CVE-2026-17000: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper authentication.

2026-08-20 NVD CVE

CVE-2026-17003: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and integrity of the system due to an out-of-bounds write.

2026-08-20 NVD CVE

CVE-2026-17436: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.

2026-08-20 NVD CVE

CVE-2026-17006: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap buffer overflow.

2026-08-20 NVD CVE

CVE-2026-17138: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

2026-08-20 NVD CVE

CVE-2026-17024: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation.

2026-08-20 NVD CVE

CVE-2026-17423: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to o HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds read.

2026-08-20 CISA KEV

TrueConf Server Code Injection Vulnerability HIGH

TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated...

arbitrary-code-executionbreakoutcisa-kevcode-injectioncve-2026-72530host-systemisolated-environmentnetwork-access

2026-08-20 NVD CVE

CVE-2026-18716: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read.

2026-08-20 NVD CVE

CVE-2026-18670: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to c HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service and potentially disclose sensitive information due to an integer underflow.

2026-08-20 CISA KEV

TrueConf Server Missing Authentication for Critical Function Vulnerability HIGH

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.

arbitrary-script-executioncisa-kevcritical-functionscve-2026-72529incident-responsemissing-authenticationnetwork-accessport-4307

2026-08-20 NVD CVE

CVE-2026-18832: IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to e HIGH

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overflow.

2026-08-19 CISA KEV

MLflow Server-Side Request Forgery Vulnerability HIGH

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.

attack-vectorscisa-kevcloud-metadatacloud-securitycve-2026-64849internal-servicesmetadata-servicesmlflow

2026-08-18 CISA KEV

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability HIGH

Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.

cisa-kevcve-2026-33824double-freeencryptionexploitikeinternet-key-exchangekey-exchange

2026-08-18 CISA KEV

Broadcom VMware vCenter Path Traversal Vulnerability HIGH

Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.

arbitrary-code-executionbroadcomcisa-kevcve-2026-59310network-accesspath-traversalthreats-actorsvcenter

2026-08-18 CISA KEV

Apple macOS Improper Authentication Vulnerability HIGH

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.

appleauthentication-bypasscisa-kevcve-2026-65400improper-authenticationmaconetworks-attacksoperating-systems

2026-08-18 CISA KEV

Microsoft SharePoint Weak Authentication Vulnerability HIGH

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

attackerauthentication-bypasscisa-kevcve-2026-55040microsoftnetwork-securitysecurity-featuressharepoint

2026-08-17 CISA KEV

Ray-Project Ray Code Injection Vulnerability HIGH

Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.

cisa-kevcode-injectioncve-2025-62593development-toolsexploitablefirefoxrayray-project

2026-08-13 NVD CVE

CVE-2026-17101: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary HIGH

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code or obtain sensitive information due to improper authentication.

2026-08-13 NVD CVE

CVE-2026-18193: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security re HIGH

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses.

2026-08-13 NVD CVE

CVE-2026-16961: IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could s HIGH

IBM i 7.6, 7.5, and 7.4 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

cvecve-2026-16961data-deletiondata-modificationdatabaseibmibm-iinformation-disclosure

2026-08-13 NVD CVE

CVE-2026-17206: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary HIGH

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

arbitrary-code-executionbuffer-overflowcve-2026-17206ibmibm-invd-cveoperating-systemsremote-code-execution

2026-08-13 NVD CVE

CVE-2026-17481: IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to e HIGH

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs.

arbitrary-code-executioncve-2026-17481documentationibmimproper-outputs-neutralizationlognvd-cveoffline

2026-08-13 NVD CVE

CVE-2026-16867: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server reso HIGH

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation.

authenticate-userauthenticationcve-2026-16867ibm-iimproper-authenticationntlm-session-negotiationnvd-cveremote-attackers

2026-08-13 NVD CVE

CVE-2026-17197: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security re HIGH

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity.

client-asserted-identitycve-2026-17197ibmibm-iibm-i-7-3ibm-i-7-4ibm-i-7-5ibm-i-7-6

2026-08-13 NVD CVE

CVE-2026-18249: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain HIGH

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses.

2026-08-13 NVD CVE

CVE-2026-16815: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of HIGH

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow.

cve-2026-16815denialibm-iibm-i-7-3ibm-i-7-4ibm-i-7-5ibm-i-7-6nvd-cve

2026-08-12 NVD CVE

CVE-2026-13433: IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to do HIGH

IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised...

2026-08-12 NVD CVE

CVE-2026-16627: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 HIGH

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate...

2026-08-12 NVD CVE

CVE-2026-10534: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer HIGH

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser.

buffer-overflowcve-2026-10534databasedb2ibmixf-import-parsernvd-cvesecurity

2026-08-12 NVD CVE

CVE-2026-17111: IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker co HIGH

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

cve-2026-17111data-deletiondata-modificationdatabaseibmibm-iibm-i-7-3ibm-i-7-4

2026-08-12 NVD CVE

CVE-2026-10543: IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privil HIGH

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query.

2026-08-12 NVD CVE

CVE-2026-18847: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to ha HIGH

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i.

credential-harvestingcve-2026-18847iibmibm-inavigatornvd-cveremote-attacks

2026-08-11 CISA KEV

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability HIGH

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

ancillary-functions-driversauthorize-attackerscisa-kevcve-2026-68820freeincident-responselocal-attackmicrosoft

2026-08-11 CISA KEV

Metabase SQL Injection Vulnerability HIGH

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance....

administrators-accessapplications-securitycisa-kevcredentials-theftcve-2026-72898data-theftdatabase-securitydatum-exfiltration