Skip to content
COOEY
LIVE FEED
1767 events · 4 sources · newest first
Events in view
1767
all sources
Critical
1492
severity
Active sources
4
collectors
Last sync
2026-08-26 06:00
UTC
All data Vulns · 3576Regulatory · 143News · 392 LIVE · UPDATES ON COLLECT
All sources NVD CVE · 1767CISA KEV · 1677CISA advisory · 113DC3 DCISE · 19
Any severity Critical High ⊙ SUBSCRIBE (RSS)
2026-07-30 NVD CVE
CVE-2026-44104: The firmware update process for the basemodule of the charging controller only v CRITICAL
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a...
charging-controllercmmc-level-2crc32-checksumcryptographic-signatures-verificationcve-2026-44104defense-industrial-basefedramp-authorizationfirmware
2026-07-30 NVD CVE
CVE-2026-48449: Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi CRITICAL
Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user...
adobe-campaign-classicarbitrary-code-executioncisacode-executioncve-2026-48449defense-industrial-basedodincorrect-authorization
2026-07-30 NVD CVE
CVE-2026-16610: The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to CRITICAL
The Admin and Site Enhancements (ASE) Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.9.0 via the recursive_html function. This is due to the frontend save...
admin-and-sites-enhancementauthentication-bypasscode-executioncve-2026-16610cve-disclosureseval-exploitnvd-cveplugins-vulnerabilities
2026-07-30 NVD CVE
CVE-2026-44090: Due to missing authentication, an unauthenticated remote attacker may access the CRITICAL
Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.
authentication-bypassbrokers-exploitationcve-2026-44090devices-compromisefirewall-bypassiots-securitymissing-authenticationmqtt-broker
2026-07-30 NVD CVE
CVE-2026-44091: An unauthenticated remote attacker can post a malicious ID to the MQTT Broker re CRITICAL
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.
cmmcconfiguration-integritycve-2026-44091defense-industrial-basefedrampincident-responsemalicious-idmqtt-broker
2026-07-30 NVD CVE
CVE-2026-67594: Spikster through commit e1cdf8c contains a missing authentication vulnerability CRITICAL
Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, which is...
api-enumerationapi-vulnerabilitiesauthentication-bypasscapiauth-middlewarecommit-e1cdf8ccve-2026-67594database-user-creationfile-write
2026-07-30 NVD CVE
CVE-2026-13379: The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remot CRITICAL
The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process
2026-07-30 NVD CVE
CVE-2026-17543: Improper escaping of backslashes in attacker-provided parameters would allow for CRITICAL
Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.
82x-befores-823383x-befores-833384x-befores-842485x-befores-859cve-2026-17543nvd-cvephp-vulnerabilitiessql-injection
2026-07-30 NVD CVE
CVE-2026-17544: Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with s CRITICAL
Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.
2026-07-29 NVD CVE
CVE-2026-65883: Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Ca CRITICAL
Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0 - A forged clfgd field allows PHP objection injection and thereby remote code execution.
2026-07-29 NVD CVE
CVE-2026-18191: VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allo CRITICAL
VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device.
administrator-credentialscisacmmc-level-2compliance-riskcve-2026-18191devices-vulnerabilitiesdfar-252-204-7012dod
2026-07-29 NVD CVE
CVE-2026-13697: undici's cache interceptor mishandles malformed Cache-Control private directives HIGH
undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such...
cache-controlcaches-interceptorscve-2026-13697errors-handlinghttps-headersinformation-disclosuremalformed-headersnvd-cve
2026-07-29 NVD CVE
CVE-2026-33267: Improper Input Validation vulnerability in Apache Traffic Server. This issue af CRITICAL
Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15...
2026-07-29 NVD CVE
CVE-2026-65890: Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20 CRITICAL
Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2 - Multiple SQLi vectors allow unauthenticated actors to inject SQL in queries.
2026-07-29 NVD CVE
CVE-2026-65884: Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The CRITICAL
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative...
2026-07-29 NVD CVE
CVE-2026-14529: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv CRITICAL
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 traditional is vulnerable to server-side request forgery (SSRF) when the SIP container feature...
applications-securitycve-2026-14529cybersecuritydefense-industrial-basedfar-252-204-7012ibmnist-800-171nvd-cve
2026-07-29 NVD CVE
CVE-2026-65888: Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.2 CRITICAL
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.
2026-07-29 NVD CVE
CVE-2025-10656: The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin f CRITICAL
The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.37 vi the user_filter function. This makes...
admin-account-creationcve-2025-10656cve-disclosurese-commercelights-pluginmissing-authorizationnvd-cveplugins-vulnerabilities
2026-07-29 NVD CVE
CVE-2026-58163: Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corr HIGH
Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0...
apacheapache-traffic-serverscache-corruptioncve-2026-58163data-integritydata-lossesincident-responsenvd-cve
2026-07-29 NVD CVE
CVE-2026-58179: The Apache Traffic Server regex_remap plugin overflows the stack and integers fr HIGH
The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0...
apache-traffic-serverscve-2026-58179cve-disclosuresinteger-overflownvd-cveregex-remap-pluginssecurity-patchsoftware
2026-07-29 NVD CVE
CVE-2026-58177: The Apache Traffic Server Cripts framework has out-of-bounds writes, path traver HIGH
The Apache Traffic Server Cripts framework has out-of-bounds writes, path traversal, and use-after-free errors. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3. Users are recommended to upgrade...
apache-traffic-serversbound-writecmmccritical-patchescve-2026-58177defense-industrial-basefedrampfree
2026-07-29 NVD CVE
CVE-2026-41939: Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability CRITICAL
Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by...
administrative-accesscares-everywhere-gatewayscmmccompliance-riskcve-2026-41939defense-industrial-basedeployment-interfacesend
2026-07-29 NVD CVE
CVE-2026-60112: AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authenticatio CRITICAL
AMMOS Instrument Toolkit (AIT) GUI before 2.5.1 contains a missing authentication vulnerability that allows any unauthenticated network attacker to obtain a valid session and issue arbitrary spacecraft commands by...
ammo-instrument-toolkitarbitrary-command-executionauthentication-bypasscommand-buscommand-injectioncve-2026-60112defensives-mitigationsmissing-authentication
2026-07-29 NVD CVE
CVE-2026-60113: AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 c CRITICAL
AMMOS Instrument Toolkit (AIT) Deep Space Network (DSN) Interface before 2.2.2 contains a missing authentication vulnerability in the Space Link Extension (SLE) interface manager that allows unauthenticated network...
ammoapi-exposureauthentication-vulnerabilitycisacve-2026-60113deep-space-networkdefense-industrial-basehttps-requests
2026-07-29 NVD CVE
CVE-2026-58185: The Apache Traffic Server intercept plugin has a use-after-free. This issue aff MEDIUM
The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to...
apache-softwaresapache-traffic-serverscritical-vulnerabilitycve-2026-58185freeintercept-pluginmemory-safetynvd-cve
2026-07-29 NVD CVE
CVE-2026-14900: The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Cod CRITICAL
The Cost Calculator Builder PRO plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.0.3 via the js_to_php function. This is due to insufficient sanitization of the...
authentication-bypasscode-injectioncve-2026-14900eval-exploitnonce-checksnvd-cvephp-evalplugins-vulnerabilities
2026-07-29 NVD CVE
CVE-2026-18072: The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick CRITICAL
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists...
administrator-privilegesadvanced-responsive-video-embedderauthentication-bypasscve-2026-18072cybersecuritydeveloper-account-compromisehardcoded-credentialkick
2026-07-29 NVD CVE
CVE-2026-65887: Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gri CRITICAL
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding...
2026-07-29 NVD CVE
CVE-2026-14488: The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via CRITICAL
The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the...
arbitrary-deletionauthorization-bypasscisaciscocve-2026-14488frontend-submissionmeta-boxmissing-authorization
2026-07-28 NVD CVE
CVE-2026-16184: IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to b HIGH
IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.
applications-securityauthentication-bypasscve-2026-16184cybersecuritydata-protectiondefense-industrial-baseibmnist-800-171
2026-07-28 NVD CVE
CVE-2026-14976: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected HIGH
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.
2026-07-28 NVD CVE
CVE-2026-14974: IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote a HIGH
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.
2026-07-28 NVD CVE
CVE-2026-15014: The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart CRITICAL
The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including,...
accounts-takeoverauthenticationauthentication-bypassbilling-phonecve-2026-15014cybersecuritydefense-industrial-basedfar-252-204-7012
2026-07-28 NVD CVE
CVE-2026-14446: IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access con CRITICAL
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to broken access control/privilege escalation in the administrative console.
administrative-consolebroken-access-controlcve-2026-14446cybersecuritydefense-industrial-basedfar-252-204-7012ibmincident-response
2026-07-28 NVD CVE
CVE-2026-14512: IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-a CRITICAL
IBM WebSphere Application Server 9.0, and 8.5 traditional is vulnerable to pre-authentication unsafe deserialization which could allow a remote attacker to bypass authentication or execute arbitrary code.
applications-securityauthentication-bypasscve-2026-14512cybersecuritydata-protectiondefense-industrial-basedfar-252-204-7012ibm
2026-07-28 NVD CVE
CVE-2026-14958: IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated at CRITICAL
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to unquoted shell interpolation.
asperaauthenticationcve-2026-14958cybersecurityfaspexibmnvd-cvepatch-management
2026-07-28 NVD CVE
CVE-2026-14973: IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow fil CRITICAL
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.
asperacve-2026-14973cybersecuritydata-integritydata-lossesdesktop-applicationsdownloads-destinationfile-integrity
2026-07-28 NVD CVE
CVE-2026-16462: In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This a CRITICAL
In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.
arbitrary-code-executioncritical-infrastructurecve-2026-16462cybersecuritydata-breachesendpoint-securityindustrial-control-systemnvd-cve
2026-07-28 NVD CVE
CVE-2026-14959: IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated at CRITICAL
IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 could allow a remote authenticated attacker to execute arbitrary code due to shell command injection.
asperaauthenticationcve-2026-14959cybersecurityfaspexibmnvd-cvepatch-management
2026-07-27 NVD CVE
CVE-2026-55971: Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This is CRITICAL
Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
apache-thriftbuffer-overflowccve-2026-55971cyber-securitydfar-252-204-7012heap-based-buffer-overflowincident-response
◀ PREV PAGE 12 / 45 NEXT ▶