Skip to content
COOEY
LIVE FEED
1767 events · 4 sources · newest first
Events in view
1767
all sources
Critical
1492
severity
Active sources
4
collectors
Last sync
2026-08-26 06:00
UTC
All data Vulns · 3576Regulatory · 143News · 392 LIVE · UPDATES ON COLLECT
All sources NVD CVE · 1767CISA KEV · 1677CISA advisory · 113DC3 DCISE · 19
Any severity Critical High ⊙ SUBSCRIBE (RSS)
2026-07-27 NVD CVE
CVE-2026-48144: Improper Validation of Certificate with Host Mismatch vulnerability in Apache Th CRITICAL
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes...
apacheapache-thriftc-glibcertificate-validationcve-2026-48144cybersecurityhost-mismatchinformation-security
2026-07-27 NVD CVE
CVE-2026-55971: Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This is CRITICAL
Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
apache-thriftbuffer-overflowccve-2026-55971cyber-securitydfar-252-204-7012heap-based-buffer-overflowincident-response
2026-07-27 NVD CVE
CVE-2026-66014: JFrog Artifactory contains an authentication handling weakness in internal reque HIGH
JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker to escalate privileges beyond the intended access level.
access-controlauthentication-weaknessescompliance-riskcve-2026-66014internal-requests-processingjfrog-artifactorynvd-cveprivileges-escalation
2026-07-27 NVD CVE
CVE-2026-58023: Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue a CRITICAL
Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
apache-thriftbound-readc-glib-bindingscve-2026-58023cybersecuritydfar-252-204-7012incident-responsenist-800-171
2026-07-27 NVD CVE
CVE-2026-58662: Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerabi CRITICAL
Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version...
apache-thriftbound-readccve-2026-58662cyber-securitydefense-industrial-basedod-supply-chainimproper-input-validation
2026-07-25 NVD CVE
CVE-2026-66012: SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST CRITICAL
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This...
accesses-auth-codeadministrators-takeoveradmins-role-enforcementapi-tokenarbitrary-files-writingconf-conf-jsoncontext-isolationcookie-keys-plaintext
2026-07-24 NVD CVE
CVE-2026-58630: Improper access control in Azure App Service allows an unauthorized attacker to CRITICAL
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
azure-app-serviceazure-security-vulnerabilityimproper-access-controlnetworks-attacksnvd-cveunauthorized-privileges-escalation
2026-07-24 NVD CVE
CVE-2026-58275: Missing authorization in Azure DNS allows an unauthorized attacker to elevate pr CRITICAL
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
azure-dnscve-2026-58275missing-authorizationnetworks-compromisenvd-cveprivileges-elevationunauthorized-attacks
2026-07-24 NVD CVE
CVE-2026-62825: Improper authentication in Azure Key Vault allows an unauthorized attacker to el CRITICAL
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
azure-keys-vaultcybersecurityimproper-authenticationnetworks-attacksnvd-cveprivileges-escalationunauthorized-accessvulnerability
2026-07-24 NVD CVE
CVE-2026-56160: Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized att CRITICAL
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.
authorize-attackersazure-red-hat-openshiftimproper-authorizationnetworknvd-cveprivileges-elevationvulnerability
2026-07-24 NVD CVE
CVE-2026-56165: Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker CRITICAL
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.
buffer-overflowcve-2026-56165malware-attacksmicrosoft-accountsnetwork-executionnvd-cveunauthorized-access
2026-07-24 NVD CVE
CVE-2026-54120: Improper input validation in Microsoft Surface allows an authorized attacker to CRITICAL
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.
authorize-attackersexecutable-codeimproper-input-validationmicrosoft-surfacenetworknvd-cvevulnerability
2026-07-24 NVD CVE
CVE-2026-56191: Improper authentication in Microsoft Exchange Online allows an unauthorized atta CRITICAL
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
cve-2026-56191improper-authenticationmicrosoft-exchange-onlinenetworks-tamperingnvd-cveunauthorized-access
2026-07-24 NVD CVE
CVE-2026-50517: Deserialization of untrusted data in M365 Copilot allows an authorized attacker CRITICAL
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
authorize-attackerscode-executioncve-2026-50517deserializationm365-copilotnetworknvd-cveuntrusted-data
2026-07-24 NVD CVE
CVE-2026-62835: Improper authorization in Azure Portal allows an unauthorized attacker to disclo CRITICAL
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
azure-portalscve-2026-62835improper-authorizationinformation-disclosurenetworknvd-cveunauthorized-access
2026-07-23 NVD CVE
CVE-2026-15967: Insufficient session expiration vulnerability in Progress MOVEit Transfer. This HIGH
Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
cisacmmc-level-2compliancecve-2026-15967defense-industrial-basedodfedramp-authorizationincident-response
2026-07-23 NVD CVE
CVE-2026-44210: Kata Containers is an open source project focusing on a standard implementation CRITICAL
Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 ship with a default configuration that...
2026-07-23 NVD CVE
CVE-2026-65906: In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL s HIGH
In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
2026-07-23 NVD CVE
CVE-2026-15966: Permissive cross-domain security policy with untrusted domains vulnerability in HIGH
Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
nvd-cve
2026-07-23 NVD CVE
CVE-2026-63732: 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcode CRITICAL
9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY network gate via a spoofed Host...
9routercode-executiondefault-passwordhost-operating-systemsmalicious-pluginsnetworks-gatesnvd-cvespoofing
2026-07-23 NVD CVE
CVE-2026-65700: h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compa CRITICAL
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process...
021cve-2026-65700file-apih2ogptnvd-cveopenai-compatiblepath-traversalremote-code-execution
2026-07-23 NVD CVE
CVE-2026-15981: The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authen CRITICAL
The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This is due to the mo_saml_validate_signature() function performing a loose...
authentication-bypasscve-2026-15981nvd-cveopenssl-verifysaml-ssovulnerabilitywordpress-plugin
2026-07-23 NVD CVE
CVE-2026-15015: The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable t CRITICAL
The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is...
administrator-equivalent-accessauthorization-bypasscve-2026-15015nvd-cveoauth-bearer-tokenunauthenticated-accessesvulnerabilitywordpress-content
2026-07-23 NVD CVE
CVE-2026-65689: Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepa CRITICAL
Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary files from the...
cve-2026-65689file-readingnvd-cvepath-traversalserver-filesystemunauthenticated-accessesvulnerability
2026-07-23 NVD CVE
CVE-2024-58354: cal.com (calcom repository, later renamed cal.diy) is affected by a repository t CRITICAL
cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's...
arbitrary-commandscalcomcheck-typesymldangerous-git-checkoutgithub-actionsgithub-tokennvd-cvepull-request
2026-07-23 NVD CVE
CVE-2025-71389: Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote co CRITICAL
Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes...
attack-controlled-inputcalcomcve-2025-55182cve-2025-71389dependencynextjnvd-cverce
2026-07-23 NVD CVE
CVE-2026-14282: The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folde CRITICAL
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This...
arbitrary-files-uploadcve-2026-14282nvd-cveremote-code-executionunauthenticated-attacksvulnerabilitywordpresswpform
2026-07-23 NVD CVE
CVE-2026-64815: In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible v HIGH
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
arbitrary-code-injectioncode-injectioncve-2026-64815cybersecuritydevelopers-toolsform-fileintellij-ideajetbrain
2026-07-23 NVD CVE
CVE-2026-15011: The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable CRITICAL
The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on...
code-injectioncve-2026-15011nvd-cvesensitive-information-exposuresite-functionalityunauthenticated-attacksvulnerabilitywordpress-plugin
2026-07-23 NVD CVE
CVE-2026-10697: Improper Authentication vulnerability in Progress MOVEit Transfer. This issue a HIGH
Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
authentication-bypasscisacmmc-level-2cve-2026-10697datum-exfiltrationdodfedramp-authorizationimproper-authentication
2026-07-22 NVD CVE
CVE-2026-50252: In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is rand CRITICAL
In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies...
cve-2026-50252dns-caches-poisoning-attacksdns-caches-poisoningsdns-transactionentropyload-balancing-policiesmalicious-actorsnvd-cve
2026-07-22 NVD CVE
CVE-2026-16232: An authentication bypass vulnerability in the Check Point SmartConsole login pro CRITICAL ◈ 2 sources · orig. NVD CVE
An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative...
administrative-privilegescheck-pointcisa-kevcve-2026-16232improper-authentication-vulnerabilityremote-attacks
2026-07-22 NVD CVE
CVE-2026-2395: Improper neutralization of special elements used in an SQL command ('SQL injecti CRITICAL
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code...
cyber-attackscyber-securitydata-breachesimproper-neutralizationinformation-securityno-code-platformnvd-cvesecurities-risks
2026-07-22 NVD CVE
CVE-2026-60369: Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion CRITICAL
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily...
availabilitybasis-score-99centralizes-thirdparty-jarconfidentialitycve-2026-60369cvss-31httpimpact
2026-07-22 NVD CVE
CVE-2026-60372: Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion CRITICAL
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily...
availabilitybasis-score-98centralizes-thirdparty-jarconfidentialitycvss-31httpimpactintegrity
2026-07-22 NVD CVE
CVE-2026-60367: Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion CRITICAL
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily...
ac-lbasis-score-98c-hcentralizes-thirdparty-jarconfidentiality-integrity-availabilitycvas-ncvss-31h
2026-07-22 NVD CVE
CVE-2026-60366: Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion CRITICAL
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily...
basis-score-100centralizes-thirdparty-jarconfidentiality-integrity-availabilitycve-2026-60366cvss-31httpimpactjava
2026-07-22 NVD CVE
CVE-2026-65590: n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restri CRITICAL
n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package (sandboxing was applied only on macOS). Shell commands executed by the tool...
computer-use-packagecve-2026-65590cybersecurityfilesystem-accessesincident-responselinuxmacon8n
2026-07-21 NVD CVE
CVE-2026-61059: Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracl CRITICAL
Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft (component: Security). The supported version that is affected is 9.2. Easily exploitable vulnerability allows...
2026-07-21 NVD CVE
CVE-2026-8983: Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authen CRITICAL
Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to...
◀ PREV PAGE 13 / 45 NEXT ▶