Skip to content
COOEY
LIVE FEED
1821 events · 4 sources · newest first
Events in view
1821
all sources
Critical
1821
severity
Active sources
4
collectors
Last sync
2026-08-26 12:00
UTC
All data Vulns · 3576Regulatory · 144News · 399 LIVE · UPDATES ON COLLECT
All sources NVD CVE · 1767CISA KEV · 1677CISA advisory · 113DC3 DCISE · 19
Any severity Critical High ⊙ SUBSCRIBE (RSS)
2026-06-30 NVD CVE
CVE-2026-14101: Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150. CRITICAL
Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML...
2026-06-30 NVD CVE
CVE-2026-13785: Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allow CRITICAL
Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML...
2026-06-30 NVD CVE
CVE-2026-13782: Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remo CRITICAL
Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...
2026-06-30 NVD CVE
CVE-2026-13781: Insufficient validation of untrusted input in Skia in Google Chrome prior to 150 CRITICAL
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML...
2026-06-30 NVD CVE
CVE-2026-13780: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 CRITICAL
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted...
2026-06-30 NVD CVE
CVE-2026-13776: Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote CRITICAL
Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...
2026-06-30 NVD CVE
CVE-2026-13775: Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote a CRITICAL
Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...
2026-06-30 NVD CVE
CVE-2026-7663: IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to ac CRITICAL
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP...
2026-06-30 NVD CVE
CVE-2026-14241: Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidenc CRITICAL
Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This...
2026-06-30 NVD CVE
CVE-2026-8655: Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway  CRITICAL
Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler...
2026-06-30 NVD CVE
CVE-2026-8452: Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unp CRITICAL
Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy)...
2026-06-29 NVD CVE
CVE-2026-11720: A path traversal vulnerability exists in the HTTP tool URL builder of googleapis CRITICAL
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured...
2026-06-29 NVD CVE
CVE-2026-56290: The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitra CRITICAL ◈ 2 sources · orig. NVD CVE
The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.
arbitrary-files-uploadcisa-kevcve-2026-56290improper-access-controljoomlackpage-builderremote-code-executionsoftware-vulnerabilities
2026-06-25 NVD CVE
CVE-2025-71338: Flowise contains a path traversal vulnerability in the /api/v1/document-store/lo CRITICAL
Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit...
2026-06-25 NVD CVE
CVE-2025-71333: Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerab CRITICAL
Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and...
2026-06-23 NVD CVE
CVE-2026-53622: Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a c CRITICAL
Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass...
2026-06-23 NVD CVE
CVE-2026-48491: Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, ther CRITICAL
Traefik is an HTTP reverse proxy and load balancer. From 3.7.0 until 3.7.3, there is a high severity vulnerability in Traefik's domain-fronting protection (SNICheck) that allows an unauthenticated client to bypass...
2026-06-23 NVD CVE
CVE-2026-48020: Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, an CRITICAL
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.48, 3.6.19, and 3.7.3, there is a high severity vulnerability in Traefik's StripPrefix middleware that allows an unauthenticated attacker to bypass...
2026-06-22 NVD CVE
CVE-2026-49468: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo CRITICAL
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, a Host-header parsing flaw in the LiteLLM proxy could, under specific conditions, allow unauthenticated access to...
2026-06-22 NVD CVE
CVE-2026-6653: Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2. CRITICAL
Use After Free in libxml2's xmlParseInternalSubset from GNOME libxml2 version 2.9.11 to 2.11.0 allows a remote attacker to cause a denial-of-service via maliciously crafted XML input with improper entity resolution handling.
2026-06-20 NVD CVE
CVE-2026-48939: A vulnerability in the iCagenda extension for Joomla allows the upload of arbitr CRITICAL ◈ 2 sources · orig. NVD CVE
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
arbitrary-files-uploadcisa-kevcve-2026-48939cybersecuritydata-protectionfiles-attachmentsicagendaincident-response
2026-06-20 NVD CVE
CVE-2026-48908: A vulnerability in SP Page Builder for Joomla allows unauthenticated users to up CRITICAL ◈ 2 sources · orig. NVD CVE
A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
arbitrary-files-uploadcisa-kevcve-2026-48908joomshaperphp-code-executionsecurities-riskssoftware-vulnerabilitiessp-page-builder
2026-06-19 NVD CVE
CVE-2026-51846: In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMac CRITICAL
In Tenda AC7 v15.03.06.44, the wanSpeed parameter of the route /goform/AdvSetMacMtuWan has a stack buffer overflow vulnerability that can lead to remote arbitrary code execution.
2026-06-19 NVD CVE
CVE-2026-51845: Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /go CRITICAL
Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the mac parameter.
2026-06-19 NVD CVE
CVE-2026-51844: Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /go CRITICAL
Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the cloneType parameter.
2026-06-19 NVD CVE
CVE-2026-51843: Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /go CRITICAL
Tenda AC7 v15.03.06.44 contains a stack buffer overflow vulnerability in the /goform/AdvSetMacMtuWan interface via the wanMTU parameter.
2026-06-18 NVD CVE
CVE-2026-12569: A critical remote code execution (RCE) vulnerability has been reported in PTC Wi CRITICAL ◈ 2 sources · orig. NVD CVE
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory...
2026-06-18 NVD CVE
CVE-2026-11717: An authentication bypass vulnerability exists in the generic opaque token valida CRITICAL
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection...
2026-06-18 NVD CVE
CVE-2026-9158: In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE conne CRITICAL
In Eclipse 4diac FORTE versions 3.0.0 to 3.1.0, a specially crafted DELETE connection command to the management interface can lead to a dangling pointer. This allows subsequent commands to access freed memory...
2026-06-18 NVD CVE
CVE-2026-11718: An authentication bypass vulnerability exists in the generic opaque token valida CRITICAL
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection...
2026-06-17 NVD CVE
CVE-2026-3894: Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) al CRITICAL
Out-of-bounds Read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.3, from 6.1.0 before...
2026-06-17 NVD CVE
CVE-2026-30803: Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core CRITICAL
Integer Underflow (Wrap or Wraparound) vulnerability in RTI Connext Micro (Core Libraries) allows Overread Buffers.This issue affects Connext Micro: from 4.0.0 before 4.3.0.
2026-06-16 NVD CVE
CVE-2026-12293: Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed i CRITICAL
Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.
2026-06-12 NVD CVE
CVE-2026-50086: The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round CRITICAL
The Aqara IAM/SSO gateway (gw-builder.aqara.com) exposes bidirectional AES round-trups against the platform's signing key without authentication. This is an instance of "CWE-306: Missing Authentication for Critical...
2026-06-12 NVD CVE
CVE-2026-50083: The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client c CRITICAL
The Aqara IAM/SSO Gateway (gw-builder.aqara.com) used a hardcoded OAuth client credential, which is an instance of "CWE-798: Use of Hard-coded Credentials." This issue has an estimated CVSS...
2026-06-12 NVD CVE
CVE-2026-49875: Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct CRITICAL
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users...
2026-06-12 NVD CVE
CVE-2026-44172: MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 CRITICAL
MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the...
2026-06-12 NVD CVE
CVE-2026-44170: MariaDB server is a community developed fork of MySQL server. From versions 10.6 CRITICAL
MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB on WIndows with...
2026-06-12 NVD CVE
CVE-2026-50628: A logic error in OAuthRequestFilter rejects legitimate requests originating from CRITICAL
A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates...
2026-06-12 NVD CVE
CVE-2026-50627: The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Aud CRITICAL
The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' (Audience) claims of incoming JWT access tokens. This allows a JWT issued for one Resource Server to be successfully replayed against a...
◀ PREV PAGE 22 / 46 NEXT ▶