Skip to content
COOEY
LIVE FEED
1828 events · 4 sources · newest first
Events in view
1828
all sources
Critical
1828
severity
Active sources
4
collectors
Last sync
2026-08-26 18:00
UTC
All data Vulns · 3593Regulatory · 144News · 410 LIVE · UPDATES ON COLLECT
All sources NVD CVE · 1776CISA KEV · 1683CISA advisory · 115DC3 DCISE · 19
Any severity Critical High ⊙ SUBSCRIBE (RSS)
2026-05-04 NVD CVE
CVE-2026-26332: vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, Suppresse CRITICAL
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
2026-04-30 CISA KEV
WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability CRITICAL
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the...
2026-04-30 NVD CVE
CVE-2026-35051: Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3 CRITICAL
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false...
2026-04-30 NVD CVE
CVE-2026-39858: Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3 CRITICAL
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based...
2026-04-28 CISA KEV
ConnectWise ScreenConnect Path Traversal Vulnerability CRITICAL
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
2026-04-24 CISA KEV
SimpleHelp Missing Authorization Vulnerability CRITICAL
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
2026-04-24 CISA KEV
SimpleHelp Path Traversal Vulnerability CRITICAL
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute...
2026-04-24 NVD CVE
CVE-2026-41473: CyberPanel versions prior to 2.4.4 contain an authentication bypass vulnerabilit CRITICAL
CyberPanel versions prior to 2.4.4 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending...
2026-04-23 NVD CVE
CVE-2026-41179: Rclone is a command-line program to sync files and directories to and from diffe CRITICAL
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed...
2026-04-23 NVD CVE
CVE-2026-41176: Rclone is a command-line program to sync files and directories to and from diffe CRITICAL
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime...
2026-04-23 NVD CVE
CVE-2026-25874: LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the as CRITICAL
LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the...
2026-04-22 CISA KEV
Microsoft Defender Insufficient Granularity of Access Control Vulnerability CRITICAL
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
2026-04-20 CISA KEV
PaperCut NG/MF Improper Authentication Vulnerability CRITICAL
PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.
2026-04-20 CISA KEV
JetBrains TeamCity Relative Path Traversal Vulnerability CRITICAL
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.
2026-04-18 NVD CVE
CVE-2026-41242: protobufjs compiles protobuf definitions into JavaScript (JS) functions. In vers CRITICAL
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute...
2026-04-14 NVD CVE
CVE-2026-34615: Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserializati CRITICAL
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could...
2026-04-14 NVD CVE
CVE-2026-39906: Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose CRITICAL
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a...
2026-04-14 NVD CVE
CVE-2026-39907: Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose CRITICAL
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file paths in the ReadLicense action's LFName parameter,...
2026-04-14 NVD CVE
CVE-2026-35033: Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 c CRITICAL
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter...
2026-04-13 CISA KEV
Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability CRITICAL
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
2026-04-13 NVD CVE
CVE-2026-0234: An improper verification of cryptographic signature vulnerability exists in Cort CRITICAL
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify...
2026-04-09 NVD CVE
CVE-2026-34184: AlanWeb SCADA does not enforce authorization for some directories. This allows a CRITICAL
AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP...
2026-04-09 NVD CVE
CVE-2025-62718: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15. CRITICAL
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like...
2026-04-08 NVD CVE
CVE-2026-39892: cryptography is a package designed to expose cryptographic primitives and recipe CRITICAL
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g....
2026-04-08 NVD CVE
CVE-2025-52221: Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm f CRITICAL
Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.
2026-04-08 NVD CVE
CVE-2026-33088: Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability CRITICAL
Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.
2026-04-08 NVD CVE
CVE-2026-31017: A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format fu CRITICAL
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered...
2026-04-08 NVD CVE
CVE-2026-39888: PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in pra CRITICAL
PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted...
2026-04-08 NVD CVE
CVE-2026-27143: Arithmetic over induction variables in loops were not correctly checked for unde CRITICAL
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
2026-04-07 NVD CVE
CVE-2026-33439: Open Access Management (OpenAM) is an access management solution. Prior to 16.0. CRITICAL
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the...
2026-04-07 NVD CVE
CVE-2026-28808: Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unaut CRITICAL
Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a...
2026-04-07 NVD CVE
CVE-2026-39351: Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, CRITICAL
Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.
2026-04-07 NVD CVE
CVE-2026-5734: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fire CRITICAL
Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some...
2026-04-07 NVD CVE
CVE-2026-5735: Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of t CRITICAL
Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...
2026-04-07 NVD CVE
CVE-2026-34582: Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implem CRITICAL
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to...
2026-04-07 NVD CVE
CVE-2026-39397: @delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual CRITICAL
@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with...
2026-04-07 NVD CVE
CVE-2026-31789: Issue summary: Converting an excessively large OCTET STRING value to a hexadecim CRITICAL
Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or...
2026-04-07 NVD CVE
CVE-2026-34078: Flatpak is a Linux application sandboxing and distribution framework. Prior to 1 CRITICAL
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths....
2026-04-07 NVD CVE
CVE-2026-39846: SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious no CRITICAL
SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption...
2026-04-06 NVD CVE
CVE-2026-35184: EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQ CRITICAL
EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.
◀ PREV PAGE 26 / 46 NEXT ▶