Skip to content
COOEY
LIVE FEED
3593 events · 4 sources · newest first
Events in view
3593
all sources
Critical
1828
severity
Active sources
4
collectors
Last sync
2026-08-26 18:00
UTC
All data Vulns · 3593Regulatory · 144News · 410 LIVE · UPDATES ON COLLECT
All sources NVD CVE · 1776CISA KEV · 1683CISA advisory · 115DC3 DCISE · 19
Any severity Critical High ⊙ SUBSCRIBE (RSS)
2026-07-07 CISA KEV
JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability HIGH ◈ 2 sources · orig. NVD CVE
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.
arbitrary-files-uploadcisa-kevcve-2026-48908joomshaperphp-code-executionsecurities-riskssoftware-vulnerabilitiessp-page-builder
2026-07-07 CISA advisory
Siemens SINEC OS ↗
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>SINEC OS before V4.0 contains multiple...
authentication-bypasscisa-advisorycritical-infrastructurecross-site-scriptingcve-2025-1352cve-2025-1376cve-2025-6052cve-2025-6141
2026-07-07 CISA KEV
Langflow Authorization Bypass Through User-Controlled Key Vulnerability HIGH
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.
authenticate-attackerauthorization-bypasscisa-kevcve-2026-55255cybersecurityflow-executionlangflowsecurities-risks
2026-07-06 NVD CVE
CVE-2026-54763: Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, CRITICAL
Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing...
2026-07-06 NVD CVE
CVE-2026-9182: ArcGIS Server contains an unrestricted file upload vulnerability. An unauthentic MEDIUM
ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow...
access-controlarbitrary-files-uploadarcgis-servercmmccve-2026-9182cybersecuritydata-integritydfar-252-204-7012
2026-07-06 NVD CVE
CVE-2026-40141: A high-severity vulnerability exists in a web application component of BeyondTru CRITICAL
A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of...
2026-07-06 NVD CVE
CVE-2026-40139: A critical pre-authentication vulnerability exists in the authentication subsyst CRITICAL
A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass...
2026-07-04 NVD CVE
CVE-2026-14535: In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImports HIGH
In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the...
2026-07-03 NVD CVE
CVE-2026-47898: Improper Restriction of XML External Entity Reference vulnerability in Apache Lu CRITICAL
Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before...
2026-07-03 NVD CVE
CVE-2026-12481: A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code exe CRITICAL
A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()`...
2026-07-03 NVD CVE
CVE-2026-57983: Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized HIGH
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
2026-07-02 NVD CVE
CVE-2026-55116: A malicious actor with access to the network and under certain network configura CRITICAL
A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to...
2026-07-02 NVD CVE
CVE-2026-26145: Improper access control in Azure Synapse allows an authorized attacker to elevat MEDIUM
Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.
2026-07-02 NVD CVE
CVE-2026-55115: A malicious actor with access to the network and low privileges could exploit a CRITICAL
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.
2026-07-02 NVD CVE
CVE-2026-54408: A malicious actor with access to the network could exploit an Improper Access Co HIGH
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming.
2026-07-02 NVD CVE
CVE-2026-41106: Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un CRITICAL
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
2026-07-02 NVD CVE
CVE-2026-59092: JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypas HIGH
JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper...
2026-07-01 NVD CVE
CVE-2026-58025: Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWik CRITICAL
Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php,...
2026-07-01 NVD CVE
CVE-2026-14363: Improper neutralization of special elements used in an SQL command ('SQL injecti CRITICAL
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo...
2026-07-01 NVD CVE
CVE-2026-53492: containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2. CRITICAL
containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint...
2026-07-01 NVD CVE
CVE-2026-50195: containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 a CRITICAL
containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a...
2026-07-01 NVD CVE
CVE-2026-58521: Improper neutralization of special elements used in an SQL command ('SQL injecti CRITICAL
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo...
2026-07-01 NVD CVE
CVE-2026-58453: JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a h CRITICAL
JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default admin...
2026-07-01 NVD CVE
CVE-2026-34106: Guardian language-system passes the id GET parameter directly into a PHP exec() CRITICAL
Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\"...
2026-07-01 NVD CVE
CVE-2026-34100: Guardian language-system passes the id GET parameter directly into an unsanitize CRITICAL
Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id =...
2026-07-01 CISA KEV
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability HIGH
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
2026-06-30 NVD CVE
CVE-2026-14120: Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 CRITICAL
Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page....
2026-06-30 NVD CVE
CVE-2026-14109: Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 CRITICAL
Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page....
2026-06-30 NVD CVE
CVE-2026-14106: Insufficient validation of untrusted input in Text in Google Chrome on Android p CRITICAL
Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a...
2026-06-30 NVD CVE
CVE-2026-14104: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome pr CRITICAL
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security...
2026-06-30 NVD CVE
CVE-2026-14101: Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150. CRITICAL
Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML...
2026-06-30 NVD CVE
CVE-2026-13785: Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allow CRITICAL
Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML...
2026-06-30 NVD CVE
CVE-2026-13782: Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remo CRITICAL
Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...
2026-06-30 NVD CVE
CVE-2026-13781: Insufficient validation of untrusted input in Skia in Google Chrome prior to 150 CRITICAL
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML...
2026-06-30 NVD CVE
CVE-2026-13780: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 CRITICAL
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted...
2026-06-30 NVD CVE
CVE-2026-13776: Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote CRITICAL
Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...
2026-06-30 NVD CVE
CVE-2026-13775: Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote a CRITICAL
Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...
2026-06-30 NVD CVE
CVE-2026-11541: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv HIGH
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
2026-06-30 NVD CVE
CVE-2026-7663: IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to ac CRITICAL
IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP...
2026-06-30 NVD CVE
CVE-2026-13773: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated C MEDIUM
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java...
◀ PREV PAGE 29 / 90 NEXT ▶