LIVE FEED
1828 events · 4 sources · newest first
Events in view
1828
all sources
Critical
1828
severity
Active sources
4
collectors
Last sync
2026-08-26 18:00
UTC
2026-02-24
NVD CVE
CVE-2026-2771: Undefined behavior in the DOM: Core & HTML component. This vulnerability was fix
CRITICAL
Undefined behavior in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2777: Privilege escalation in the Messaging System component. This vulnerability was f
CRITICAL
Privilege escalation in the Messaging System component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2772: Use-after-free in the Audio/Video: Playback component. This vulnerability was fi
CRITICAL
Use-after-free in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2773: Incorrect boundary conditions in the Web Audio component. This vulnerability was
CRITICAL
Incorrect boundary conditions in the Web Audio component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2765: Use-after-free in the JavaScript Engine component. This vulnerability was fixed
CRITICAL
Use-after-free in the JavaScript Engine component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2774: Integer overflow in the Audio/Video component. This vulnerability was fixed in F
CRITICAL
Integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2775: Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixe
CRITICAL
Mitigation bypass in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2776: Sandbox escape due to incorrect boundary conditions in the Telemetry component i
CRITICAL
Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2766: Use-after-free in the JavaScript Engine: JIT component. This vulnerability was f
CRITICAL
Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2757: Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnera
CRITICAL
Incorrect boundary conditions in the WebRTC: Audio/Video component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2758: Use-after-free in the JavaScript: GC component. This vulnerability was fixed in
CRITICAL
Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2759: Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerab
CRITICAL
Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-24
NVD CVE
CVE-2026-2760: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender c
CRITICAL
Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component. This vulnerability was fixed in Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8.
2026-02-13
CISA KEV
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute operating system...
2026-02-11
NVD CVE
CVE-2026-20677: A race condition was addressed with improved handling of symbolic links. This is
CRITICAL
A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3,...
2026-02-07
NVD CVE
CVE-2026-25560: WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in L
CRITICAL
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate...
2026-02-06
NVD CVE
CVE-2026-1709: A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does n
CRITICAL
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated...
2026-02-05
CISA KEV
SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
CRITICAL
◈ 2 sources · orig. NVD CVE
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP...
2026-01-26
CISA KEV
SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
CRITICAL
◈ 2 sources · orig. NVD CVE
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify...
2026-01-26
CISA KEV
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server,...
2026-01-23
NVD CVE
CVE-2026-24423: SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated
CRITICAL
◈ 2 sources · orig. NVD CVE
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP...
2026-01-23
NVD CVE
CVE-2026-24304: Improper access control in Azure Resource Manager allows an authorized attacker
CRITICAL
Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.
2026-01-22
NVD CVE
CVE-2026-23760: SmarterTools SmarterMail versions prior to build 9511 contain an authentication
CRITICAL
◈ 2 sources · orig. NVD CVE
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the...
2026-01-20
NVD CVE
CVE-2025-55130: A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-rea
CRITICAL
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted...
2026-01-19
NVD CVE
CVE-2026-23884: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A...
2026-01-19
NVD CVE
CVE-2026-23534: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past...
2026-01-19
NVD CVE
CVE-2026-23532: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between...
2026-01-19
NVD CVE
CVE-2026-23531: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the...
2026-01-19
NVD CVE
CVE-2026-23533: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes...
2026-01-19
NVD CVE
CVE-2026-23883: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering...
2026-01-19
NVD CVE
CVE-2026-23530: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE...
2026-01-14
NVD CVE
CVE-2026-22858: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char...
2026-01-14
NVD CVE
CVE-2026-22859: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in...
2026-01-14
NVD CVE
CVE-2026-22855: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This...
2026-01-14
NVD CVE
CVE-2026-22853: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1
CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated...
2026-01-12
NVD CVE
CVE-2026-22214: RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buf
CRITICAL
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The...
2026-01-12
NVD CVE
CVE-2026-22213: RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buf
CRITICAL
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen()...
2026-01-07
NVD CVE
CVE-2026-22189: The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains
CRITICAL
The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker-controlled input. When constructing...
2026-01-07
NVD CVE
CVE-2025-12543: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBo
CRITICAL
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a...
2025-12-31
NVD CVE
CVE-2025-34468: libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a s
CRITICAL
libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer...