LIVE FEED
1828 events · 4 sources · newest first
Events in view
1828
all sources
Critical
1828
severity
Active sources
4
collectors
Last sync
2026-08-27 00:00
UTC
2025-01-14
NVD CVE
CVE-2024-55591: An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-2
CRITICAL
◈ 2 sources · orig. NVD CVE
An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy version 7.0.0 through 7.0.19 and 7.2.0 through 7.2.12 allows a remote...
2025-01-13
CISA KEV
Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.
2025-01-09
NVD CVE
CVE-2024-53704: An Improper Authentication vulnerability in the SSLVPN authentication mechanism
CRITICAL
◈ 2 sources · orig. NVD CVE
An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication.
2025-01-08
CISA KEV
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
CRITICAL
◈ 2 sources · orig. NVD CVE
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
2025-01-08
NVD CVE
CVE-2025-0282: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5,
CRITICAL
◈ 2 sources · orig. NVD CVE
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote...
2025-01-07
CISA KEV
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an...
2025-01-07
CISA KEV
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This...
2024-12-17
CISA KEV
Cleo Multiple Products Unauthenticated File Upload Vulnerability
CRITICAL
◈ 2 sources · orig. NVD CVE
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload vulnerability that could allow an unauthenticated user to import and execute arbitrary bash or...
2024-12-13
CISA KEV
Cleo Harmony, VLTrader, and LexiCom, which are managed file transfer products, contain an unrestricted file upload and download vulnerability that can lead to remote code execution with elevated privileges.
2024-12-13
NVD CVE
CVE-2024-55956: In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.
CRITICAL
◈ 2 sources · orig. NVD CVE
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the...
2024-12-04
CISA KEV
CyberPanel contains an incorrect default permissions vulnerability that allows for authentication bypass and the execution of arbitrary commands using shell metacharacters in the statusfile property.
2024-12-03
CISA KEV
Multiple Zyxel firewalls contain a path traversal vulnerability in the web management interface that could allow an attacker to download or upload files via a crafted URL.
2024-11-26
NVD CVE
CVE-2024-11680: ProjectSend versions prior to r1720 are affected by an improper authentication v
CRITICAL
◈ 2 sources · orig. NVD CVE
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw by sending crafted HTTP requests to options.php, enabling...
2024-11-25
CISA KEV
Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability
CRITICAL
◈ 2 sources · orig. NVD CVE
Array Networks AG and vxAG ArrayOS contain a missing authentication for critical function vulnerability that allows an attacker to read local files and execute code on the SSL VPN gateway.
2024-11-22
NVD CVE
CVE-2024-52723: In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str f
CRITICAL
In TOTOLINK X6000R V9.4.0cu.1041_B20240224 in the shttpd file, the Uci_Set Str function is used without strict parameter filtering. An attacker can achieve arbitrary command execution by constructing the payload.
2024-11-19
NVD CVE
CVE-2024-52714: Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the f
CRITICAL
Tenda AC6 v2.0 v15.03.06.50 was discovered to contain a buffer overflow in the function 'fromSetSysTime.
2024-11-18
CISA KEV
Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability
CRITICAL
◈ 2 sources · orig. NVD CVE
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability in the web-based management interface for several PAN-OS products, including firewalls and VPN concentrators.
2024-11-18
NVD CVE
CVE-2024-0012: An authentication bypass in Palo Alto Networks PAN-OS software enables an unauth
CRITICAL
◈ 2 sources · orig. NVD CVE
An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative...
2024-11-18
CISA KEV
Palo Alto Networks PAN-OS contains an OS command injection vulnerability that allows for privilege escalation through the web-based management interface for several PAN products, including firewalls and VPN concentrators.
2024-11-12
CISA KEV
Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.
2024-11-07
CISA KEV
CyberPanel contains an incorrect default permissions vulnerability that allows a remote, unauthenticated attacker to execute commands as root.
2024-10-29
NVD CVE
CVE-2024-51567: upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before
CRITICAL
◈ 2 sources · orig. NVD CVE
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing...
2024-10-29
NVD CVE
CVE-2024-51378: getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel)
CRITICAL
◈ 2 sources · orig. NVD CVE
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or...
2024-10-28
NVD CVE
CVE-2024-50623: In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.
CRITICAL
◈ 2 sources · orig. NVD CVE
In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.
2024-10-22
CISA KEV
Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution.
2024-10-21
NVD CVE
CVE-2024-41713: A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiColl
CRITICAL
◈ 2 sources · orig. NVD CVE
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input...
2024-10-20
NVD CVE
CVE-2024-49604: Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Medi
CRITICAL
Authentication Bypass Using an Alternate Path or Channel vulnerability in N-Media Simple User Registration wp-registration allows Authentication Bypass.This issue affects Simple User Registration: from n/a through <= 6.7.
2024-10-17
CISA KEV
Veeam Backup and Replication contains a deserialization vulnerability allowing an unauthenticated user to perform remote code execution.
2024-10-15
CISA KEV
Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.
2024-10-15
CISA KEV
Mozilla Firefox and Firefox ESR contain a use-after-free vulnerability in Animation timelines that allows for code execution in the content process.
2024-10-09
NVD CVE
CVE-2024-9680: An attacker was able to achieve code execution in the content process by exploit
CRITICAL
◈ 2 sources · orig. NVD CVE
An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of this vulnerability being exploited in the wild. This vulnerability...
2024-10-07
NVD CVE
CVE-2024-46446: Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct
CRITICAL
Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of...
2024-09-25
NVD CVE
CVE-2024-6593: Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka
CRITICAL
Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands.
An attacker that has...
2024-09-25
NVD CVE
CVE-2024-6592: An incorrect authorization vulnerability in the protocol communication between t
CRITICAL
An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS...
2024-09-19
NVD CVE
CVE-2024-33109: Directory Traversal in the web interface of the Tiptel IP 286 with firmware vers
CRITICAL
Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function.
2024-09-17
NVD CVE
CVE-2024-44004: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti
CRITICAL
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection.
This issue affects WPCargo Track & Trace: before 8.0.4.
2024-09-16
CISA KEV
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
2024-09-09
CISA KEV
SonicWall SonicOS contains an improper access control vulnerability that could lead to unauthorized resource access and, under certain conditions, may cause the firewall to crash.
2024-09-09
NVD CVE
CVE-2024-44902: A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to
CRITICAL
A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.
2024-09-09
CISA KEV
Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.