Live feed · cooey

2026-04-10 NVD CVE

CVE-2026-5483: A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in HIGH

A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a...

2026-04-10 NVD CVE

CVE-2026-40190: LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. MEDIUM

LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally...

2026-04-09 NVD CVE

CVE-2025-62718: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15. CRITICAL

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like...

2026-04-09 NVD CVE

CVE-2026-34184: AlanWeb SCADA does not enforce authorization for some directories. This allows a CRITICAL

AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP...

2026-04-08 NVD CVE

CVE-2026-39888: PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in pra CRITICAL

PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted...

2026-04-08 NVD CVE

CVE-2026-39429: kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kub HIGH

kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no...

2026-04-08 NVD CVE

CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash HIGH

Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction...

2026-04-08 NVD CVE

CVE-2026-35477: InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, th MEDIUM

InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual...

2026-04-08 NVD CVE

CVE-2026-39394: CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo HIGH

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST...

2026-04-08 NVD CVE

CVE-2026-5300: Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows una MEDIUM

Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests

2026-04-08 NVD CVE

CVE-2026-33088: Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability CRITICAL

Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.

2026-04-08 NVD CVE

CVE-2026-31017: A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format fu CRITICAL

A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered...

2026-04-08 NVD CVE

CVE-2026-39892: cryptography is a package designed to expose cryptographic primitives and recipe CRITICAL

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g....

2026-04-08 NVD CVE

CVE-2025-52221: Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm f CRITICAL

Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.

2026-04-08 NVD CVE

CVE-2026-27143: Arithmetic over induction variables in loops were not correctly checked for unde CRITICAL

Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.

2026-04-07 NVD CVE

CVE-2026-34582: Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implem CRITICAL

Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to...

2026-04-07 NVD CVE

CVE-2026-28808: Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unaut CRITICAL

Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias. When script_alias maps a URL prefix to a...

2026-04-07 NVD CVE

CVE-2026-34078: Flatpak is a Linux application sandboxing and distribution framework. Prior to 1 CRITICAL

Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths....

2026-04-07 NVD CVE

CVE-2026-5734: Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Fire CRITICAL

Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some...

2026-04-07 NVD CVE

CVE-2026-5735: Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of t CRITICAL

Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...

2026-04-07 NVD CVE

CVE-2026-34045: Podman Desktop is a graphical tool for developing on containers and Kubernetes. HIGH

Podman Desktop is a graphical tool for developing on containers and Kubernetes. Prior to 1.26.2, an unauthenticated HTTP server exposed by Podman Desktop allows any network attacker to remotely trigger...

2026-04-07 NVD CVE

CVE-2026-39846: SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious no CRITICAL

SiYuan is a personal knowledge management system. Prior to 3.6.4, a malicious note synced to another user can trigger remote code execution in the SiYuan Electron desktop client. The root cause is that table caption...

2026-04-07 NVD CVE

CVE-2026-31789: Issue summary: Converting an excessively large OCTET STRING value to a hexadecim CRITICAL

Issue summary: Converting an excessively large OCTET STRING value to a hexadecimal string leads to a heap buffer overflow on 32 bit platforms. Impact summary: A heap buffer overflow may lead to a crash or...

2026-04-07 NVD CVE

CVE-2026-39397: @delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual CRITICAL

@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with...

2026-04-07 NVD CVE

CVE-2026-33439: Open Access Management (OpenAM) is an access management solution. Prior to 16.0. CRITICAL

Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the...

2026-04-07 NVD CVE

CVE-2026-39351: Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, CRITICAL

Frappe is a full-stack web application framework. Prior to 16.14.0 and 15.104.0, Frappe allows unrestricted Doctype access via API exploit.

2026-04-06 NVD CVE

CVE-2026-35178: Workbench is a suite of tools for administrators and developers to interact with CRITICAL

Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains remote code execution vulnerability in the...

2026-04-06 NVD CVE

CVE-2026-34444: Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, CRITICAL

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This...

2026-04-06 NVD CVE

CVE-2026-35408: Directus is a real-time API and App dashboard for managing SQL database content. HIGH

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without...

2026-04-06 NVD CVE

CVE-2026-35459: pyLoad is a free and open-source download manager written in Python. In 0.5.0b3. CRITICAL

pyLoad is a free and open-source download manager written in Python. In 0.5.0b3.dev96 and earlier, pyLoad has a server-side request forgery (SSRF) vulnerability. The fix for CVE-2026-33992 added IP validation to...

2026-04-06 NVD CVE

CVE-2026-35184: EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQ CRITICAL

EcclesiaCRM is CRM Software for church management. Prior to 8.0.0, there is a SQL injection vulnerability in v2/templates/query/queryview.php via the custom and value parameters. This vulnerability is fixed in 8.0.0.

2026-04-06 NVD CVE

CVE-2026-35197: dye is a portable and respectful color library for shell scripts. Prior to 1.1.1 MEDIUM

dye is a portable and respectful color library for shell scripts. Prior to 1.1.1, certain dye template expressions would result in execution of arbitrary code. This issue was discovered and fixed by dye's author, and...

2026-04-05 NVD CVE

CVE-2026-5570: A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. HIGH

A vulnerability was determined in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. The affected element is the function index_config of the file /LoginCB. This manipulation causes improper authentication. It is possible...

2026-04-05 NVD CVE

CVE-2026-5569: A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impac HIGH

A vulnerability was found in Technostrobe HI-LED-WR120-G2 5.5.0.1R6.03.30. Impacted is an unknown function of the file /Technostrobe/ of the component Endpoint. The manipulation results in improper access controls....

2026-04-05 NVD CVE

CVE-2019-25704: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers HIGH

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the filter_user_mail parameter. Attackers can send crafted requests with...

2026-04-05 NVD CVE

CVE-2019-25702: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers HIGH

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_project parameter. Attackers can send crafted requests with...

2026-04-05 NVD CVE

CVE-2019-25700: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers HIGH

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the sort_direction parameter. Attackers can submit malicious SQL...

2026-04-05 NVD CVE

CVE-2019-25698: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers HIGH

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_to_delete parameter. Attackers can send crafted requests with...

2026-04-05 NVD CVE

CVE-2019-25696: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers HIGH

Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the language_tag parameter. Attackers can submit malicious SQL statements...

2026-04-05 NVD CVE

CVE-2019-25694: Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthent HIGH

Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user2reset parameter. Attackers can send crafted...