LIVE FEED
3595 events · 4 sources · newest first
Events in view
3595
all sources
Critical
1828
severity
Active sources
4
collectors
Last sync
2026-08-27 00:00
UTC
2026-06-08
NVD CVE
CVE-2026-46440: Flowise is a drag & drop user interface to build a customized large language mod
CRITICAL
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct...
2026-06-08
NVD CVE
CVE-2026-42861: Flowise is a drag & drop user interface to build a customized large language mod
CRITICAL
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint of FlowiseAI. The endpoint...
2026-06-08
NVD CVE
CVE-2026-46442: Flowise is a drag & drop user interface to build a customized large language mod
CRITICAL
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, POST /api/v1/node-custom-function lacks route-level authorization, allowing any authenticated user or...
2026-06-08
CISA KEV
Check Point Security Gateway contains an improper authentication vulnerability in IKEv1 key exchange that could allow an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN...
2026-06-08
CISA KEV
BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.
2026-06-05
NVD CVE
CVE-2026-48907: A vulnerability in the JCE editor extension for Joomla allows the creation of ne
CRITICAL
◈ 2 sources · orig. NVD CVE
A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.
2026-06-05
NVD CVE
CVE-2026-45777: OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Startin
CRITICAL
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version 11.0.3, an attacker can remotely execute arbitrary system commands on the web server hosting...
2026-06-05
NVD CVE
CVE-2026-45779: OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL
CRITICAL
OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL injection vulnerability exists in Open XDMoD versions prior to 10.0.3 that allows an unauthenticated remote attacker to execute...
2026-06-05
CISA KEV
SolarWinds Serv-U contains an uncontrolled resource consumption vulnerability that allows specially crafted POST requests using the Content-Encoding: deflate header to crash the Serv-U service without authentication.
2026-06-05
NVD CVE
CVE-2026-11420: Two path traversal vulnerabilities in the Network Installation Service (NIS) of
CRITICAL
Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server...
2026-06-04
NVD CVE
CVE-2026-49185: The FieldX MDM adb messaging topic passes unverified payloads directly into Runt
CRITICAL
The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.
2026-06-04
NVD CVE
CVE-2026-49186: The local MQTT broker does not enforce topic-level Access Control Lists (ACLs).
CRITICAL
The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.
2026-06-04
NVD CVE
CVE-2026-10972: Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed
CRITICAL
Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
2026-06-04
NVD CVE
CVE-2026-49191: The production build of the M3WebServer hard-codes its backend API keys, which c
CRITICAL
The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.
2026-06-04
NVD CVE
CVE-2026-50208: High-risk TrustAllCerts routines disable standard TLS certificate validation. Co
CRITICAL
High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic.
2026-06-04
NVD CVE
CVE-2026-48040: The netty incubator codec.bhttp is a java language binary http parser. The libra
CRITICAL
The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for...
2026-06-04
NVD CVE
CVE-2026-50292: In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unesca
HIGH
In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitrary root code execution
2026-06-04
NVD CVE
CVE-2026-10931: Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a r
CRITICAL
Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
2026-06-04
NVD CVE
CVE-2026-11002: Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a rem
CRITICAL
Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium...
2026-06-04
NVD CVE
CVE-2026-10966: Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 a
CRITICAL
Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)
2026-06-04
NVD CVE
CVE-2026-10974: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 14
CRITICAL
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
2026-06-04
NVD CVE
CVE-2026-10990: Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote
CRITICAL
Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...
2026-06-04
NVD CVE
CVE-2026-10971: Insufficient validation of untrusted input in Printing in Google Chrome on Windo
CRITICAL
Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via...
2026-06-04
NVD CVE
CVE-2026-11120: Insufficient validation of untrusted input in Enterprise Reporting in Google Chr
CRITICAL
Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape...
2026-06-04
NVD CVE
CVE-2026-11029: Insufficient validation of untrusted input in Drag and Drop in Google Chrome on
CRITICAL
Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...
2026-06-04
NVD CVE
CVE-2026-11113: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 14
CRITICAL
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted...
2026-06-04
NVD CVE
CVE-2026-48567: Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized atta
CRITICAL
Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.
2026-06-04
NVD CVE
CVE-2026-49188: The ai_cmd utility executes with full root permissions. It pipes socket inputs d
CRITICAL
The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.
2026-06-04
NVD CVE
CVE-2026-50225: The registration path /v1/account/register provides no bot mitigation mechanisms
CRITICAL
The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.
2026-06-04
NVD CVE
CVE-2026-50211: Leftover engineering diagnostics and factory-level diagnostic software remain ex
CRITICAL
Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.
2026-06-04
NVD CVE
CVE-2026-50214: The /v1/Plan service relies entirely on a shared global API token for full admin
CRITICAL
The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.
2026-06-04
NVD CVE
CVE-2026-8037: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC
CRITICAL
◈ 2 sources · orig. NVD CVE
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input...
appliance-executioncisa-kevcommand-injectionprogress-loadmastersprogress-loadmasters-vulnerabilitiesunauthenticated-attacksunsanitized-inputs
2026-06-03
CISA KEV
Mirasvit Full Page Cache Warmer contains a deserialization of untrusted data vulnerability that could allow unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in...
2026-06-03
NVD CVE
CVE-2026-5241: A vulnerability in the LightGlue model loading path of huggingface/transformers
CRITICAL
A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises...
2026-06-02
NVD CVE
CVE-2026-42074: OpenClaude is an open-source coding-agent command line interface for cloud and l
CRITICAL
OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema,...
2026-06-02
CISA KEV
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
2026-06-02
CISA KEV
Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.
2026-06-02
NVD CVE
CVE-2026-10611: An authentication bypass vulnerability exists in MISP when LDAP mixed authentica
CRITICAL
An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users...
2026-06-02
NVD CVE
CVE-2026-35482: alf.io is an open source ticket reservation system for conferences, trade shows,
HIGH
alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, a sandbox escape vulnerability in the alf.io extension script engine allows an...
2026-06-01
CISA KEV
Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can...