Skip to content
COOEY
LIVE FEED
3595 events · 4 sources · newest first
Events in view
3595
all sources
Critical
1828
severity
Active sources
4
collectors
Last sync
2026-08-27 00:00
UTC
All data Vulns · 3595Regulatory · 144News · 426 LIVE · UPDATES ON COLLECT
All sources NVD CVE · 1777CISA KEV · 1683CISA advisory · 116DC3 DCISE · 19
Any severity Critical High ⊙ SUBSCRIBE (RSS)
2026-05-20 NVD CVE
CVE-2026-33278: NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability CRITICAL
NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure...
2026-05-20 CISA KEV
Microsoft Internet Explorer Use-After-Free Vulnerability HIGH
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be...
2026-05-20 CISA KEV
Microsoft DirectX NULL Byte Overwrite Vulnerability HIGH
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
2026-05-20 NVD CVE
CVE-2026-20223: A vulnerability in the access validation of internal REST APIs of Cisco Sec CRITICAL
A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin...
2026-05-19 NVD CVE
CVE-2026-47310: Use after free vulnerability in Samsung Open Source Escargot allows Pointer Mani HIGH
Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
2026-05-19 NVD CVE
CVE-2026-47311: Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows HIGH
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
2026-05-19 NVD CVE
CVE-2026-33642: Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the CRITICAL
Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic...
2026-05-19 NVD CVE
CVE-2026-47314: Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflo HIGH
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
2026-05-19 NVD CVE
CVE-2026-8711: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is config HIGH
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the...
2026-05-19 NVD CVE
CVE-2026-8602: In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnera CRITICAL
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
2026-05-19 NVD CVE
CVE-2026-8605: In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could al CRITICAL
In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
2026-05-19 NVD CVE
CVE-2026-8603: In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an a CRITICAL
In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.
2026-05-15 NVD CVE
CVE-2026-44774: Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, an CRITICAL
Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider...
2026-05-15 CISA KEV
Microsoft Exchange Server Cross-Site Scripting Vulnerability HIGH
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the...
2026-05-14 NVD CVE
CVE-2026-44484: PyTorch Lightning is a deep learning framework to pretrain and finetune AI model CRITICAL
PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.
2026-05-14 CISA KEV
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability HIGH
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
2026-05-13 NVD CVE
CVE-2026-42584: Netty is an asynchronous, event-driven network application framework. Prior to 4 HIGH
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response,...
2026-05-13 NVD CVE
CVE-2026-42581: Netty is an asynchronous, event-driven network application framework. Prior to 4 MEDIUM
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both...
2026-05-13 NVD CVE
CVE-2026-42579: Netty is an asynchronous, event-driven network application framework. Prior to 4 HIGH
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding....
2026-05-13 NVD CVE
CVE-2026-0264: A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo CRITICAL
A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all...
2026-05-13 NVD CVE
CVE-2026-0263: A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PA CRITICAL
A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or...
2026-05-13 NVD CVE
CVE-2026-42557: jupyterlab is an extensible environment for interactive and reproducible computi CRITICAL
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and...
2026-05-13 NVD CVE
CVE-2026-0258: A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation o CRITICAL
A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended...
2026-05-12 NVD CVE
CVE-2026-27851: When safe filter is used with variable expansion, all following pipelines on the HIGH
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks...
2026-05-11 NVD CVE
CVE-2026-43639: Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerabili HIGH
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST...
2026-05-11 NVD CVE
CVE-2026-8263: A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affect MEDIUM
A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the...
2026-05-10 NVD CVE
CVE-2026-7261: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, a CRITICAL
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via...
2026-05-10 NVD CVE
CVE-2026-6722: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, a CRITICAL
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without...
2026-05-10 NVD CVE
CVE-2025-14179: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, a CRITICAL
In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query...
2026-05-10 NVD CVE
CVE-2026-6104: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding nam CRITICAL
In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that...
2026-05-09 NVD CVE
CVE-2026-6665: The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strl HIGH
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM...
2026-05-09 NVD CVE
CVE-2026-42257: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionalit CRITICAL
Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the...
2026-05-09 NVD CVE
CVE-2026-42601: ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6 CRITICAL
ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without...
2026-05-08 NVD CVE
CVE-2026-42354: Sentry is an error tracking and performance monitoring tool. From version 21.12. CRITICAL
Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows...
2026-05-08 NVD CVE
CVE-2026-42556: Postiz is an AI social media scheduling tool. From version 2.21.6 to before vers HIGH
Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request...
2026-05-08 NVD CVE
CVE-2026-42298: Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Re CRITICAL
Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any...
2026-05-08 NVD CVE
CVE-2026-42264: Axios is a promise based HTTP client for the browser and Node.js. From version 1 HIGH
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP...
2026-05-08 NVD CVE
CVE-2026-42208: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo CRITICAL ◈ 2 sources · orig. NVD CVE
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key...
2026-05-08 CISA KEV
BerriAI LiteLLM SQL Injection Vulnerability HIGH ◈ 2 sources · orig. NVD CVE
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.
2026-05-07 CISA KEV
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability HIGH
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
◀ PREV PAGE 35 / 90 NEXT ▶