Skip to content
COOEY
LIVE FEED
1777 events · 4 sources · newest first
Events in view
1777
all sources
Critical
1499
severity
Active sources
4
collectors
Last sync
2026-08-27 00:00
UTC
All data Vulns · 3595Regulatory · 144News · 426 LIVE · UPDATES ON COLLECT
All sources NVD CVE · 1777CISA KEV · 1683CISA advisory · 116DC3 DCISE · 19
Any severity Critical High ⊙ SUBSCRIBE (RSS)
2026-02-11 NVD CVE
CVE-2026-20677: A race condition was addressed with improved handling of symbolic links. This is CRITICAL
A race condition was addressed with improved handling of symbolic links. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3,...
2026-02-07 NVD CVE
CVE-2026-25560: WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in L CRITICAL
WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP search filters and DN-related values without adequate...
2026-02-06 NVD CVE
CVE-2026-1709: A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does n CRITICAL
A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated...
2026-01-27 NVD CVE
CVE-2026-24881: In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an HIGH
In GnuPG before 2.5.17, a crafted CMS (S/MIME) EnvelopedData message carrying an oversized wrapped session key can cause a stack-based buffer overflow in gpg-agent during PKDECRYPT--kem=CMS handling. This can easily...
2026-01-23 NVD CVE
CVE-2026-24423: SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated CRITICAL ◈ 2 sources · orig. NVD CVE
SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP...
2026-01-23 NVD CVE
CVE-2026-24304: Improper access control in Azure Resource Manager allows an authorized attacker CRITICAL
Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.
2026-01-22 NVD CVE
CVE-2026-23760: SmarterTools SmarterMail versions prior to build 9511 contain an authentication CRITICAL ◈ 2 sources · orig. NVD CVE
SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the...
2026-01-21 NVD CVE
CVE-2026-22807: vLLM is an inference and serving engine for large language models (LLMs). Starti HIGH
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without...
2026-01-20 NVD CVE
CVE-2025-55130: A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-rea CRITICAL
A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted...
2026-01-20 NVD CVE
CVE-2026-23876: ImageMagick is free and open-source software used for editing and manipulating d HIGH
ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage)...
2026-01-19 NVD CVE
CVE-2026-23530: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE...
2026-01-19 NVD CVE
CVE-2026-23532: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between...
2026-01-19 NVD CVE
CVE-2026-23534: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past...
2026-01-19 NVD CVE
CVE-2026-23883: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering...
2026-01-19 NVD CVE
CVE-2026-23884: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A...
2026-01-19 NVD CVE
CVE-2026-23533: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes...
2026-01-19 NVD CVE
CVE-2026-23531: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the...
2026-01-14 NVD CVE
CVE-2026-22853: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1 CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated...
2026-01-14 NVD CVE
CVE-2026-22858: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1 CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char...
2026-01-14 NVD CVE
CVE-2026-22859: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1 CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in...
2026-01-14 NVD CVE
CVE-2026-22855: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1 CRITICAL
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This...
2026-01-12 NVD CVE
CVE-2026-22213: RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buf CRITICAL
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen()...
2026-01-12 NVD CVE
CVE-2026-22214: RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buf CRITICAL
RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The...
2026-01-09 NVD CVE
CVE-2025-13761: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 HIGH
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an ...
2026-01-07 NVD CVE
CVE-2026-22189: The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains CRITICAL
The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker-controlled input. When constructing...
2026-01-07 NVD CVE
CVE-2025-69264: pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted depend HIGH
pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution...
2026-01-07 NVD CVE
CVE-2025-12543: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBo CRITICAL
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a...
2026-01-04 NVD CVE
CVE-2025-3654: Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information MEDIUM
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware information by exploiting insecure API endpoints. Attackers...
2026-01-04 NVD CVE
CVE-2025-3653: Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper ac HIGH
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access control vulnerability that allows unauthorized device manipulation by accepting arbitrary serial numbers without ownership...
2026-01-04 NVD CVE
CVE-2025-15115: Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authenticat MEDIUM
Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any user account by exploiting OAuth token validation flaws in...
2025-12-31 NVD CVE
CVE-2025-34468: libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a s CRITICAL
libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer...
2025-12-22 NVD CVE
CVE-2025-67288: An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers t CRITICAL
An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file...
2025-12-19 NVD CVE
CVE-2025-14733: An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process CRITICAL ◈ 2 sources · orig. NVD CVE
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2...
2025-12-10 NVD CVE
CVE-2025-14087: A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacke MEDIUM
A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser...
2025-11-06 NVD CVE
CVE-2022-50589: SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within t CRITICAL
SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers...
2025-10-17 NVD CVE
CVE-2025-34282: ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulner CRITICAL
ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If...
2025-10-14 NVD CVE
CVE-2025-34267: Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled c CRITICAL
Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules...
2025-09-24 NVD CVE
CVE-2025-10585: Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote a CRITICAL ◈ 2 sources · orig. NVD CVE
Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
2025-09-18 NVD CVE
CVE-2025-10035: A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MF CRITICAL ◈ 2 sources · orig. NVD CVE
A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading...
2025-09-17 NVD CVE
CVE-2025-9242: An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process CRITICAL ◈ 2 sources · orig. NVD CVE
An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2...
◀ PREV PAGE 35 / 45 NEXT ▶