LIVE FEED
3595 events · 4 sources · newest first
Events in view
3595
all sources
Critical
1828
severity
Active sources
4
collectors
Last sync
2026-08-27 00:00
UTC
2026-05-07
NVD CVE
CVE-2026-42010: A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adlem
HIGH
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit...
2026-05-07
NVD CVE
CVE-2026-41586: Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framew
CRITICAL
Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes...
2026-05-07
NVD CVE
CVE-2026-7891: A vulnerability has been identified in Mendix Runtime (All versions). Mendix doc
CRITICAL
A vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers without...
2026-05-07
NVD CVE
CVE-2026-42216: OpenEXR provides the specification and reference implementation of the EXR file
CRITICAL
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0...
2026-05-06
CISA KEV
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root...
2026-05-05
NVD CVE
CVE-2026-34084: PhpSpreadsheet is a library for reading and writing spreadsheet files. In versio
CRITICAL
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.2 and earlier, 2.0.0 through 2.1.14, 2.2.0 through 2.4.3, 3.3.0 through 3.10.3, and 4.0.0 through 5.5.0, when the filename...
2026-05-05
NVD CVE
CVE-2026-35579: CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QU
CRITICAL
CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the...
2026-05-04
NVD CVE
CVE-2026-26332: vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, Suppresse
CRITICAL
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0.
2026-05-01
CISA KEV
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
2026-04-30
CISA KEV
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the...
2026-04-30
NVD CVE
CVE-2026-33845: A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero len
HIGH
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is...
2026-04-30
NVD CVE
CVE-2026-39858: Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3
CRITICAL
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's ForwardAuth and snippet-based...
2026-04-30
NVD CVE
CVE-2026-35051: Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3
CRITICAL
Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is an authentication bypass vulnerability in Traefik's ForwardAuth middleware when trustForwardHeader=false...
2026-04-28
NVD CVE
CVE-2026-40974: Spring Boot's Cassandra auto-configuration does not perform hostname verificatio
MEDIUM
Spring Boot's Cassandra auto-configuration does not perform hostname verification when establishing an SSL connection to Cassandra.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14),...
2026-04-28
CISA KEV
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
2026-04-28
CISA KEV
Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
2026-04-27
NVD CVE
CVE-2026-40971: When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration
MEDIUM
When configured to use an SSL bundle, Spring Boot's RabbitMQ auto-configuration does not perform hostname verification when connecting to the RabbitMQ broker.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6),...
2026-04-24
CISA KEV
Samsung MagicINFO 9 Server contains a path traversal vulnerability that could allow an attacker to write arbitrary files as system authority.
2026-04-24
CISA KEV
D-Link DIR-823X contains a command injection vulnerability that allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiting via the corresponding...
2026-04-24
CISA KEV
SimpleHelp contains a path traversal vulnerability that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute...
2026-04-24
CISA KEV
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role.
2026-04-24
NVD CVE
CVE-2026-42044: Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to
MEDIUM
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the...
2026-04-24
NVD CVE
CVE-2026-42043: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.
HIGH
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than...
2026-04-24
NVD CVE
CVE-2026-41473: CyberPanel versions prior to 2.4.4 contain an authentication bypass vulnerabilit
CRITICAL
CyberPanel versions prior to 2.4.4 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending...
2026-04-23
NVD CVE
CVE-2026-25874: LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the as
CRITICAL
LeRobot through 0.5.1 contains an unsafe deserialization vulnerability in the async inference pipeline where pickle.loads() is used to deserialize data received over unauthenticated gRPC channels without TLS in the...
2026-04-23
CISA KEV
Marimo contains an pre-authorization remote code execution vulnerability, allowing an unauthenticated attacked to shell access and execute arbitrary system commands.
2026-04-23
NVD CVE
CVE-2026-41176: Rclone is a command-line program to sync files and directories to and from diffe
CRITICAL
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. The RC endpoint `options/set` is exposed without `AuthRequired: true`, but it can mutate global runtime...
2026-04-23
NVD CVE
CVE-2026-41179: Rclone is a command-line program to sync files and directories to and from diffe
CRITICAL
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Starting in version 1.48.0 and prior to version 1.73.5, the RC endpoint `operations/fsinfo` is exposed...
2026-04-22
CISA KEV
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
2026-04-20
CISA KEV
Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
2026-04-20
CISA KEV
Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by...
2026-04-20
CISA KEV
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials.
2026-04-20
CISA KEV
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability that could allow attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access...
2026-04-20
CISA KEV
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed.
2026-04-20
CISA KEV
PaperCut NG/MF contains an improper authentication vulnerability that could allow remote attackers to bypass authentication on affected installations via the SecurityRequestFilter class.
2026-04-20
CISA KEV
Kentico Xperience contains a path traversal vulnerability that could allow an authenticated user's Staging Sync Server to upload arbitrary data to path relative locations.
2026-04-20
CISA KEV
Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA...
2026-04-18
NVD CVE
CVE-2026-41242: protobufjs compiles protobuf definitions into JavaScript (JS) functions. In vers
CRITICAL
protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute...
2026-04-17
NVD CVE
CVE-2026-40518: ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary
HIGH
ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation where the agent name validation is bypassed. Attackers can supply...
2026-04-16
CISA KEV
Apache ActiveMQ contains an improper input validation vulnerability that allows for code injection.