LIVE FEED
3595 events · 4 sources · newest first
Events in view
3595
all sources
Critical
1828
severity
Active sources
4
collectors
Last sync
2026-08-27 00:00
UTC
2026-04-14
NVD CVE
CVE-2026-35589: nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site
HIGH
nanobot is a personal AI assistant. Versions prior to 0.1.5 contain a Cross-Site WebSocket Hijacking (CSWSH) vulnerability exists in the bridge's WebSocket server in bridge/src/server.ts, resulting from an incomplete...
2026-04-14
NVD CVE
CVE-2026-35033: Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 c
CRITICAL
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument injection through the StreamOptions query parameter...
2026-04-14
NVD CVE
CVE-2026-39907: Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose
CRITICAL
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file paths in the ReadLicense action's LFName parameter,...
2026-04-14
NVD CVE
CVE-2026-34615: Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserializati
CRITICAL
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could...
2026-04-14
NVD CVE
CVE-2026-39906: Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose
CRITICAL
Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose a deprecated .NET Remoting TCP channel that allows remote unauthenticated attackers to leak NTLMv2 machine-account hashes by supplying a...
2026-04-14
NVD CVE
CVE-2026-2332: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when ch
HIGH
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:
* https://w4ke.info/2025/06/18/funky-chunks.html
...
2026-04-14
CISA KEV
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a...
2026-04-14
CISA KEV
Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.
2026-04-13
NVD CVE
CVE-2025-31991: Rate Limiting for attempting a user login is not being properly enforced, making
MEDIUM
Rate Limiting for attempting a user login is not being properly enforced, making HCL DevOps Velocity susceptible to brute-force attacks past the unsuccessful login attempt limit. This vulnerability is fixed in 5.1.7.
2026-04-13
NVD CVE
CVE-2026-0234: An improper verification of cryptographic signature vulnerability exists in Cort
CRITICAL
An improper verification of cryptographic signature vulnerability exists in Cortex XSOAR and Cortex XSIAM platforms during integration of Microsoft Teams that enables an unauthenticated user to access and modify...
2026-04-13
NVD CVE
CVE-2026-5936: An attacker can control a server-side HTTP request by supplying a crafted URL, c
HIGH
An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinations. This behavior may be exploited to probe internal network services,...
2026-04-13
CISA KEV
Microsoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.
2026-04-13
CISA KEV
Adobe Acrobat and Reader contain a prototype pollution vulnerability that allows for arbitrary code execution.
2026-04-13
CISA KEV
Microsoft Windows contains a link following vulnerability that allows for privilege escalation
2026-04-13
CISA KEV
Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
2026-04-13
CISA KEV
Adobe Acrobat contains a use-after-free vulnerability that allows for code execution
2026-04-13
CISA KEV
Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalation
2026-04-13
CISA KEV
Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.
2026-04-12
NVD CVE
CVE-2026-40393: In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occu
HIGH
In Mesa before 25.3.6 and 26 before 26.0.1, out-of-bounds memory access can occur in WebGPU because the amount of to-be-allocated data depends on an untrusted party, and is then used for alloca.
2026-04-10
NVD CVE
CVE-2026-40190: LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform.
MEDIUM
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix in its internally...
2026-04-10
NVD CVE
CVE-2026-5483: A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in
HIGH
A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for the disclosure of Kubernetes Service Account tokens through a...
2026-04-09
NVD CVE
CVE-2026-34184: AlanWeb SCADA does not enforce authorization for some directories. This allows a
CRITICAL
AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP...
2026-04-09
NVD CVE
CVE-2025-62718: Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.
CRITICAL
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like...
2026-04-08
NVD CVE
CVE-2026-33088: Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability
CRITICAL
Movable Type provided by Six Apart Ltd. contains an SQL Injection vulnerability which may allow an attacker to execute an arbitrary SQL statement.
2026-04-08
NVD CVE
CVE-2026-5300: Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows una
MEDIUM
Unauthenticated functionality in CoolerControl/coolercontrold <4.0.0 allows unauthenticated attackers to view and modify potentially sensitive data via HTTP requests
2026-04-08
NVD CVE
CVE-2026-35477: InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, th
MEDIUM
InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT validator to use jinja2.sandbox.SandboxedEnvironment. However, the actual...
2026-04-08
NVD CVE
CVE-2026-39394: CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, mo
HIGH
CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to 0.31.4.0, the Install::index() controller reads the host POST...
2026-04-08
NVD CVE
CVE-2025-52221: Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm f
CRITICAL
Tenda AC6 15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetCfm function via the funcname, funcpara1, and funcpara2 parameters.
2026-04-08
NVD CVE
CVE-2026-27143: Arithmetic over induction variables in loops were not correctly checked for unde
CRITICAL
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
2026-04-08
NVD CVE
CVE-2026-39892: cryptography is a package designed to expose cryptographic primitives and recipe
CRITICAL
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g....
2026-04-08
NVD CVE
CVE-2026-31017: A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format fu
CRITICAL
A Server-Side Request Forgery (SSRF) vulnerability exists in the Print Format functionality of ERPNext v16.0.1 and Frappe Framework v16.1.1, where user-supplied HTML is insufficiently sanitized before being rendered...
2026-04-08
CISA KEV
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.
2026-04-08
NVD CVE
CVE-2026-33466: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash
HIGH
Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in Logstash can lead to arbitrary file write and potentially remote code execution via Relative Path Traversal (CAPEC-139). The archive extraction...
2026-04-08
NVD CVE
CVE-2026-39429: kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kub
HIGH
kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server is directly exposed by the root shard and has no...
2026-04-08
NVD CVE
CVE-2026-39888: PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in pra
CRITICAL
PraisonAI is a multi-agent teams system. Prior to 1.5.115, execute_code() in praisonaiagents.tools.python_tools defaults to sandbox_mode="sandbox", which runs user code in a subprocess wrapped with a restricted...
2026-04-07
NVD CVE
CVE-2026-39397: @delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual
CRITICAL
@delmaredigital/payload-puck is a PayloadCMS plugin for integrating Puck visual page builder. Prior to 0.6.23, all /api/puck/* CRUD endpoint handlers registered by createPuckPlugin() called Payload's local API with...
2026-04-07
NVD CVE
CVE-2026-33439: Open Access Management (OpenAM) is an access management solution. Prior to 16.0.
CRITICAL
Open Access Management (OpenAM) is an access management solution. Prior to 16.0.6, OpenIdentityPlatform OpenAM is vulnerable to pre-authentication Remote Code Execution (RCE) via unsafe Java deserialization of the...
2026-04-07
NVD CVE
CVE-2026-34078: Flatpak is a Linux application sandboxing and distribution framework. Prior to 1
CRITICAL
Flatpak is a Linux application sandboxing and distribution framework. Prior to 1.16.4, the Flatpak portal accepts paths in the sandbox-expose options which can be app-controlled symlinks pointing at arbitrary paths....
2026-04-07
NVD CVE
CVE-2026-34582: Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implem
CRITICAL
Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received. A server which is attempting to...
2026-04-07
NVD CVE
CVE-2026-5735: Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of t
CRITICAL
Memory safety bugs present in Firefox 149.0.1 and Thunderbird 149.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run...