LIVE FEED
1574 events · 4 sources · newest first
Events in view
1574
all sources
Critical
0
severity
Active sources
4
collectors
Last sync
2026-08-26 00:01
UTC
2026-05-26
CISA KEV
LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
2026-05-26
NVD CVE
CVE-2026-24212: NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive infor
HIGH
NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text. A successful exploit of this vulnerability might lead to code execution, escalation of privileges,...
2026-05-22
CISA KEV
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
2026-05-21
CISA KEV
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform...
2026-05-21
CISA KEV
Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on...
2026-05-21
NVD CVE
CVE-2026-4858: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.
HIGH
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API...
2026-05-20
CISA KEV
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be...
2026-05-20
CISA KEV
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
2026-05-20
NVD CVE
CVE-2026-24425: Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerabi
HIGH
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to...
2026-05-20
CISA KEV
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
2026-05-20
NVD CVE
CVE-2026-24206: NVIDIA Triton Inference Server contains a vulnerability where an attacker could
HIGH
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or...
2026-05-20
NVD CVE
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation.
This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1.
BIND 9 versions...
2026-05-20
CISA KEV
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
2026-05-20
NVD CVE
CVE-2025-33255: NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an
HIGH
NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of...
2026-05-20
NVD CVE
CVE-2026-24163: NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where a
HIGH
NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of...
2026-05-20
NVD CVE
CVE-2026-24213: NVIDIA Triton Inference Server contains a vulnerability in the DALI backend wher
HIGH
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, data...
2026-05-20
NVD CVE
CVE-2026-24214: NVIDIA Triton Inference Server contains a vulnerability in the DALI backend wher
HIGH
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering,...
2026-05-20
CISA KEV
Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
2026-05-20
CISA KEV
Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
2026-05-20
CISA KEV
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The...
2026-05-19
NVD CVE
CVE-2026-47314: Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflo
HIGH
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
2026-05-19
NVD CVE
CVE-2026-47311: Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows
HIGH
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
2026-05-19
NVD CVE
CVE-2026-47310: Use after free vulnerability in Samsung Open Source Escargot allows Pointer Mani
HIGH
Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
2026-05-19
NVD CVE
CVE-2026-8711: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is config
HIGH
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the...
2026-05-15
CISA KEV
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the...
2026-05-14
CISA KEV
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
2026-05-13
NVD CVE
CVE-2026-42584: Netty is an asynchronous, event-driven network application framework. Prior to 4
HIGH
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response,...
2026-05-13
NVD CVE
CVE-2026-42579: Netty is an asynchronous, event-driven network application framework. Prior to 4
HIGH
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding....
2026-05-12
NVD CVE
CVE-2026-27851: When safe filter is used with variable expansion, all following pipelines on the
HIGH
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks...
2026-05-11
NVD CVE
CVE-2026-43639: Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerabili
HIGH
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST...
2026-05-09
NVD CVE
CVE-2026-6665: The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strl
HIGH
The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM...
2026-05-08
CISA KEV
BerriAI LiteLLM contains a SQL injection vulnerability that allows an attacker to read data from the proxy's database and potentially modify it, leading to unauthorized access to the proxy and the credentials it manages.
2026-05-08
NVD CVE
CVE-2026-42264: Axios is a promise based HTTP client for the browser and Node.js. From version 1
HIGH
Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP...
2026-05-08
NVD CVE
CVE-2026-42556: Postiz is an AI social media scheduling tool. From version 2.21.6 to before vers
HIGH
Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request...
2026-05-07
NVD CVE
CVE-2026-42010: A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adlem
HIGH
A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit...
2026-05-07
CISA KEV
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
2026-05-06
CISA KEV
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root...
2026-05-01
CISA KEV
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
2026-04-30
NVD CVE
CVE-2026-33845: A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero len
HIGH
A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is...
2026-04-28
CISA KEV
Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.