LIVE FEED
1574 events · 4 sources · newest first
Events in view
1574
all sources
Critical
0
severity
Active sources
4
collectors
Last sync
2026-08-26 00:01
UTC
2026-04-05
NVD CVE
CVE-2019-25692: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers
HIGH
Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id_to_modify' parameter. Attackers can send crafted requests with...
2026-04-05
NVD CVE
CVE-2019-25694: Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthent
HIGH
Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user2reset parameter. Attackers can send crafted...
2026-04-05
NVD CVE
CVE-2019-25696: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers
HIGH
Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the language_tag parameter. Attackers can submit malicious SQL statements...
2026-04-05
NVD CVE
CVE-2019-25698: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers
HIGH
Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_to_delete parameter. Attackers can send crafted requests with...
2026-04-05
NVD CVE
CVE-2019-25700: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers
HIGH
Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the sort_direction parameter. Attackers can submit malicious SQL...
2026-04-05
NVD CVE
CVE-2019-25704: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers
HIGH
Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the filter_user_mail parameter. Attackers can send crafted requests with...
2026-04-05
NVD CVE
CVE-2019-25702: Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers
HIGH
Kados R10 GreenBee contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the id_project parameter. Attackers can send crafted requests with...
2026-04-05
NVD CVE
CVE-2026-5562: A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts t
HIGH
A vulnerability was identified in provectus kafka-ui up to 0.7.2. This impacts the function validateAccess of the file /api/smartfilters/testexecutions of the component Endpoint. The manipulation leads to code...
2026-04-04
NVD CVE
CVE-2026-5526: A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/
HIGH
A security flaw has been discovered in Tenda 4G03 Pro up to 1.0/1.1/04.03.01.53/192.168.0.1. Affected by this vulnerability is an unknown functionality of the file /bin/httpd. The manipulation results in improper...
2026-04-04
NVD CVE
CVE-2026-34955: PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSand
HIGH
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, SubprocessSandbox in all modes (BASIC, STRICT, NETWORK_ISOLATED) calls subprocess.run() with shell=True and relies solely on string-pattern matching...
2026-04-03
NVD CVE
CVE-2026-25726: Cloudreve is a self-hosted file management and sharing system. Prior to version
HIGH
Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now().UnixNano() to generate critical...
2026-04-03
NVD CVE
CVE-2026-34937: PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() i
HIGH
PraisonAI is a multi-agent teams system. Prior to version 1.5.90, run_python() in praisonai constructs a shell command string by interpolating user-controlled code into python3 -c "<code>" and passing it to...
2026-04-03
NVD CVE
CVE-2026-5463: Command injection vulnerability in console.run_module_with_output() in pymetaspl
HIGH
Command injection vulnerability in console.run_module_with_output() in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended...
2026-04-03
NVD CVE
CVE-2026-35561: Insufficient authentication security controls in the browser-based authenticatio
HIGH
Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to intercept or hijack authentication sessions due...
2026-04-02
CISA KEV
TrueConf Client contains a download of code without integrity check vulnerability. An attacker who is able to influence the update delivery path can substitute a tampered update payload. If the payload is executed or...
2026-04-02
NVD CVE
CVE-2026-5368: A vulnerability was determined in projectworlds Car Rental Project 1.0. The affe
HIGH
A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php of the component Parameter Handler. This manipulation of the argument uname...
2026-04-01
CISA KEV
Google Dawn contains an use-after-free vulnerability that could allow a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. This vulnerability could affect...
2026-04-01
NVD CVE
CVE-2026-34430: ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vul
HIGH
ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host system by bypassing regex-based...
2026-03-31
NVD CVE
CVE-2026-24164: NVIDIA BioNeMo contains a vulnerability where a user could cause a deserializati
HIGH
NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information...
2026-03-31
NVD CVE
CVE-2026-34359: HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare i
HIGH
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, ManagedWebAccessUtils.getServer() uses String.startsWith() to match request URLs...
2026-03-31
NVD CVE
CVE-2026-24148: NVIDIA Jetson for JetPack contains a vulnerability in the system initialization
HIGH
NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of...
2026-03-31
NVD CVE
Impact:
The fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both...
2026-03-30
CISA KEV
Citrix NetScaler ADC (formerly Citrix ADC), NetScaler Gateway (formerly Citrix Gateway) and NetScaler ADC FIPS and NDcPP contain an out-of-bounds reads vulnerability when configured as a SAML IDP leading to memory overread.
2026-03-27
NVD CVE
CVE-2026-28369: A flaw was found in Undertow. When Undertow receives an HTTP request where the f
HIGH
A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior,...
2026-03-27
NVD CVE
CVE-2026-33896: Forge (also called `node-forge`) is a native implementation of Transport Layer S
HIGH
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements...
2026-03-27
NVD CVE
CVE-2026-33943: Happy DOM is a JavaScript implementation of a web browser without its graphical
HIGH
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code injection vulnerability in `ECMAScriptModuleCompiler` allows an attacker to...
2026-03-27
CISA KEV
F5 BIG-IP APM contains a stack-based buffer overflow vulnerability that could allow a threat actor to achieve remote code execution.
2026-03-26
CISA KEV
Aquasecurity Trivy contains an embedded malicious code vulnerability that could allow an attacker to gain access to everything in the CI/CD environment, including all tokens, SSH keys, cloud credentials, database...
2026-03-25
CISA KEV
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication.
2026-03-23
NVD CVE
CVE-2026-4601: Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Crypto
HIGH
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private...
2026-03-23
NVD CVE
CVE-2026-4600: Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verif
HIGH
Versions of the package jsrsasign before 11.1.1 are vulnerable to Improper Verification of Cryptographic Signature via the DSA domain-parameter validation in KJUR.crypto.DSA.setPublic (and the related DSA/X509...
2026-03-20
CISA KEV
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios.
2026-03-20
CISA KEV
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code.
2026-03-20
CISA KEV
Apple Safari, iOS, watchOS, visionOS, iPadOS, macOS, and tvOS contain a buffer overflow vulnerability that could allow the processing of maliciously crafted web content which may lead to memory corruption.
2026-03-20
CISA KEV
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain a classic buffer overflow vulnerability which could allow a malicious application to cause unexpected system termination or write kernel memory.
2026-03-20
CISA KEV
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes.
2026-03-19
NVD CVE
CVE-2025-71257: BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentica
HIGH
BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability due to improper enforcement of security filters on restricted REST API endpoints and servlets. Unauthenticated...
2026-03-18
CISA KEV
Synacor Zimbra Collaboration Suite (ZCS) contains a cross-site scripting vulnerability in the Classic UI where attackers could abuse Cascading Style Sheets (CSS) @import directives in email HTML.
2026-03-18
NVD CVE
CVE-2026-28500: Open Neural Network Exchange (ONNX) is an open standard for machine learning int
HIGH
Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the...
2026-03-18
CISA KEV
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.