Live feed · cooey

2026-07-17 NVD CVE

CVE-2026-8297: Improper neutralization of special elements used in an SQL command ('SQL injecti CRITICAL

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting Laboratory R&D and Software Services Inc. GisLab Laboratory Management...

applications-securitycode-injectioncve-2026-8297data-breaches-risksdatabase-securitygi-laboratory-management-systemsgis-informatics-engineering-consulting-laboratoryimproper-neutralization

2026-07-17 NVD CVE

CVE-2026-12694: Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform a CRITICAL

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

access-controlaclcve-2026-12694enterprise-video-platformmissing-authorizationnvd-cvesecurityvimesoft

2026-07-17 NVD CVE

CVE-2026-12693: Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. CRITICAL

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video...

access-control-listaclauthorization-bypasscve-2026-12693enterprise-video-platformnvd-cvesecurity-bugsoftware-vulnerabilities

2026-07-17 NVD CVE

CVE-2026-9198: IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain CRITICAL ◈ 2 sources · orig. NVD CVE

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve...

api-vulnerabilitiescode-executioncve-2026-9198default-deploymentibmlangflownvd-cveopen-source

2026-07-17 NVD CVE

CVE-2026-12692: Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platf CRITICAL

Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0.

authentication-bypasscve-2026-12692enterprise-video-platformnvd-cvepassword-changeunverified-password-changevimesoftvulnerability

2026-07-17 NVD CVE

CVE-2026-62241: clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT CRITICAL

clawvet self-hosted API server (apps/api) before 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as the default in .env.example. Because GET /api/v1/scans returns scan...

apiattackauthenticationclawvetcve-2026-62241datum-exfiltrationhard-codedjwt

2026-07-17 NVD CVE

CVE-2026-14956: The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in al CRITICAL

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration...

administrator-accountbricksforgecve-2026-14956nvd-cveplugins-vulnerabilitiesprivileges-escalationsecurity-bulletinunauthenticated-attacks

2026-07-17 NVD CVE

CVE-2026-46420: setup-php is a GitHub action to set up PHP with extensions, php.ini configuratio MEDIUM

setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled...

2026-07-17 NVD CVE

CVE-2026-13473: IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 throu HIGH

IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attacker...

2026-07-16 NVD CVE

CVE-2026-44181: Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr CRITICAL

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions 2.0.0rc2 and above, prior to 3.3.0, the environment...

2026-07-16 NVD CVE

CVE-2026-44182: Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distr CRITICAL

Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted...

2026-07-16 NVD CVE

CVE-2026-54526: Argo Workflows is an open source container-native workflow engine for orchestrat CRITICAL

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 is incomplete because...

2026-07-16 NVD CVE

CVE-2026-45568: zrok is software for sharing web services, files, and network resources. Prior t CRITICAL

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to...

cve-2026-45568cybersecurityflaskincident-responseinformation-disclosurenetwork-resourcesnvd-cveproxy

2026-07-16 NVD CVE

CVE-2026-56453: HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vu MEDIUM

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client...

accounts-takeoverauthentication-bypassauthorization-bypasscve-2026-56453hcl-dfxanalytichttps-responses-manipulationnvd-cveremote-attackers

2026-07-16 NVD CVE

CVE-2026-44596: Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoi MEDIUM

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting,...

account-lockoutauthenticationbrute-forcecve-2026-44596failed-attempts-throttlingframeworkmission-controlnvd-cve

2026-07-16 NVD CVE

CVE-2026-63089: WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographic CRITICAL

WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer...

brute-forcecredentials-theftcryptographic-weaknessescve-2026-63089impersonationnvd-cveone-time-linkpreshared-key

2026-07-16 NVD CVE

CVE-2026-63087: Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability CRITICAL

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using...

admins-usersapi-endpointapi-tokencve-2026-63087grafanagrafana-urlnvd-cveoncall

2026-07-16 NVD CVE

CVE-2023-49900: An unauthenticated remote attacker is able to perform remote code execution due CRITICAL

An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.

cve-2023-49900exploitincorrectly-sanitize-inputsnvd-cveremote-attackersremote-code-executionsecurity-bulletinsetparameter-command

2026-07-16 NVD CVE

CVE-2023-49899: An unauthenticated remote attacker can execute any command on the affected devic CRITICAL

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.

command-executioncommunications-channelscve-2023-49899nvd-cveorigin-verificationremote-attackerssecurityunauthenticate

2026-07-16 NVD CVE

CVE-2026-15013: The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authen CRITICAL

The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass via SAML Signature Algorithm Confusion in all versions up to, and including, 5.4.3. The vulnerability exists because...

authentication-bypasscve-2026-15013nvd-cvesamlsaml-signatures-algorithms-confusionsingle-signssowordpress

2026-07-15 NVD CVE

CVE-2026-50148: Metabase is an open-source business intelligence and embedded analytics tool. Fr CRITICAL

Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19, 1.58.14, 1.59.10, and 1.60.4, a Metabase user with permission to add or edit a...

2026-07-15 NVD CVE

CVE-2026-20156: As part of Cisco's ongoing commitment to proactive security and product quality, HIGH

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening...

2026-07-15 NVD CVE

CVE-2026-53512: Better Auth is an authentication and authorization library for TypeScript. Prior CRITICAL

Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, the legacy oidcProvider and mcp plugins expose OAuth token endpoints whose refresh_token grant authenticates only possession...

accesses-tokenauthenticationauthorizationbetters-authsclient-idclients-secretscve-2026-53512mcp-plugins

2026-07-15 NVD CVE

CVE-2026-54052: n8n-MCP is an MCP server that provides AI assistants access to n8n node document CRITICAL

n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-tenancy enabled through ENABLE_MULTI_TENANT=true, n8n-mcp's...

ai-assistantauthorization-headercredentials-exposurecve-2026-54052data-breacheshttps-modemcp-servermulti-tenancy

2026-07-15 NVD CVE

CVE-2026-56400: open-webui before 0.3.14 contains a cross-origin resource sharing misconfigurati HIGH

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute...

admins-usersapi-endpointarbitrary-code-executionattackers-controlled-websitesauthenticate-requestscross-origin-resources-sharingcross-site-requestcve-2026-56400

2026-07-15 NVD CVE

CVE-2026-56398: Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in HIGH

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header,...

accounts-takeoverauthentication-token-theftcontent-typescross-site-scriptingcve-2026-56398datum-urifile-extensioninline-disposition

2026-07-15 NVD CVE

CVE-2026-20157: As part of Cisco's ongoing commitment to proactive security and product quality, HIGH

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening...

2026-07-14 NVD CVE

CVE-2026-58644: Deserialization of untrusted data in Microsoft Office SharePoint allows an unaut CRITICAL ◈ 2 sources · orig. NVD CVE

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

attack-vectorscode-executioncve-2026-58644datum-exfiltrationdeserializationexploitmicrosoftmicrosoft-office

2026-07-14 NVD CVE

CVE-2026-55008: Improper neutralization of input during web page generation ('cross-site scripti CRITICAL

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

attackercross-site-scriptingcve-2026-55008exchange-serverinputs-neutralizationmicrosoftnetwork-securitynvd-cve

2026-07-14 NVD CVE

CVE-2026-54990: Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attac CRITICAL

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

buffer-overflowcode-executioncve-2026-54990exploitheap-based-buffer-overflownetworks-attacksnetworks-vulnerabilitiesnvd-cve

2026-07-14 NVD CVE

CVE-2026-50522: Deserialization of untrusted data in Microsoft Office SharePoint allows an unaut CRITICAL ◈ 2 sources · orig. NVD CVE

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

code-executioncve-2026-50522deserializationmicrosoftmicrosoft-officenetwork-securitynvd-cvesharepoint

2026-07-14 NVD CVE

CVE-2026-49798: Use after free in Windows Kernel allows an unauthorized attacker to elevate priv CRITICAL

Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.

cve-2026-49798freekernel-exploitlocal-attacknvd-cveprivileges-escalationsecurity-bulletinunauthorized-access

2026-07-14 NVD CVE

CVE-2026-49172: Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacke CRITICAL

Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network.

buffer-overflowcode-executioncve-2026-49172exploitftpheap-based-buffer-overflownetworks-attacksnvd-cve

2026-07-14 NVD CVE

CVE-2026-48561: Improper neutralization of special elements used in a command ('command injectio CRITICAL

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network.

ai-vulnerabilitycode-executioncommand-injectioncopilotcve-2026-48561microsoftnetwork-securityneutralization

2026-07-14 NVD CVE

CVE-2026-62644: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin o MEDIUM

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

2026-07-14 NVD CVE

CVE-2026-59836: A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 HIGH

A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow attacker to information disclosure via...

certificate-validationcve-2026-59836endpoint-securityforticlientemfortinetimproper-certificate-validationinformation-disclosurenetwork-security

2026-07-14 NVD CVE

CVE-2026-24227: NVIDIA TensorRT for contains a vulnerability where a user might cause a deserial MEDIUM

NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution.

code-executioncve-2026-24227deserializationexploitnvd-cvenvidiasecuritytensorrt

2026-07-14 NVD CVE

CVE-2026-42990: Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized atta CRITICAL

Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network.

buffer-overflowcode-executioncve-2026-42990heap-based-buffer-overflowmicrosoftnetworks-attacksnvd-cveodbc-driver

2026-07-14 NVD CVE

CVE-2026-15701: A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affect CRITICAL

A weakness has been identified in Totolink NR1800X 9.1.0u.6279_B20210910. Affected by this issue is the function Form_Logout of the file /formLogout.htm of the component lighttpd. This manipulation of the argument...

buffer-overflowcooeys-clubcve-2026-15701form-logoutformlogouthtmlighttpdnetworks-devicesnvd-cve

2026-07-14 NVD CVE

CVE-2026-62392: Improper Neutralization of Special Elements used in an OS Command ('OS Command I CRITICAL

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may bring job config parameters to OS command line. This issue affects Apache...

apache-softwaresapaches-kylinapi-vulnerabilitiescommand-injectioncve-2026-62392cybersecuritydata-breaches-preventionincident-response