Live feed · cooey

2026-07-07 NVD CVE

CVE-2026-59705: mem0's openmemory/api component contains an unauthenticated access vulnerability CRITICAL

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without...

apiarbitrary-accessescve-2026-59705cybersecuritydata-breachesdata-exposuredenialincident-response

2026-07-07 NVD CVE

CVE-2026-59706: mem0 contains unauthenticated config API endpoints that expose LLM API keys in p CRITICAL

mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve...

api-keycloud-imdsconfiguration-managementcve-2026-59706cybersecuritydata-exposuredefense-industrial-basenist-800-171

2026-07-07 NVD CVE

CVE-2026-58473: Cognee before 1.2.0 contains an improper access control vulnerability that allow CRITICAL

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings...

cogneeconfiguration-overwritecve-2026-58473data-breachesdatum-exfiltrationendpoint-securityimproper-access-controlinstance-wide-impact

2026-07-07 NVD CVE

CVE-2026-14345: The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell CRITICAL

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter...

cve-2026-14345cybersecurityinclude-oncelog-filenvd-cvephppluginremote-code-execution

2026-07-06 NVD CVE

CVE-2026-54763: Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, CRITICAL

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing...

2026-07-06 NVD CVE

CVE-2026-40141: A high-severity vulnerability exists in a web application component of BeyondTru CRITICAL

A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of...

2026-07-06 NVD CVE

CVE-2026-40139: A critical pre-authentication vulnerability exists in the authentication subsyst CRITICAL

A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass...

2026-07-03 NVD CVE

CVE-2026-47898: Improper Restriction of XML External Entity Reference vulnerability in Apache Lu CRITICAL

Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before...

2026-07-03 NVD CVE

CVE-2026-12481: A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code exe CRITICAL

A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()`...

2026-07-02 NVD CVE

CVE-2026-55116: A malicious actor with access to the network and under certain network configura CRITICAL

A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to...

2026-07-02 NVD CVE

CVE-2026-55115: A malicious actor with access to the network and low privileges could exploit a CRITICAL

A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.

2026-07-02 NVD CVE

CVE-2026-41106: Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un CRITICAL

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

2026-07-01 NVD CVE

CVE-2026-58025: Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWik CRITICAL

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php,...

2026-07-01 NVD CVE

CVE-2026-14363: Improper neutralization of special elements used in an SQL command ('SQL injecti CRITICAL

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo...

2026-07-01 NVD CVE

CVE-2026-53492: containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2. CRITICAL

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint...

2026-07-01 NVD CVE

CVE-2026-50195: containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 a CRITICAL

containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a...

2026-07-01 NVD CVE

CVE-2026-58521: Improper neutralization of special elements used in an SQL command ('SQL injecti CRITICAL

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo...

2026-07-01 NVD CVE

CVE-2026-58453: JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a h CRITICAL

JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default admin...

2026-07-01 NVD CVE

CVE-2026-34106: Guardian language-system passes the id GET parameter directly into a PHP exec() CRITICAL

Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\"...

2026-07-01 NVD CVE

CVE-2026-34100: Guardian language-system passes the id GET parameter directly into an unsanitize CRITICAL

Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id =...

2026-06-30 NVD CVE

CVE-2026-14120: Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 CRITICAL

Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page....

2026-06-30 NVD CVE

CVE-2026-14109: Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 CRITICAL

Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page....

2026-06-30 NVD CVE

CVE-2026-14106: Insufficient validation of untrusted input in Text in Google Chrome on Android p CRITICAL

Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a...

2026-06-30 NVD CVE

CVE-2026-14104: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome pr CRITICAL

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security...

2026-06-30 NVD CVE

CVE-2026-14101: Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150. CRITICAL

Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML...

2026-06-30 NVD CVE

CVE-2026-13785: Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allow CRITICAL

Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML...

2026-06-30 NVD CVE

CVE-2026-13782: Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remo CRITICAL

Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...

2026-06-30 NVD CVE

CVE-2026-13781: Insufficient validation of untrusted input in Skia in Google Chrome prior to 150 CRITICAL

Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML...

2026-06-30 NVD CVE

CVE-2026-13780: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 15 CRITICAL

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted...

2026-06-30 NVD CVE

CVE-2026-13776: Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote CRITICAL

Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...

2026-06-30 NVD CVE

CVE-2026-13775: Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote a CRITICAL

Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...

2026-06-30 NVD CVE

CVE-2026-7663: IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to ac CRITICAL

IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP...

2026-06-30 NVD CVE

CVE-2026-14241: Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidenc CRITICAL

Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This...

2026-06-30 NVD CVE

CVE-2026-8655: Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway CRITICAL

Multiple Memory overflow vulnerabilities in NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if NetScaler ADC is configured as an LB of type Oracle OR NetScaler...

2026-06-30 NVD CVE

CVE-2026-8452: Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unp CRITICAL ◈ 2 sources · orig. NVD CVE

Memory overflow vulnerability NetScaler ADC and NetScaler Gateway leading to unpredictable or erroneous behavior and Denial of Service if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy)...

boundcisa-kevcitrixcve-2026-8452denialimproper-restrictioninfrastructures-vulnerabilitiesmemory-buffer

2026-06-29 NVD CVE

CVE-2026-11720: A path traversal vulnerability exists in the HTTP tool URL builder of googleapis CRITICAL

A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured...

2026-06-29 NVD CVE

CVE-2026-56290: The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitra CRITICAL ◈ 2 sources · orig. NVD CVE

The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

arbitrary-files-uploadcisa-kevcve-2026-56290improper-access-controljoomlackpage-builderremote-code-executionsoftware-vulnerabilities

2026-06-25 NVD CVE

CVE-2025-71338: Flowise contains a path traversal vulnerability in the /api/v1/document-store/lo CRITICAL

Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary files to the filesystem. Attackers can exploit...

2026-06-25 NVD CVE

CVE-2025-71333: Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerab CRITICAL

Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Attackers can exploit path traversal in the chatId and...

2026-06-23 NVD CVE

CVE-2026-53622: Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a c CRITICAL

Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7.3, there is a critical vulnerability in Traefik's HTTP/3 (QUIC) TLS configuration selection that allows unauthenticated clients to bypass...