Live feed · cooey

2026-06-05 NVD CVE

CVE-2026-45779: OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL CRITICAL

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. An SQL injection vulnerability exists in Open XDMoD versions prior to 10.0.3 that allows an unauthenticated remote attacker to execute...

2026-06-05 NVD CVE

CVE-2026-11420: Two path traversal vulnerabilities in the Network Installation Service (NIS) of CRITICAL

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server...

2026-06-05 NVD CVE

CVE-2026-45777: OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Startin CRITICAL

OpenXDMoD is an open framework for collecting and analyzing HPC metrics. Starting in version 9.5.0 and prior to version 11.0.3, an attacker can remotely execute arbitrary system commands on the web server hosting...

2026-06-05 NVD CVE

CVE-2026-48907: A vulnerability in the JCE editor extension for Joomla allows the creation of ne CRITICAL ◈ 2 sources · orig. NVD CVE

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution.

2026-06-04 NVD CVE

CVE-2026-10990: Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote CRITICAL

Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security...

2026-06-04 NVD CVE

CVE-2026-11120: Insufficient validation of untrusted input in Enterprise Reporting in Google Chr CRITICAL

Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape...

2026-06-04 NVD CVE

CVE-2026-11113: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 14 CRITICAL

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted...

2026-06-04 NVD CVE

CVE-2026-11029: Insufficient validation of untrusted input in Drag and Drop in Google Chrome on CRITICAL

Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox...

2026-06-04 NVD CVE

CVE-2026-11002: Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a rem CRITICAL

Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium...

2026-06-04 NVD CVE

CVE-2026-10974: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 14 CRITICAL

Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

2026-06-04 NVD CVE

CVE-2026-10972: Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed CRITICAL

Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

2026-06-04 NVD CVE

CVE-2026-10971: Insufficient validation of untrusted input in Printing in Google Chrome on Windo CRITICAL

Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via...

2026-06-04 NVD CVE

CVE-2026-10966: Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 a CRITICAL

Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)

2026-06-04 NVD CVE

CVE-2026-10931: Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a r CRITICAL

Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

2026-06-04 NVD CVE

CVE-2026-48040: The netty incubator codec.bhttp is a java language binary http parser. The libra CRITICAL

The netty incubator codec.bhttp is a java language binary http parser. The library implements Oblivious HTTP (RFC 9458) using BoringSSL's HPKE C library via JNI. When deriving native memory addresses for...

2026-06-04 NVD CVE

CVE-2026-50208: High-risk TrustAllCerts routines disable standard TLS certificate validation. Co CRITICAL

High-risk TrustAllCerts routines disable standard TLS certificate validation. Combined with hard-coded DES symmetric encryption keys, a Man-in-the-Middle (MITM) actor could decrypt network traffic.

2026-06-04 NVD CVE

CVE-2026-49191: The production build of the M3WebServer hard-codes its backend API keys, which c CRITICAL

The production build of the M3WebServer hard-codes its backend API keys, which can be easily intercepted through verbose error handling pages.

2026-06-04 NVD CVE

CVE-2026-49188: The ai_cmd utility executes with full root permissions. It pipes socket inputs d CRITICAL

The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.

2026-06-04 NVD CVE

CVE-2026-49186: The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). CRITICAL

The local MQTT broker does not enforce topic-level Access Control Lists (ACLs). This allows any client to subscribe using wildcard characters (# or +) to enumerate hidden network devices or publish rogue control commands.

2026-06-04 NVD CVE

CVE-2026-48567: Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized atta CRITICAL

Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.

2026-06-04 NVD CVE

CVE-2026-49185: The FieldX MDM adb messaging topic passes unverified payloads directly into Runt CRITICAL

The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec(), allowing command/instruction injection.

2026-06-04 NVD CVE

CVE-2026-50211: Leftover engineering diagnostics and factory-level diagnostic software remain ex CRITICAL

Leftover engineering diagnostics and factory-level diagnostic software remain exposed on retail builds, giving malicious apps write privileges to internal NVRAM registers.

2026-06-04 NVD CVE

CVE-2026-50214: The /v1/Plan service relies entirely on a shared global API token for full admin CRITICAL

The /v1/Plan service relies entirely on a shared global API token for full administrative management, allowing arbitrary creation of zero-cost network access plans.

2026-06-04 NVD CVE

CVE-2026-50225: The registration path /v1/account/register provides no bot mitigation mechanisms CRITICAL

The registration path /v1/account/register provides no bot mitigation mechanisms, allowing malicious automated systems to flood the database.

2026-06-04 NVD CVE

CVE-2026-8037: OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC CRITICAL ◈ 2 sources · orig. NVD CVE

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input...

appliance-executioncisa-kevcommand-injectionprogress-loadmastersprogress-loadmasters-vulnerabilitiesunauthenticated-attacksunsanitized-inputs

2026-06-03 NVD CVE

CVE-2026-5241: A vulnerability in the LightGlue model loading path of huggingface/transformers CRITICAL

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises...

2026-06-02 NVD CVE

CVE-2026-10611: An authentication bypass vulnerability exists in MISP when LDAP mixed authentica CRITICAL

An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users...

2026-06-02 NVD CVE

CVE-2026-42074: OpenClaude is an open-source coding-agent command line interface for cloud and l CRITICAL

OpenClaude is an open-source coding-agent command line interface for cloud and local model providers. Prior to version 0.5.1, the dangerouslyDisableSandbox parameter is exposed as part of the BashTool input schema,...

2026-06-01 NVD CVE

CVE-2026-22872: Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsul CRITICAL

Capsule is a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. Although the TenantResource RawItems processing logic forcibly sets the namespace, this...

2026-05-29 NVD CVE

CVE-2025-41270: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele CRITICAL

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0...

2026-05-29 NVD CVE

CVE-2025-41272: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele CRITICAL

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0...

2026-05-29 NVD CVE

CVE-2025-41273: Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Altern CRITICAL

Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote...

2026-05-29 NVD CVE

CVE-2026-46376: FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, una CRITICAL

FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not...

2026-05-29 NVD CVE

CVE-2025-41277: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele CRITICAL

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0...

2026-05-29 NVD CVE

CVE-2025-41276: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele CRITICAL

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0...

2026-05-29 NVD CVE

CVE-2025-41275: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele CRITICAL

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0...

2026-05-29 NVD CVE

CVE-2025-41274: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele CRITICAL

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0...

2026-05-29 NVD CVE

CVE-2026-49200: The acer_cgi.log file in the device firmware is accessible without authenticatio CRITICAL

The acer_cgi.log file in the device firmware is accessible without authentication via the web interface. This file contains cleartext login credentials (for web and Telnet), leading to unauthorized system access.

2026-05-29 NVD CVE

CVE-2025-41268: Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Adminis CRITICAL

Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to delete...

2026-05-29 NVD CVE

CVE-2025-41269: Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Ele CRITICAL

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0...