Live feed · cooey

2026-05-28 NVD CVE

CVE-2026-44881: Portainer Community Edition is a lightweight service delivery platform for conta CRITICAL

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2,...

2026-05-28 NVD CVE

CVE-2026-44477: CloudNativePG is a platform designed to manage PostgreSQL databases within Kuber CRITICAL

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.29.1 and 1.28.3, the CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres...

2026-05-26 NVD CVE

CVE-2026-40383: An improper validation of user-supplied input leads to a local file inclusion vu CRITICAL

An improper validation of user-supplied input leads to a local file inclusion vulnerability.

2026-05-26 NVD CVE

CVE-2026-8376: Perl versions through 5.43.10 have a heap buffer overflow when compiling regular CRITICAL

Perl versions through 5.43.10 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds. Perl_study_chunk in regcomp_study.c checked the size of the joined...

2026-05-26 NVD CVE

CVE-2026-8855: IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial o HIGH

IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).

2026-05-26 NVD CVE

CVE-2026-48687: FastNetMon Community Edition through 1.2.9 contains an OS command injection vuln CRITICAL

FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() function in src/juniper_plugin/fastnetmon_juniper.php (lines 117-118)...

2026-05-26 NVD CVE

CVE-2026-44985: Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSo CRITICAL

Dozzle is a realtime log viewer for docker containers. Prior to 10.5.2, he WebSocket upgrader for the /exec and /attach endpoints uses CheckOrigin: func(r *http.Request) bool { return true }, accepting upgrade...

2026-05-26 NVD CVE

CVE-2026-48898: An improper access check allows privilege escalation through the com_users batch CRITICAL

An improper access check allows privilege escalation through the com_users batch task.

2026-05-26 NVD CVE

CVE-2026-24212: NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive infor HIGH

NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text. A successful exploit of this vulnerability might lead to code execution, escalation of privileges,...

2026-05-26 NVD CVE

CVE-2026-48686: FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflo CRITICAL

FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder. The function decode_bgp_subnet_encoding_ipv4_raw() in...

2026-05-26 NVD CVE

CVE-2026-44723: Vowpal Wabbit is a machine learning system. The workflow .github/workflows/pytho MEDIUM

Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside double-quoted bash strings in four separate steps across four...

2026-05-26 NVD CVE

CVE-2026-35223: An improper access check allows unauthorized access to com_config webservice end CRITICAL

An improper access check allows unauthorized access to com_config webservice endpoints.

2026-05-26 NVD CVE

CVE-2026-35222: Improperly validated order clauses lead to a SQL injection vulnerability in com_ CRITICAL

Improperly validated order clauses lead to a SQL injection vulnerability in com_tags.

2026-05-26 NVD CVE

CVE-2025-36220: IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cl MEDIUM

IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow...

2026-05-26 NVD CVE

CVE-2026-48689: FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buf CRITICAL

FastNetMon Community Edition through 1.2.9 contains an off-by-one heap-based buffer overflow in the dynamic_binary_buffer_t class (src/dynamic_binary_buffer.hpp). Five methods (append_dynamic_buffer,...

2026-05-26 NVD CVE

CVE-2026-48904: An improper access check allows privelege escalation through the com_users group CRITICAL

An improper access check allows privelege escalation through the com_users group editing webservice endpoint.

2026-05-26 NVD CVE

CVE-2026-48691: FastNetMon Community Edition through 1.2.9 contains an integer overflow in the B CRITICAL

FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce::get_attributes() function computes attribute_length as...

2026-05-26 NVD CVE

CVE-2026-35221: Improperly built filter clauses lead to a SQL injection vulnerability in the sea CRITICAL

Improperly built filter clauses lead to a SQL injection vulnerability in the search query for com_finder.

2026-05-26 NVD CVE

CVE-2026-42496: Archive::Tar versions before 3.08 for Perl extract symlinks with attacker contro CRITICAL

Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it...

2026-05-26 NVD CVE

CVE-2026-44966: Velocity.js is a JavaScript implementation of the Apache Velocity template engin HIGH

Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of...

2026-05-26 NVD CVE

CVE-2026-8856: IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configuration HIGH

IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.

2026-05-26 NVD CVE

CVE-2026-48899: An improper access check allows privilege escalation through the com_users batch CRITICAL

An improper access check allows privilege escalation through the com_users batch task.

2026-05-22 NVD CVE

CVE-2026-8673: Unprotected transport of credentials vulnerability in syslink software AG Avantr MEDIUM

Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: before 25.3.0.

2026-05-22 NVD CVE

CVE-2026-33843: Authentication bypass using an alternate path or channel in Microsoft Azure Acti CRITICAL

Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

2026-05-22 NVD CVE

CVE-2026-47280: Improper authentication in Azure Resource Manager (ARM) allows an unauthorized a CRITICAL

Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.

2026-05-22 NVD CVE

CVE-2026-40412: Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows a CRITICAL

Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network.

2026-05-22 NVD CVE

CVE-2026-23652: Improper neutralization of special elements used in a command ('command injectio CRITICAL

Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.

2026-05-22 NVD CVE

CVE-2026-44930: An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS s CRITICAL

An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended to upgrade to...

2026-05-21 NVD CVE

CVE-2026-48172: LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possi CRITICAL ◈ 2 sources · orig. NVD CVE

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE...

2026-05-21 NVD CVE

CVE-2026-4858: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11. HIGH

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API...

2026-05-20 NVD CVE

CVE-2026-8631: A potential security vulnerability has been identified in the HP Linux Imaging a CRITICAL

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution via an integer...

2026-05-20 NVD CVE

CVE-2026-24425: Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerabi HIGH

Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to...

2026-05-20 NVD CVE

CVE-2025-31973: HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecur MEDIUM

HCL BigFix Service Management (SM) is susceptible to a Configuration – 'Insecure Use of Base Image Version'. Using outdated or insecure base images may introduce known vulnerabilities, potentially increasing the...

2026-05-20 NVD CVE

CVE-2026-42960: NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning CRITICAL

NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscuous RRSets that complement DNS replies in the authority section can be used...

2026-05-20 NVD CVE

CVE-2026-20223: A vulnerability in the access validation of internal REST APIs of Cisco Sec CRITICAL

A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with the privileges of the Site Admin...

2026-05-20 NVD CVE

CVE-2025-33255: NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an HIGH

NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of...

2026-05-20 NVD CVE

CVE-2026-24142: NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and u MEDIUM

NVIDIA TRT-LLM for any platform contains a deserialization vulnerability and unsafe serialized handle. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure.

2026-05-20 NVD CVE

CVE-2026-33278: NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability CRITICAL

NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that enables denial of service and possible remote code execution as a result of deep copying a data structure...

2026-05-20 NVD CVE

CVE-2026-24163: NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where a HIGH

NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of...

2026-05-20 NVD CVE

CVE-2026-24214: NVIDIA Triton Inference Server contains a vulnerability in the DALI backend wher HIGH

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering,...