Live feed · cooey

2026-05-20 NVD CVE

CVE-2026-3593: A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. HIGH

A use-after-free vulnerability exists within the DNS-over-HTTPS implementation. This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1. BIND 9 versions...

2026-05-20 NVD CVE

CVE-2026-24206: NVIDIA Triton Inference Server contains a vulnerability where an attacker could HIGH

NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or...

2026-05-20 NVD CVE

CVE-2026-24213: NVIDIA Triton Inference Server contains a vulnerability in the DALI backend wher HIGH

NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, data...

2026-05-19 NVD CVE

CVE-2026-33642: Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the CRITICAL

Kitty is a cross-platform GPU based terminal. In versions 0.46.2 and below, the handle_compose_command() function in kitty/graphics.c performs bounds validation on composition offsets using unsigned 32-bit arithmetic...

2026-05-19 NVD CVE

CVE-2026-8602: In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnera CRITICAL

In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.

2026-05-19 NVD CVE

CVE-2026-8711: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is config HIGH

NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the...

2026-05-19 NVD CVE

CVE-2026-47311: Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows HIGH

Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

2026-05-19 NVD CVE

CVE-2026-47310: Use after free vulnerability in Samsung Open Source Escargot allows Pointer Mani HIGH

Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

2026-05-19 NVD CVE

CVE-2026-8603: In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an a CRITICAL

In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.

2026-05-19 NVD CVE

CVE-2026-8605: In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could al CRITICAL

In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.

2026-05-19 NVD CVE

CVE-2026-47314: Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflo HIGH

Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

2026-05-15 NVD CVE

CVE-2026-44774: Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, an CRITICAL

Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a tenant with HTTPRoute creation permissions to expose the REST provider...

2026-05-14 NVD CVE

CVE-2026-44484: PyTorch Lightning is a deep learning framework to pretrain and finetune AI model CRITICAL

PyTorch Lightning is a deep learning framework to pretrain and finetune AI models. Versions 2.6.2 and 2.6.2 have introduced functionality consistent with a credential harvesting mechanism.

2026-05-13 NVD CVE

CVE-2026-42584: Netty is an asynchronous, event-driven network application framework. Prior to 4 HIGH

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response,...

2026-05-13 NVD CVE

CVE-2026-42581: Netty is an asynchronous, event-driven network application framework. Prior to 4 MEDIUM

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both...

2026-05-13 NVD CVE

CVE-2026-42579: Netty is an asynchronous, event-driven network application framework. Prior to 4 HIGH

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding....

2026-05-13 NVD CVE

CVE-2026-0258: A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation o CRITICAL

A server-side request forgery (SSRF) vulnerability in the IKEv2 implementation of Palo Alto Networks PAN-OS® software allows an unauthenticated attacker to cause the firewall to send network requests to unintended...

2026-05-13 NVD CVE

CVE-2026-0263: A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PA CRITICAL

A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS® software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or...

2026-05-13 NVD CVE

CVE-2026-42557: jupyterlab is an extensible environment for interactive and reproducible computi CRITICAL

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and...

2026-05-13 NVD CVE

CVE-2026-0264: A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo CRITICAL

A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS® Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition (all...

2026-05-12 NVD CVE

CVE-2026-27851: When safe filter is used with variable expansion, all following pipelines on the HIGH

When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks...

2026-05-11 NVD CVE

CVE-2026-8263: A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affect MEDIUM

A security flaw has been discovered in Tenda AC6 15.03.06.49_multi_TDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the...

2026-05-11 NVD CVE

CVE-2026-43639: Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerabili HIGH

Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST...

2026-05-10 NVD CVE

CVE-2026-7261: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, a CRITICAL

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when SoapServer is configured with SOAP_PERSISTENCE_SESSION, the handler object is persisted across requests via...

2026-05-10 NVD CVE

CVE-2026-6104: In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding nam CRITICAL

In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that...

2026-05-10 NVD CVE

CVE-2026-6722: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, a CRITICAL

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores pointers to PHP objects in a global map without...

2026-05-10 NVD CVE

CVE-2025-14179: In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, a CRITICAL

In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query...

2026-05-09 NVD CVE

CVE-2026-42257: Net::IMAP implements Internet Message Access Protocol (IMAP) client functionalit CRITICAL

Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.4.24, 0.5.14, and 0.6.4, several Net::IMAP commands accept a raw string argument that is sent to the...

2026-05-09 NVD CVE

CVE-2026-6665: The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strl HIGH

The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM client-final-message. A malicious backend that sends a SCRAM...

2026-05-09 NVD CVE

CVE-2026-42601: ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6 CRITICAL

ArchiveBox is an open source self-hosted web archiving system. In versions 0.8.6rc0 and prior, the /add/ endpoint (AddView in core/views.py) accepts a config JSON field that gets merged into the crawl config without...

2026-05-08 NVD CVE

CVE-2026-42264: Axios is a promise based HTTP client for the browser and Node.js. From version 1 HIGH

Axios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL, socketPath, beforeRedirect, and insecureHTTPParser) in the HTTP...

2026-05-08 NVD CVE

CVE-2026-42208: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) fo CRITICAL ◈ 2 sources · orig. NVD CVE

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key...

2026-05-08 NVD CVE

CVE-2026-42556: Postiz is an AI social media scheduling tool. From version 2.21.6 to before vers HIGH

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request...

2026-05-08 NVD CVE

CVE-2026-42298: Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Re CRITICAL

Postiz is an AI social media scheduling tool. Prior to commit da44801, a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow (.github/workflows/pr-docker-build.yml) allows any...

2026-05-08 NVD CVE

CVE-2026-42354: Sentry is an error tracking and performance monitoring tool. From version 21.12. CRITICAL

Sentry is an error tracking and performance monitoring tool. From version 21.12.0 to before version 26.4.1, a critical vulnerability was discovered in the SAML SSO implementation of Sentry. The vulnerability allows...

2026-05-07 NVD CVE

CVE-2026-7891: A vulnerability has been identified in Mendix Runtime (All versions). Mendix doc CRITICAL

A vulnerability has been identified in Mendix Runtime (All versions). Mendix documentation for access rules does not adequately describe the special behavior of the System.User entity, leaving developers without...

2026-05-07 NVD CVE

CVE-2026-42216: OpenEXR provides the specification and reference implementation of the EXR file CRITICAL

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0...

2026-05-07 NVD CVE

CVE-2026-42010: A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adlem HIGH

A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit...

2026-05-07 NVD CVE

CVE-2026-41586: Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framew CRITICAL

Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions 1.0.0 to 2.2.26, Channel.java implements readObject() and exposes...

2026-05-05 NVD CVE

CVE-2026-35579: CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QU CRITICAL

CoreDNS is a DNS server written in Go. In versions prior to 1.14.3, the gRPC, QUIC, DoH, and DoH3 transport implementations incorrectly handle TSIG authentication. For gRPC and QUIC, the server checks whether the...