Live feed · cooey

2026-01-20 NVD CVE

CVE-2026-23876: ImageMagick is free and open-source software used for editing and manipulating d HIGH

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow vulnerability in the XBM image decoder (ReadXBMImage)...

2026-01-19 NVD CVE

CVE-2026-23534: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the ClearCodec bands decode path when crafted band coordinates allow writes past...

2026-01-19 NVD CVE

CVE-2026-23533: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the RDPGFX ClearCodec decode path when maliciously crafted residual data causes...

2026-01-19 NVD CVE

CVE-2026-23532: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, a client-side heap buffer overflow occurs in the FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between...

2026-01-19 NVD CVE

CVE-2026-23531: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, in ClearCodec, when `glyphData` is present, `clear_decompress` calls `freerdp_image_copy_no_overlap` without validating the...

2026-01-19 NVD CVE

CVE-2026-23530: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate `nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before RLE...

2026-01-19 NVD CVE

CVE-2026-23884: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, offscreen bitmap deletion leaves `gdi->drawing` pointing to freed memory, causing UAF when related update packets arrive. A...

2026-01-19 NVD CVE

CVE-2026-23883: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.21.0, `xf_Pointer_New` frees `cursorPixels` on failure, then `pointer_free` calls `xf_Pointer_Free` and frees it again, triggering...

2026-01-14 NVD CVE

CVE-2026-22853: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1 CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated...

2026-01-14 NVD CVE

CVE-2026-22858: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1 CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, global-buffer-overflow was observed in FreeRDP's Base64 decoding path. The root cause appears to be implementation-defined char...

2026-01-14 NVD CVE

CVE-2026-22859: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1 CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in...

2026-01-14 NVD CVE

CVE-2026-22855: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1 CRITICAL

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.20.1, a heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length. This...

2026-01-12 NVD CVE

CVE-2026-22214: RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buf CRITICAL

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the ethos utility due to missing bounds checking when processing incoming serial frame data. The...

2026-01-12 NVD CVE

CVE-2026-22213: RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buf CRITICAL

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen()...

2026-01-09 NVD CVE

CVE-2025-13761: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 HIGH

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an ...

2026-01-07 NVD CVE

CVE-2025-69264: pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted depend HIGH

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution...

2026-01-07 NVD CVE

CVE-2026-22189: The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains CRITICAL

The egg-mkfont utility in Panda3D versions up to and including 1.10.16 contains a stack-based buffer overflow vulnerability due to use of an unbounded sprintf() call with attacker-controlled input. When constructing...

2026-01-07 NVD CVE

CVE-2025-12543: A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBo CRITICAL

A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly validate the Host header in incoming HTTP requests.As a...

2026-01-04 NVD CVE

CVE-2025-3654: Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information MEDIUM

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware information by exploiting insecure API endpoints. Attackers...

2026-01-04 NVD CVE

CVE-2025-3653: Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper ac HIGH

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access control vulnerability that allows unauthorized device manipulation by accepting arbitrary serial numbers without ownership...

2026-01-04 NVD CVE

CVE-2025-15115: Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authenticat MEDIUM

Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any user account by exploiting OAuth token validation flaws in...

2025-12-31 NVD CVE

CVE-2025-34468: libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a s CRITICAL

libcoap versions up to and including 4.3.5, prior to commit 30db3ea, contain a stack-based buffer overflow in address resolution when attacker-controlled hostname data is copied into a fixed 256-byte stack buffer...

2025-12-22 NVD CVE

CVE-2025-67288: An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers t CRITICAL

An arbitrary file upload vulnerability in Umbraco CMS v16.3.3 allows attackers to execute arbitrary code by uploading a crafted PDF file. NOTE: this is disputed by the Supplier because the responsibility for file...

2025-12-19 NVD CVE

CVE-2025-14733: An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process CRITICAL ◈ 2 sources · orig. NVD CVE

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2...

2025-12-10 NVD CVE

CVE-2025-14087: A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacke MEDIUM

A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser...

2025-11-06 NVD CVE

CVE-2022-50589: SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within t CRITICAL

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers...

2025-10-17 NVD CVE

CVE-2025-34282: ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulner CRITICAL

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If...

2025-10-14 NVD CVE

CVE-2025-34267: Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled c CRITICAL

Flowise v3.0.1 < 3.0.8 and all versions after with 'ALLOW_BUILTIN_DEP' enabled contain an authenticated remote code execution vulnerability and node VM sandbox escape due to insecure use of integrated modules...

2025-09-24 NVD CVE

CVE-2025-10585: Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote a CRITICAL ◈ 2 sources · orig. NVD CVE

Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

2025-09-18 NVD CVE

CVE-2025-10035: A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MF CRITICAL ◈ 2 sources · orig. NVD CVE

A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading...

2025-09-17 NVD CVE

CVE-2025-9242: An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process CRITICAL ◈ 2 sources · orig. NVD CVE

An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2...

2025-08-27 NVD CVE

CVE-2025-34157: Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-sit CRITICAL

Coolify versions prior to v4.0.0-beta.420.6 are vulnerable to a stored cross-site scripting (XSS) attack in the project creation workflow. An authenticated user with low privileges can create a project with a...

2025-08-20 NVD CVE

CVE-2010-20103: A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball CRITICAL

A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes...

2025-08-13 NVD CVE

CVE-2025-51451: In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sendi CRITICAL

In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

2025-08-13 NVD CVE

CVE-2025-51452: In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login CRITICAL

In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm.

2025-06-05 NVD CVE

CVE-2025-5635: A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This HIGH

A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. This vulnerability affects unknown code of the component PLS Command Handler. The manipulation leads to buffer overflow. The attack can be...

2025-05-30 NVD CVE

CVE-2025-48938: go-gh is a collection of Go modules to make authoring GitHub CLI extensions easi CRITICAL

go-gh is a collection of Go modules to make authoring GitHub CLI extensions easier. A security vulnerability has been identified in versions prior to 2.12.1 where an attacker-controlled GitHub Enterprise Server could...

2025-05-29 NVD CVE

CVE-2025-5331: A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as criti HIGH

A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. This vulnerability affects unknown code of the component NLST Command Handler. The manipulation leads to buffer overflow. The...

2025-05-21 NVD CVE

CVE-2025-34027: The Versa Concerto SD-WAN orchestration platform is vulnerable to an authenticat CRITICAL

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at attacker to access administrative endpoints. The Spack upload...

2025-05-11 NVD CVE

CVE-2025-4528: A weakness has been identified in Dígitro NGC Explorer up to 3.48.21. This affec MEDIUM

A weakness has been identified in Dígitro NGC Explorer up to 3.48.21. This affects an unknown function. Executing a manipulation can lead to session expiration. The attack can be launched remotely. Upgrading to...