LIVE FEED
1601 events · 13 sources · newest first
Events in view
1601
all sources
Critical
0
severity
Active sources
13
collectors
Last sync
2026-08-28 18:00
UTC
All sources
NVD CVE · 1796CISA KEV · 1686News · 435CISA advisory · 124eCFR · 98DoD CIO CMMC · 21DC3 DCISE · 19DOJ FCA · 16NIST · 15Fed. Register · 14DCSA · 11Cyber AB docs · 10OIRA · 1
2026-06-01
NVD CVE
CVE-2026-44825: Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enab
HIGH
Hardcoded credentials in the Basic Authentication setup tool (bin/solr auth enable) in Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 allows a remote attacker to gain full administrative access to the cluster...
2026-06-01
CISA KEV
Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can...
2026-05-29
NVD CVE
CVE-2026-10062: A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this
HIGH
A vulnerability was determined in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formSetRoute of the file /goform/formSetRoute. This manipulation of the argument ip/mask/gateway causes...
2026-05-29
NVD CVE
CVE-2026-48501: GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub
HIGH
GitHub CLI (gh) is GitHub’s official command line tool. Prior to 2.93.0, GitHub CLI incorrectly includes authorization header in API requests to TUF repository mirrors via gh attestation, gh release verify, and gh...
2026-05-29
NVD CVE
CVE-2026-10063: A vulnerability was identified in TRENDnet TEW-432BRP 3.10B20. Affected by this
HIGH
A vulnerability was identified in TRENDnet TEW-432BRP 3.10B20. Affected by this issue is the function formWPS of the file /goform/formWPS. Such manipulation of the argument peerPin leads to stack-based buffer...
2026-05-29
CISA KEV
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
2026-05-27
CISA KEV
Daemon Tools contains an unspecified vulnerability that has a high impact on confidentiality, integrity, and availability.
2026-05-26
NVD CVE
CVE-2026-8856: IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configuration
HIGH
IBM HTTP Server 8.5, and 9.0 is vulnerable to denial of service in configurations where an attacker has write access to parts of the server configuration.
2026-05-26
NVD CVE
CVE-2026-8855: IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial o
HIGH
IBM HTTP Server 8.5, and 9.0 is vulnerable to remote code execution and denial of service in configurations with TLS mutual authentication (client authentication).
2026-05-26
NVD CVE
CVE-2026-44966: Velocity.js is a JavaScript implementation of the Apache Velocity template engin
HIGH
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. In 2.1.5 and earlier, a prototype pollution vulnerability was discovered in velocityjs. This issue occurs during the processing of...
2026-05-26
CISA KEV
LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with root privileges.
2026-05-26
NVD CVE
CVE-2026-24212: NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive infor
HIGH
NVIDIA Isaac Launchable for Linux contains a vulnerability where sensitive information is transmitted in clear text. A successful exploit of this vulnerability might lead to code execution, escalation of privileges,...
2026-05-22
CISA KEV
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.
2026-05-21
NVD CVE
CVE-2026-4858: Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.
HIGH
Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API...
2026-05-21
CISA KEV
Langflow contains an origin validation error vulnerability in which an overly permissive CORS configuration combined with a refresh token cookie configured as SameSite=None allows a malicious webpage to perform...
2026-05-21
CISA KEV
Trend Micro Apex One (on-premise) contains a directory traversal vulnerability that could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on...
2026-05-20
NVD CVE
CVE-2026-24425: Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerabi
HIGH
Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering capabilities to pass arbitrary PHP callables to...
2026-05-20
CISA KEV
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be...
2026-05-20
CISA KEV
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
2026-05-20
NVD CVE
A use-after-free vulnerability exists within the DNS-over-HTTPS implementation.
This issue affects BIND 9 versions 9.20.0 through 9.20.22, 9.21.0 through 9.21.21, and 9.20.9-S1 through 9.20.22-S1.
BIND 9 versions...
2026-05-20
CISA KEV
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
2026-05-20
CISA KEV
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
2026-05-20
NVD CVE
CVE-2026-24214: NVIDIA Triton Inference Server contains a vulnerability in the DALI backend wher
HIGH
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an integer overflow. A successful exploit of this vulnerability might lead to code execution, data tampering,...
2026-05-20
NVD CVE
CVE-2025-33255: NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an
HIGH
NVIDIA TRT-LLM for any platform contains a vulnerability in MPI server, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of...
2026-05-20
NVD CVE
CVE-2026-24163: NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where a
HIGH
NVIDIA TRT-LLM for any platform contains a vulnerability in RPC testing, where an attacker could cause an unsafe deserialization. A successful exploit of this vulnerability might lead to code execution, denial of...
2026-05-20
NVD CVE
CVE-2026-24206: NVIDIA Triton Inference Server contains a vulnerability where an attacker could
HIGH
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to escalation of privileges, denial of service, or...
2026-05-20
NVD CVE
CVE-2026-24213: NVIDIA Triton Inference Server contains a vulnerability in the DALI backend wher
HIGH
NVIDIA Triton Inference Server contains a vulnerability in the DALI backend where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, data...
2026-05-20
CISA KEV
Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
2026-05-20
CISA KEV
Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
2026-05-20
CISA KEV
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The...
2026-05-19
NVD CVE
CVE-2026-47314: Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflo
HIGH
Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
2026-05-19
NVD CVE
CVE-2026-47311: Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows
HIGH
Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
2026-05-19
NVD CVE
CVE-2026-8711: NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is config
HIGH
NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the...
2026-05-19
NVD CVE
CVE-2026-47310: Use after free vulnerability in Samsung Open Source Escargot allows Pointer Mani
HIGH
Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.
This issue affects Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.
2026-05-15
CISA KEV
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the...
2026-05-14
CISA KEV
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
2026-05-13
NVD CVE
CVE-2026-42584: Netty is an asynchronous, event-driven network application framework. Prior to 4
HIGH
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response,...
2026-05-13
NVD CVE
CVE-2026-42579: Netty is an asynchronous, event-driven network application framework. Prior to 4
HIGH
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty's DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding....
2026-05-12
NVD CVE
CVE-2026-27851: When safe filter is used with variable expansion, all following pipelines on the
HIGH
When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped. This can enable SQL / LDAP injection attacks...
2026-05-11
NVD CVE
CVE-2026-43639: Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerabili
HIGH
Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provider via `POST...