Live feed · cooey

2026-08-14 NVD CVE

CVE-2026-17186: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute CRITICAL

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.

arbitrary-command-executioncl-commandcommand-injectioncve-2026-17186databases-vulnerabilitiesdb2i-seriesibm

2026-08-14 NVD CVE

CVE-2026-17182: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass a CRITICAL

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.

authentication-bypasscve-2026-17182db2ibmimproper-validationnvd-cvepaths-segmentsremote-attackers

2026-08-14 NVD CVE

CVE-2026-17184: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute CRITICAL

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.

arbitrary-code-executioncve-2026-17184db2external-controlfile-path-traversalibmincident-responsenvd-cve

2026-08-14 NVD CVE

CVE-2026-72826: The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scop CRITICAL

The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in createApiKey. The self-target path of requireApiKeyPermission()...

access-controlapi-keyapi-securityauthentication-bypassconfiguration-writecve-2026-72826grav-plugin-apigrav-plugins

2026-08-14 NVD CVE

CVE-2026-12949: The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via I CRITICAL

The Wishlist Member plugin for WordPress is vulnerable to Account Takeover via Insufficient Verification of Data Authenticity in versions up to and including 3.34.1. This is due to the wpm_register() function...

accounts-takeovercve-2026-12949data-authenticityinsufficient-verificationnvd-cveprivileges-escalationsecurity-bulletinunauthenticated-attacks

2026-08-14 NVD CVE

CVE-2026-72830: Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in Con CRITICAL

Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can...

api-keyapi-pluginapi-securitycommand-injectionconfigcontrollerconfiguration-managementcve-2026-72830grav

2026-08-14 NVD CVE

CVE-2026-73678: MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated re CRITICAL

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts...

apiarbitrary-code-executioncredentialcve-2026-73678endpointexecllmmind-platform

2026-08-14 NVD CVE

CVE-2026-17181: IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write fi CRITICAL

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal.

arbitrary-locationcve-2026-17181data-protectiondb2file-writeibmmirrornvd-cve

2026-08-13 NVD CVE

CVE-2026-72850: Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authe CRITICAL

Budibase before 3.40.0 fails to properly sanitize S3 object keys, allowing authenticated builders to upload files with traversal sequences that are preserved during export. Attackers can craft filenames containing .....

arbitrary-file-writeauthenticate-attacksauthenticationbudibasecloud-storagecve-2026-72850exportfile-traversal

2026-08-13 NVD CVE

CVE-2026-72842: luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privile CRITICAL

luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit...

acl-inconsistencyauthorization-checkscontainer-managementcve-2026-72842host-side-scriptlow-privileges-authenticate-userlucuses-apps-lxcnetwork-security

2026-08-13 NVD CVE

CVE-2026-72851: Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability i CRITICAL

Budibase before 3.40.0 contains an unauthenticated SQL injection vulnerability in webhook-triggered automations with EXECUTE_QUERY steps. Attackers can POST attacker-controlled JSON to the webhook trigger endpoint to...

automationbudibasecve-2026-72851data-modificationdatasourcedatum-exfiltrationexecutives-queriesjson

2026-08-13 NVD CVE

CVE-2026-72839: filebrowser through 2.63.16 fails to properly restrict scope and permissions whe CRITICAL

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server...

access-controlcve-2026-72839default-settingsfile-managementfile-systemfilebrowserfiles-accessfiles-downloads

2026-08-13 NVD CVE

CVE-2026-72776: AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution v CRITICAL

AgenticSeek (commit fc242c7) contains an unauthenticated remote code execution vulnerability that allows any network-adjacent attacker to execute arbitrary commands by submitting crafted queries to the unprotected...

agenticseekapi-vulnerabilitiesbashinterpretercommand-injectioncors-misconfigurationcvecve-2026-72776host-level-compromise

2026-08-13 NVD CVE

CVE-2026-72841: luci-app-openvpn fails to properly validate the instance_name2 parameter during CRITICAL

luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers...

authenticate-usercve-2026-72841files-uploadluci-apps-openvpnmalicious-payloadsnvd-cveopenvpnpath-traversal

2026-08-13 NVD CVE

CVE-2026-67614: CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the We CRITICAL

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an...

authenticationcve-2026-67614cyberpanelfastapihard-coded-secretjwtnvd-cveremote-attacks

2026-08-13 NVD CVE

CVE-2026-73533: Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introd CRITICAL

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file...

administrator-accountbackdoorcve-2026-73533decommissionedmalicious-codeninja-table-pronvd-cvepersistent-file

2026-08-13 NVD CVE

CVE-2026-14525: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphe CRITICAL

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled.

application-serverauthentication-bypasscve-2026-14525featureibmlibertynvd-cvertcomm-10

2026-08-13 NVD CVE

CVE-2026-53791: rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that all CRITICAL

rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source...

access-controls-bypassallow-deny-rulecve-2026-53791daemonforged-source-addressip-spoofingnetwork-securitynvd-cve

2026-08-13 NVD CVE

CVE-2026-73532: Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introdu CRITICAL

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file...

administrator-accountbackdoorcve-2026-73532decommissionedfluent-forms-prosmalicious-codenvd-cvepersistent-file

2026-08-13 NVD CVE

CVE-2026-19747: A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B CRITICAL

A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE...

attack-vectorscommand-injectioncve-2026-19747cybersecurityexploitnetwork-securitynetworks-devicesnvd-cve

2026-08-13 NVD CVE

CVE-2026-17482: IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to e CRITICAL

IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.

cve-2026-17482documentationfile-pathibmibm-documentation-offlineimproper-controlnvd-cveremote-code-execution

2026-08-13 NVD CVE

CVE-2026-19297: IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain una CRITICAL

IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.

authenticationcve-2026-19297ibmlangflownvd-cveossremote-attackerssecurity

2026-08-12 NVD CVE

CVE-2026-17276: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to esca CRITICAL

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.

cve-2026-17276high-authority-threadibm-iibm-i-7-3ibm-i-7-4ibm-i-7-5ibm-i-7-6improper-authorization

2026-08-12 NVD CVE

CVE-2026-71471: A flaw was found in acm-search-v2-rhel9. An attacker with administrative privile CRITICAL

A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the...

nvd-cve

2026-08-12 NVD CVE

CVE-2024-27253: IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated CRITICAL

IBM DOORS Next 7.0.3 through 7.0.3 Interim Fix 018 could allow an authenticated user to bypass security logic to perform unauthorized activities.

nvd-cve

2026-08-12 NVD CVE

CVE-2026-73519: WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret comp CRITICAL

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication...

nvd-cve

2026-08-12 NVD CVE

CVE-2026-72508: A flaw was found in the multicloud-operators-subscription component of Red Hat A CRITICAL

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating...

nvd-cve

2026-08-12 NVD CVE

CVE-2026-17083: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary CRITICAL

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

nvd-cve

2026-08-12 NVD CVE

CVE-2026-73268: A flaw was found in the cluster-curator-controller component of multicluster eng CRITICAL

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is...

nvd-cve

2026-08-12 NVD CVE

CVE-2026-16860: IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to exec CRITICAL

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

arbitrary-code-executionauthenticate-attackercve-2026-16860ibmibm-iibm-i-7-3ibm-i-7-4ibm-i-7-5

2026-08-12 NVD CVE

CVE-2026-70398: A flaw was found in multicloud-integrations, a component of Red Hat Advanced Clu CRITICAL

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster...

argos-cdbearer-tokencloud-securitycve-2026-70398data-disclosuregitopsclustermulticloud-integrationnvd-cve

2026-08-12 NVD CVE

CVE-2026-72526: A flaw was found in the multicloud-integrations component. The Application propa CRITICAL

A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A...

annotation-validationapplications-custom-resourceargos-cdcluster-managementcode-executioncve-2026-72526hub-clustermanifest-synchronization

2026-08-12 NVD CVE

CVE-2025-41769: The device's PROFINET service is affected by a buffer overflow vulnerability tha CRITICAL

The device's PROFINET service is affected by a buffer overflow vulnerability that exists in the default configuration. An unauthenticated remote attacker could exploit this vulnerability to reboot the device or...

arbitrary-code-executionbuffer-overflowcve-2025-41769default-configurationdevice-rebootexploitindustrial-control-systemnetworks-vulnerabilities

2026-08-11 NVD CVE

CVE-2026-73032: PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that a CRITICAL

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to...

chrome-privilegescve-2026-73032file-readsfile-writejavascriptllmmitmnvd-cve

2026-08-11 NVD CVE

CVE-2026-73034: DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allo CRITICAL

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id...

agent-scriptattackers-controlledcron-directoriescve-2026-73034db-gptdirectories-traversalfiles-uploadhttps-headers

2026-08-11 NVD CVE

CVE-2026-71362: Adobe Commerce is affected by an Incorrect Authorization vulnerability that coul CRITICAL

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources....

access-controladobeadobe-commercecommercecve-2026-71362exploitincorrect-authorizationnvd-cve

2026-08-11 NVD CVE

CVE-2026-69102: MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT sig CRITICAL

MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any...

admin-sessionapplication-secretcve-2026-69102forged-tokenhard-coded-secretjwtmaxkeynvd-cve

2026-08-11 NVD CVE

CVE-2026-71398: Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerabi CRITICAL

Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to...

adobeadobe-campaign-classicarbitrary-code-executioncve-2026-71398incorrect-authorizationnvd-cvesecurityvulnerability

2026-08-11 NVD CVE

CVE-2026-71384: is affected by an Incorrect Authorization vulnerability that could result in a S CRITICAL

is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write...

access-controladministrative-network-zoneapplications-vulnerabilitiescve-2026-71384cybersecuritydenialexploitincorrect-authorization

2026-08-11 NVD CVE

CVE-2026-70306: Improper neutralization of input during web page generation ('cross-site scripti CRITICAL

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

cross-site-scriptingcve-2026-70306inputs-neutralizationmicrosoftnetwork-securitynvd-cvesharepointspoofing