LIVE FEED
5346 events · 4 sources · newest first
Events in view
5346
all sources
Critical
2816
severity
Active sources
4
collectors
Last sync
2026-10-16 02:00
UTC
2026-10-15
CISA advisory
<p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active...
2026-10-15
NVD CVE
CVE-2026-110957: A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. Th
CRITICAL
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument...
2026-10-15
NVD CVE
CVE-2026-111281: Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a re
CRITICAL
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send...
2026-10-15
NVD CVE
CVE-2026-111283: BMC Helix Network Management on-prem before 26.3.01 contains an authentication b
CRITICAL
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single...
2026-10-15
CISA advisory
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-01.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities...
2026-10-15
CISA advisory
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-01.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of this vulnerability...
2026-10-15
CISA advisory
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01_DrupalCompatible.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p>The following versions of CISA Malcolm...
2026-10-15
CISA advisory
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-288-02.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities...
2026-10-15
NVD CVE
CVE-2026-111322: Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability tha
CRITICAL
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access...
2026-10-15
NVD CVE
CVE-2026-111329: JuggleIM im-server through 1.8.16 ships default administrator credentials admin/
CRITICAL
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even...
2026-10-15
CISA KEV
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files...
2026-10-15
CISA advisory
<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json"><strong>View CSAF</strong></a></p>
<h2>Summary</h2>
<p><strong>Successful exploitation of these vulnerabilities...
2026-10-14
CISA KEV
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This...
2026-10-14
NVD CVE
CVE-2026-102031: An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evo
CRITICAL
An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+...
2026-10-14
NVD CVE
CVE-2026-101982: A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)
CRITICAL
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd...
2026-10-14
NVD CVE
CVE-2020-37282: office-converter through 1.0.2 contains an OS command injection vulnerability th
CRITICAL
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...),...
2026-10-14
NVD CVE
CVE-2026-101950: A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Netwo
CRITICAL
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise...
2026-10-14
NVD CVE
CVE-2026-101954: An Improper Authentication vulnerability in the J-Web management interface and i
CRITICAL
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain...
2026-10-14
NVD CVE
CVE-2026-102175: A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon
CRITICAL
A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured...
2026-10-14
CISA KEV
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
2026-10-14
NVD CVE
CVE-2026-110536: A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the func
CRITICAL
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead...
2026-10-14
NVD CVE
CVE-2026-104748: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifica
CRITICAL
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the...
2026-10-14
NVD CVE
CVE-2026-97668: The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL
CRITICAL
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user...
2026-10-14
NVD CVE
CVE-2026-110643: transcribe2texts through 1.0.6 contains an OS command injection vulnerability th
CRITICAL
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick...
2026-10-14
CISA advisory
<div class="OutlineElement Ltr SCXW266414493 BCX8">
<p>CISA has added four new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog"><u>Known Exploited Vulnerabilities (KEV)...
2026-10-14
NVD CVE
CVE-2026-110635: webp-converter before 3.0.0 contains an OS command injection vulnerability in sr
CRITICAL
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings...
2026-10-14
CISA KEV
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
2026-10-14
NVD CVE
CVE-2026-102178: A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper
CRITICAL
A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon...
2026-10-14
NVD CVE
CVE-2026-110636: pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(
CRITICAL
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or...
2026-10-14
CISA KEV
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s...
2026-10-14
NVD CVE
CVE-2026-101990: A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd)
CRITICAL
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote...
2026-10-14
NVD CVE
CVE-2026-104800: The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all
CRITICAL
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability...
2026-10-14
NVD CVE
CVE-2026-109439: Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 cont
CRITICAL
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by...
2026-10-14
NVD CVE
CVE-2026-110002: The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary Fil
CRITICAL
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap,...
2026-10-14
NVD CVE
CVE-2026-110638: doc-recog through 1.1.6 contains an OS command injection vulnerability that allo
CRITICAL
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command...
2026-10-14
NVD CVE
CVE-2026-110640: Whisper-node through 1.1.1 contains an OS command injection vulnerability that a
CRITICAL
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject...
2026-10-14
NVD CVE
CVE-2026-110862: Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vu
CRITICAL
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens....
2026-10-14
NVD CVE
CVE-2026-92097: The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary S
CRITICAL
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template...
2026-10-13
NVD CVE
CVE-2026-75732: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability
CRITICAL
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over...
2026-10-13
NVD CVE
CVE-2026-90530: ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restrict
CRITICAL
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this...