Skip to content
COOEY
LIVE FEED
2487 events · 4 sources · newest first
Events in view
2487
all sources
Critical
2487
severity
Active sources
4
collectors
Last sync
2026-10-16 02:00
UTC
All data Vulns · 5346Regulatory · 151News · 1570 LIVE · UPDATES ON COLLECT
All sources NVD CVE · 3347CISA KEV · 1747CISA advisory · 233DC3 DCISE · 19
Any severity Critical High ⊙ SUBSCRIBE (RSS)
2026-10-15 NVD CVE
CVE-2026-111329: JuggleIM im-server through 1.8.16 ships default administrator credentials admin/ CRITICAL
JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even...
2026-10-15 NVD CVE
CVE-2026-110957: A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. Th CRITICAL
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument...
2026-10-15 NVD CVE
CVE-2026-111281: Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a re CRITICAL
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send...
2026-10-15 NVD CVE
CVE-2026-111322: Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability tha CRITICAL
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access...
2026-10-15 NVD CVE
CVE-2026-111283: BMC Helix Network Management on-prem before 26.3.01 contains an authentication b CRITICAL
BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single...
2026-10-14 NVD CVE
CVE-2026-110638: doc-recog through 1.1.6 contains an OS command injection vulnerability that allo CRITICAL
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command...
2026-10-14 NVD CVE
CVE-2026-110640: Whisper-node through 1.1.1 contains an OS command injection vulnerability that a CRITICAL
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject...
2026-10-14 NVD CVE
CVE-2026-110643: transcribe2texts through 1.0.6 contains an OS command injection vulnerability th CRITICAL
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick...
2026-10-14 NVD CVE
CVE-2020-37282: office-converter through 1.0.2 contains an OS command injection vulnerability th CRITICAL
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...),...
2026-10-14 NVD CVE
CVE-2026-104800: The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all CRITICAL
The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter. This is due to missing authentication, capability...
2026-10-14 NVD CVE
CVE-2026-109439: Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 cont CRITICAL
Lantronix XPress-DR and XPress-DR-I (CoBos-family) firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by...
2026-10-14 NVD CVE
CVE-2026-110536: A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the func CRITICAL
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead...
2026-10-14 NVD CVE
CVE-2026-110635: webp-converter before 3.0.0 contains an OS command injection vulnerability in sr CRITICAL
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings...
2026-10-14 NVD CVE
CVE-2026-110636: pypdftk through 0.5 contains an OS command injection vulnerability in fill_form( CRITICAL
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or...
2026-10-14 NVD CVE
CVE-2026-102178: A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper CRITICAL
A Stack-based Buffer Overflow vulnerability in the BGP routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP flowspec peer to cause routing-engine compromise or a routing-daemon...
2026-10-14 NVD CVE
CVE-2026-101950: A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Netwo CRITICAL
A Heap-based Buffer Overflow vulnerability in the SVR component of Juniper Networks Junos OS on SRX Series allows an unauthenticated network attacker to cause a denial of service and potentially compromise...
2026-10-14 NVD CVE
CVE-2026-101954: An Improper Authentication vulnerability in the J-Web management interface and i CRITICAL
An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain...
2026-10-14 NVD CVE
CVE-2026-104748: The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifica CRITICAL
The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.10.0 This is due to the...
2026-10-14 NVD CVE
CVE-2026-97668: The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL CRITICAL
The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the guest cart persistent meta_value in all versions up to, and including, 10.8.0 due to insufficient escaping on user...
2026-10-14 NVD CVE
CVE-2026-102175: A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon CRITICAL
A Heap-based Buffer Overflow vulnerability in the sdxd service-deployment daemon of Juniper Networks Junos OS and Junos OS Evolved allows a remote unauthenticated attacker who can control or intercept the configured...
2026-10-14 NVD CVE
CVE-2026-102031: An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evo CRITICAL
An OS Command Injection vulnerability in TACACS of Juniper Networks Junos OS Evolved allows a low-privileged TACACS+-authenticated user to execute commands with root privileges when periodic TACACS+...
2026-10-14 NVD CVE
CVE-2026-110862: Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vu CRITICAL
Better Auth from 1.4.0-beta.18 before 1.7.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to sign in as other users by reusing OAuth state values as Magic Link tokens....
2026-10-14 NVD CVE
CVE-2026-101990: A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) CRITICAL
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a remote configured BGP peer to cause an rpd crash, or on Junos OS remote...
2026-10-14 NVD CVE
CVE-2026-110002: The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary Fil CRITICAL
The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function. This is due to missing WordPress bootstrap,...
2026-10-14 NVD CVE
CVE-2026-101982: A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) CRITICAL
A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured BGP/EVPN peer to cause root code execution on Junos OS or an rpd...
2026-10-14 NVD CVE
CVE-2026-92097: The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary S CRITICAL
The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_dialog() function building the {url} template...
2026-10-13 NVD CVE
CVE-2026-109157: A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulne CRITICAL
A vulnerability was found in TRENDnet TEW-432BRP 3.10B20. Affected by this vulnerability is the function formTcpipSetup of the file /goform/formTcpipSetup. Performing a manipulation of the argument Name results in...
2026-10-13 NVD CVE
CVE-2026-110130: Dockhand before 1.0.45 contains an authentication bypass in which the global aut CRITICAL
Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation...
2026-10-13 NVD CVE
CVE-2026-49950: Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulner CRITICAL
Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data over the actor-pool TCP channel. Attackers can...
2026-10-13 NVD CVE
CVE-2026-74041: Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the osse CRITICAL
Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation. Authenticated users with manager:update_config can...
2026-10-13 NVD CVE
CVE-2026-90532: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability CRITICAL
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over...
2026-10-13 NVD CVE
CVE-2026-83662: Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) v CRITICAL
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated...
2026-10-13 NVD CVE
CVE-2026-91013: Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability CRITICAL
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a...
2026-10-13 NVD CVE
CVE-2026-74040: Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vuln CRITICAL
Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers...
2026-10-13 NVD CVE
CVE-2026-63146: Omnispace Agora Project before 26.10.0 contains a code injection vulnerability w CRITICAL
Omnispace Agora Project before 26.10.0 contains a code injection vulnerability where unescaped, attacker-controlled values are written into the config.inc.php configuration file during installation through...
2026-10-13 NVD CVE
CVE-2026-92464: Adobe Commerce is affected by an Improper Input Validation vulnerability that co CRITICAL
Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this...
2026-10-13 NVD CVE
CVE-2026-48383: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability CRITICAL
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over...
2026-10-13 NVD CVE
CVE-2026-75732: Adobe Experience Manager is affected by an Incorrect Authorization vulnerability CRITICAL
Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over...
2026-10-13 NVD CVE
CVE-2026-63353: Affected devices do not properly sanitize comment fields contained in imported t CRITICAL
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the...
2026-10-13 NVD CVE
CVE-2026-93895: IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could all CRITICAL
IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods.
◀ PREV PAGE 01 / 63 NEXT ▶