Live intelligence feed

417 collected events across every source — vulnerabilities, rulemaking and (soon) advisories, enforcement & news — newest first. This is the raw stream behind the compliance boards.

• 2026-07-08 NVD CVE high
  CVE-2026-60002: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its h

  ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

  clients-sidescve-2026-60002cybersecuritydefense-industrial-basedfar-252-204-7012freehost-keyinformation-security
• 2026-07-08 NVD CVE critical
  CVE-2026-9701: The Eventer plugin for WordPress is vulnerable to an insecure password reset mec

  The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user...

  cve-2026-9700cve-2026-9701eventer-pluginnvd-cvepassword-resetphpphp-74plaintext
• 2026-07-08 NVD CVE high
  CVE-2026-3144: IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could a

  IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

  api-connectcredentials-managementcve-2026-3144cybersecuritydata-exposuredefault-credentialsdefense-industrial-baseibm
• 2026-07-08 NVD CVE medium
  CVE-2026-8649: Improper Neutralization of Special Elements in Data Query Logic vulnerability in

  Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

  cve-2026-8649cybersecuritydata-querydata-securitydefense-industrial-basefederal-acquisition-regulationimproper-neutralizationmoveit
• 2026-07-08 NVD CVE critical
  CVE-2026-8307: Improper neutralization of special elements used in an SQL command ('SQL injecti

  Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned...

  cve-2026-8307cybersecuritydatabase-securityimproper-neutralizationmedikum-webnvd-cvesecurity-flawsql-injection
• 2026-07-08 NVD CVE critical
  CVE-2026-58480: Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthentic

  Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the...

  blocksy-companion-pro-plugincustom-fonts-extensionscve-2026-58480cybersecurityextension-validationfiles-uploadnvd-cvephp
• 2026-07-07 NVD CVE high
  CVE-2026-13020: A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal

  A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism....

  account-compromiseadministrator-privilegesarcgicve-2026-13020cybersecurityemail-serveresriinformation-security
• 2026-07-07 NVD CVE critical
  CVE-2026-14345: The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

  The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized...

  cve-2026-14345cybersecurityinclude-oncelog-filenvd-cvephppluginremote-code-execution
• 2026-07-07 NVD CVE critical
  CVE-2026-59706: mem0 contains unauthenticated config API endpoints that expose LLM API keys in p

  mem0 contains unauthenticated config API endpoints that expose LLM API keys in plaintext and allow server-side request forgery via attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via...

  api-keycloud-imdsconfiguration-managementcve-2026-59706cybersecuritydata-exposuredefense-industrial-basenist-800-171
• 2026-07-07 NVD CVE critical
  CVE-2026-59705: mem0's openmemory/api component contains an unauthenticated access vulnerability

  mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can...

  apiarbitrary-accessescve-2026-59705cybersecuritydata-breachesdata-exposuredenialincident-response
• 2026-07-07 NVD CVE critical
  CVE-2026-58473: Cognee before 1.2.0 contains an improper access control vulnerability that allow

  Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or...

  cogneeconfiguration-overwritecve-2026-58473data-breachesdatum-exfiltrationendpoint-securityimproper-access-controlinstance-wide-impact
• 2026-07-06 NVD CVE medium
  CVE-2026-9182: ArcGIS Server contains an unrestricted file upload vulnerability. An unauthentic

  ArcGIS Server contains an unrestricted file upload vulnerability. An unauthenticated attacker could exploit this issue by uploading a crafted file to the affected endpoint. Successful exploitation could allow arbitrary file upload.

  access-controlarbitrary-files-uploadarcgis-servercmmccve-2026-9182cybersecuritydata-integritydfar-252-204-7012
• 2026-07-06 NVD CVE critical
  CVE-2026-40139: A critical pre-authentication vulnerability exists in the authentication subsyst

  A critical pre-authentication vulnerability exists in the authentication subsystem of BeyondTrust Remote Support. Improper processing of authentication requests may allow an unauthenticated remote attacker to bypass access controls and gain unauthorized...
• 2026-07-06 NVD CVE critical
  CVE-2026-54763: Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22,

  Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account...
• 2026-07-06 NVD CVE critical
  CVE-2026-40141: A high-severity vulnerability exists in a web application component of BeyondTru

  A high-severity vulnerability exists in a web application component of BeyondTrust Remote Support and Privileged Remote Access related to the processing of certain input parameters. Insufficient validation of user-supplied input may allow an authenticated...
• 2026-07-04 NVD CVE high
  CVE-2026-14535: In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImports

  In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call...
• 2026-07-03 NVD CVE critical
  CVE-2026-12481: A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code exe

  A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `Lambda` layer. Specifically, the `_raise_for_lambda_deserialization()` function fails to enforce the safe-mode guard...
• 2026-07-03 NVD CVE high
  CVE-2026-57983: Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized

  Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
• 2026-07-03 NVD CVE critical
  CVE-2026-47898: Improper Restriction of XML External Entity Reference vulnerability in Apache Lu

  Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library). This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018. Users are recommended to...
• 2026-07-02 NVD CVE high
  CVE-2026-54408: A malicious actor with access to the network could exploit an Improper Access Co

  A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect Application to bypass authentication for data streaming.
• 2026-07-02 NVD CVE critical
  CVE-2026-41106: Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un

  Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
• 2026-07-02 NVD CVE critical
  CVE-2026-55115: A malicious actor with access to the network and low privileges could exploit a

  A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device.
• 2026-07-02 NVD CVE medium
  CVE-2026-26145: Improper access control in Azure Synapse allows an authorized attacker to elevat

  Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.
• 2026-07-02 NVD CVE critical
  CVE-2026-55116: A malicious actor with access to the network and under certain network configura

  A malicious actor with access to the network and under certain network configurations could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.
• 2026-07-01 NVD CVE critical
  CVE-2026-14363: Improper neutralization of special elements used in an SQL command ('SQL injecti

  Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
• 2026-07-01 NVD CVE critical
  CVE-2026-58025: Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWik

  Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue...
• 2026-07-01 NVD CVE critical
  CVE-2026-34106: Guardian language-system passes the id GET parameter directly into a PHP exec()

  Guardian language-system passes the id GET parameter directly into a PHP exec() call in subtitles.php (line 19) without sanitization: exec(\"php jobs/subtitle_rendering.php \".$login_session.\" \".$_GET['id'].\" ...\"). No authentication is required. An...
• 2026-07-01 NVD CVE critical
  CVE-2026-53492: containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.

  containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container...
• 2026-07-01 NVD CVE critical
  CVE-2026-58521: Improper neutralization of special elements used in an SQL command ('SQL injecti

  Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
• 2026-07-01 NVD CVE critical
  CVE-2026-34100: Guardian language-system passes the id GET parameter directly into an unsanitize

  Guardian language-system passes the id GET parameter directly into an unsanitized SQL query in media.php (line 17): SELECT id, filename, extension, type, duration, owner, private FROM files where id = '\".$_GET['id'].\"'. An authenticated attacker can...
• 2026-07-01 NVD CVE critical
  CVE-2026-58453: JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a h

  JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default admin username with an empty password accepted by...
• 2026-07-01 NVD CVE critical
  CVE-2026-50195: containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 a

  containerd is an open-source container runtime. Versions prior to 2.3.2, 2.2.5 and 2.1.9 contain a vulnerability in the CRI checkpoint import process where it fails to validate the image references specified within a checkpoint image's configuration. An...
• 2026-06-30 NVD CVE medium
  CVE-2026-13773: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated C

  IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered...
• 2026-06-30 NVD CVE high
  CVE-2026-11714: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected

  IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the apiDiscovery-1.0 feature enabled.
• 2026-06-30 NVD CVE high
  CVE-2026-11546: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected

  IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled.
• 2026-06-30 NVD CVE high
  CVE-2026-13772: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language eng

  IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and...
• 2026-06-30 NVD CVE high
  CVE-2026-11541: IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Serv

  IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are affected by an HTTP request smuggling vulnerability.
• 2026-06-30 NVD CVE high
  CVE-2026-13449: IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable

  IBM Business Automation Manager Open Editions 9.0.0 through 9.4.2 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory...
• 2026-06-30 NVD CVE critical
  CVE-2026-7663: IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to ac

  IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and execute MCP operations due to improper authorization enforcement in the Streamable MCP transport endpoint.
• 2026-06-30 NVD CVE high
  CVE-2026-10560: IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerabi

  IBM Langflow OSS 1.0.0 through 1.9.6 contains a missing authentication vulnerability in /api/v1/build_public_tmp/ endpoints that allows an unauthenticated attacker to read build event data or cancel jobs using a valid job identifier, resulting in...