Live feed · cooey

2026-07-10 NVD CVE critical

CVE-2026-61444: PraisonAI versions before 4.6.78 contain a code injection vulnerability in deplo

PraisonAI versions before 4.6.78 contain a code injection vulnerability in deploy/api.py where the agents_file parameter is directly interpolated into an f-string without sanitization. Attackers can inject arbitrary Python code that executes when the...

apicode-injectioncve-2026-61444cybersecuritydeploymentnvd-cvepraiseaipython

2026-07-10 NVD CVE critical

CVE-2026-57158: FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 bef

FreeRDP is a free implementation of the Remote Desktop Protocol. From 3.21.0 before 3.28.0, FreeRDP clients using the GFX pipeline contain an incomplete fix for CVE-2026-23530 in planar_decompress_plane_rle_only in libfreerdp/codec/planar.c, allowing a...

buffer-overflowcmmc-level-2compliancecve-2026-23530cve-2026-57158dodfedrampfreerdp

2026-07-10 NVD CVE critical

CVE-2026-12761: The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) pl

The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow...

accounts-takeoveradministrators-accessauthentication-bypasscve-2026-12761cybersecuritydata-compromiseemail-address-verificationminiorange

2026-07-10 NVD CVE critical

CVE-2026-14894: The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to

The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability...

ajaxarbitrary-files-uploadcve-2026-14894cybersecurityfile-type-validationnoncenoprivnvd-cve

2026-07-10 CISA advisory

CISA Adds Two Known Exploited Vulnerabilities to Catalog ↗

<p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a...

balbooon-formbinding-operational-directivesbod-26-04cisacisa-advisorycve-2026-48939cve-2026-56291cyber-attacks

2026-07-10 CISA KEV high

iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

arbitrary-files-uploadcisa-kevcve-2026-48939cybersecuritydata-protectionfiles-attachmentsicagendaincident-response

2026-07-09 NVD CVE critical

CVE-2026-47826: The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an at

The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information. Affected versions: BOSH CLI tool versions prior to v7.10.4.

arbitrary-file-writeblob-ymlbosh-clicli-toolcloud-foundrycodecve-2026-47826datum-exfiltration

2026-07-09 NVD CVE high

CVE-2026-58459: gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injecti

gpsd through release-3.27.5, fixed at commit 4c06658, contains a command injection vulnerability in gpsprof that allows attackers who control the GPS device subtype value to execute arbitrary shell commands by embedding backtick payloads in the gnuplot...

arbitrary-shell-command-executionbackticks-payloadscommand-escapingcommand-injectioncommit-4c06658cve-2026-58459gnuplotgpsd

2026-07-09 CISA advisory

OpenPLC v3 ↗

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-190-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an authenticated attacker to...

arbitrary-code-executionauthenticate-attackercisacisa-advisorycritical-infrastructurecritical-manufacturingcve-2026-14480cwes-73

2026-07-09 CISA advisory

Schneider Electric Easergy MiCOM Px40 Series ↗

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-190-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Schneider Electric is aware of a vulnerability in its Easergy MiCOM Px40 Series products....

best-practicecisacisa-advisorycritical-infrastructurecritical-manufacturingcsafcve-2026-4832cwe-798

2026-07-09 NVD CVE high

CVE-2026-59214: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, Open WebUI runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads that use pyodide.http.pyfetch or the js module...

ai-platformauthenticate-requestsclient-side-pythoncve-2026-59214cybersecuritydata-exposureendpoint-securitynvd-cve

2026-07-09 NVD CVE high

CVE-2026-59216: Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI plat

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool Socket.IO events to a client-supplied session_id after checking only that the session was...

ai-platformauthentication-bypasscisacode-executioncve-2026-59216dodnist-800-171nvd-cve

2026-07-09 CISA advisory

Schneider Electric PowerChute Serial Shutdown ↗

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-190-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow attackers to overwrite...

authenticationcisa-advisorycommunicationcritical-infrastructurecve-2026-2399cve-2026-2400cve-2026-2401cve-2026-2402

2026-07-09 NVD CVE critical

CVE-2026-0284: An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of P

An XML injection vulnerability in the Large Scale VPN (LSVPN) functionality of Palo Alto Networks PAN-OS® software enables an unauthenticated attacker with network access to inject malicious XML content, potentially leading to information disclosure or...

cloud-ngfwcve-2026-0284data-corruptioninformation-disclosurelsvpnmalicious-contentsnetwork-accessnot-impacted

2026-07-09 NVD CVE critical

CVE-2026-15158: The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Uploa

The Blocksy Companion plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.1.46 via the save_attachments function. This is due to the Custom Fonts extension registering a wp_check_filetype_and_ext filter that...

arbitrary-files-uploadblocksy-companionblocksy-companion-procustom-fontscve-2026-15158file-extensionmime-validationnvd-cve

2026-07-09 NVD CVE critical

CVE-2026-47646: Improper neutralization of input during web page generation ('cross-site scripti

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network.

cross-site-scriptingcustomer-voicecve-2026-47646cybersecuritydynamics-365information-securityinput-validationmicrosoft

2026-07-09 NVD CVE critical

CVE-2026-14245: The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPres

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the...

accounts-takeoveradministrator-accounts-takeoverauthentication-bypasscve-2026-14245form-noncejavascriptminiorangenonce

2026-07-09 NVD CVE critical

CVE-2026-58122: Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability tha

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback...

accesses-tokenapi-keyauthentication-bypasscloud-metadata-endpointcve-2026-58122device-code-flowheaderhermes-webui

2026-07-09 NVD CVE critical

CVE-2026-56291: The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary

The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

arbitrary-files-uploadbalbooon-formcybersecurityfiles-uploadjoomlanvd-cverceremote-code-execution

2026-07-09 NVD CVE critical

CVE-2026-2342: Improper neutralization of input during web page generation ('cross-site scripti

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OceanicSoft Informatics Systems Ltd. ValeApp allows Stored XSS. This issue affects ValeApp: through 09072026. NOTE: The vendor was contacted early about...

cross-site-scriptingcybersecuritydisclosureinput-validationnvd-cveoceanicsoftsoftware-vulnerabilitiesstoreds-xss

2026-07-09 NVD CVE critical

CVE-2026-5955: Improper neutralization of special elements used in an SQL command ('SQL injecti

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows SQL Injection. This issue affects BiEticaret: before v3.3.57.

applications-securitybieticaretcve-2026-5955cybersecuritydata-securityinrove-softwarenvd-cvesoftware-vulnerabilities

2026-07-09 NVD CVE critical

CVE-2026-58123: Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution v

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a...

api-endpointcommand-executioncybersecuritydefense-industrial-basehermes-webuihttps-requestsincident-responsenvd-cve

2026-07-08 NVD CVE critical

CVE-2026-14487: The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file de

The Simple Coherent Form plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the removeUploadDir function in all versions up to, and including, 2.4.13. This makes it possible for unauthenticated...

arbitrary-file-deletionauthenticationauthorizationcve-2026-14487cybersecurityfile-path-validationfile-removalhash-checks

2026-07-08 NVD CVE medium

CVE-2026-8649: Improper Neutralization of Special Elements in Data Query Logic vulnerability in

Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

cve-2026-8649cybersecuritydata-querydata-securitydefense-industrial-basefederal-acquisition-regulationimproper-neutralizationmoveit

2026-07-08 NVD CVE critical

CVE-2026-12153: The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass

The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

arbitrary-code-executionauthorization-bypasscve-2026-12153cybersecuritynvd-cveplugin-activationplugin-installationplugins-vulnerabilities

2026-07-08 NVD CVE critical

CVE-2026-9701: The Eventer plugin for WordPress is vulnerable to an insecure password reset mec

The Eventer plugin for WordPress is vulnerable to an insecure password reset mechanism in all versions up to, and including, 4.4.2. The plugin stores a plaintext copy of the password reset key in the `eventer_verification_code` user meta field when a user...

cve-2026-9700cve-2026-9701eventer-pluginnvd-cvepassword-resetphpphp-74plaintext

2026-07-08 NVD CVE high

CVE-2026-60002: ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its h

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

clients-sidescve-2026-60002cybersecuritydefense-industrial-basedfar-252-204-7012freehost-keyinformation-security

2026-07-08 OIRA

Definitions of Gold Star Family and Gold Star Survivor ↗

Under OMB/OIRA review since 2026-07-08 · stage Interim Final Rule · RIN 0790-AL56

federal-registergold-star-familygold-star-survivorinterim-final-rulemanagement-and-budgetofficeoiraomb

2026-07-08 NVD CVE critical

CVE-2026-8307: Improper neutralization of special elements used in an SQL command ('SQL injecti

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Webbeyaz Web Design Mediküm Web allows SQL Injection. This issue affects Mediküm Web: through 08072026. NOTE: The vendor was contacted and it was learned...

cve-2026-8307cybersecuritydatabase-securityimproper-neutralizationmedikum-webnvd-cvesecurity-flawsql-injection

2026-07-08 NVD CVE critical

CVE-2026-58480: Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthentic

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the...

blocksy-companion-pro-plugincustom-fonts-extensionscve-2026-58480cybersecurityextension-validationfiles-uploadnvd-cvephp

2026-07-08 NVD CVE low

CVE-2026-8801: Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules

Path equivalence: vulnerability in Progress MOVEit Transfer (File Upload modules). This issue affects MOVEit Transfer: before 2025.0.8, from 2025.1.0 before 2025.1.4.

cmmccve-2026-8801cybersecuritydata-exposuredfar-252-204-7012federal-acquisition-regulationfiles-uploadincident-response

2026-07-08 NVD CVE critical

CVE-2026-9074: IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

api-connectcve-2026-9074cybersecuritydata-securitydefense-industrial-baseibmincident-responsenist-800-171

2026-07-08 NVD CVE high

CVE-2026-3144: IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could a

IBM API Connect 12.1.0.0 through 12.1.0.3 uses default credentials which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

api-connectcredentials-managementcve-2026-3144cybersecuritydata-exposuredefault-credentialsdefense-industrial-baseibm

2026-07-07 CISA KEV high

Adobe ColdFusion Path Traversal Vulnerability

Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.

adobearbitrary-code-executioncisa-kevcoldfusioncve-2026-48282cybersecurityincident-responsepath-traversal

2026-07-07 NVD CVE high

CVE-2026-13020: A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal

A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote, unauthorized attacker may assume ownership of a user’s account by manipulating this mechanism....

account-compromiseadministrator-privilegesarcgicve-2026-13020cybersecurityemail-serveresriinformation-security

2026-07-07 NVD CVE critical

CVE-2026-14345: The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell

The WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.12.7 via the 'postData' parameter parameter. This is due to unsanitized...

cve-2026-14345cybersecurityinclude-oncelog-filenvd-cvephppluginremote-code-execution

2026-07-07 CISA advisory

Hydro-Québec Le Circuit Electrique charging station backend ↗

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-188-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could lead to privilege escalation, or...

authenticationbackendcanadacharging-stationscisa-advisorycritical-infrastructurecve-2026-20744cve-2026-42952

2026-07-07 NVD CVE critical

CVE-2026-58473: Cognee before 1.2.0 contains an improper access control vulnerability that allow

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or...

cogneeconfiguration-overwritecve-2026-58473data-breachesdatum-exfiltrationendpoint-securityimproper-access-controlinstance-wide-impact

2026-07-07 CISA advisory

CISA Adds One Known Exploited Vulnerability to Catalog ↗

<p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a...

actives-exploitationsadobebinding-operational-directivesbod-26-04cisacisa-advisorycoldfusioncve-2026-48282

2026-07-07 NVD CVE critical

CVE-2026-59705: mem0's openmemory/api component contains an unauthenticated access vulnerability

mem0's openmemory/api component contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can...

apiarbitrary-accessescve-2026-59705cybersecuritydata-breachesdata-exposuredenialincident-response

Live intelligence feed