#critical
463 articles
CVE-2026-76721 and 4 more: RCE and Auth Bypass in HPE Networking Instant On APs
HPE published five critical vulnerabilities in HPE Networking Instant On access points — buffer overflows, a format string flaw, CLI command injection and a management protocol authentication bypass...
CVE-2026-8065: Authentication Bypass in Hitachi Energy RTU500 Firmware Update
An authentication bypass in the firmware update endpoint of end-of-life Hitachi Energy RTU500 versions allows an unauthenticated attacker to upload arbitrary firmware to the device...
CVE-2026-84436: Command Injection in IBM Guardium Data Protection 12.2
IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root p...
CVE-2026-88771: Unauthenticated Command Execution in Citrix NetScaler
Citrix NetScaler ADC and NetScaler Gateway contain an improper input validation vulnerability that could allow an unauthenticated attacker to execute arbitrary commands....
CVE-2026-88772: Memory Buffer Flaw in Citrix NetScaler ADC and Gateway
Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow for remote code execution or denial of serv...
CVE-2026-93641: Stored XSS via Email in Zimbra Collaboration Suite
An unauthenticated sender can forge a share notification or calendar message that triggers stored XSS in Zimbra Classic or Modern, allowing the attacker to access mailbox data and act as the victim...
CVE-2026-93643: Unauthenticated RCE in Zimbra via OnlyOffice Integration
When OnlyOffice/Document Editing is available, an unauthenticated remote attacker with access to an existing supported public Briefcase document can abuse unsigned save fields to perform path-traversa...
CVE-2026-5430: Critical Flaw in WSO2 API Manager and API Gateways
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. ...
CVE-2026-71362: Privilege Escalation in Adobe Commerce and Magento
Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user...
CVE-2026-78308, CVE-2026-78312: Auth Bypass and Path Traversal in Delta DIAEnergie
Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before 1.11.00.022....
CVE-2026-93577, CVE-2026-89078: RCE via CI/CD Regex in GitLab CE/EE
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authentica...
CVE-2026-75884: Privilege Escalation via pod_spec_override in AWX
A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccount...
CVE-2026-84719: Permission Bypass in Red Hat Ansible Automation Platform
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, ...
CVE-2026-85102: VPN Certificate Validation RCE in Check Point Quantum Gateway
Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated re...
CVE-2026-93616: Path Traversal and RCE in Check Point Management Server
Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticat...
CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability
Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Su...
CVE-2026-94127: F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability
F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker...
CVE-2025-39682: Zero-Length Record Handling in the Linux Kernel TLS Receive Path
In the Linux Kernel TLS receive path, a zero-length record bypasses the intended recvmsg() record-type handling, so subsequent TLS records may be processed under incorrect assumptions...
CVE-2026-76460: Management Interface Bypass in Cisco Identity Services Engine
Cisco Identity Services Engine and ISE Passive Identity Connector let an unauthenticated attacker gain access to the device by bypassing the web-based management interface...
CVE-2026-76461: SQL Injection in Cisco Secure Email Gateway
Cisco AsyncOS for Secure Email Gateway contains a SQL injection vulnerability that lets an unauthenticated remote attacker execute arbitrary commands with root privileges...
CVE-2026-84869: File Transfer and Execution in ConnectWise ScreenConnect Sessions
ConnectWise ScreenConnect allows files to be transferred and executed through an active remote session without authorization and without host-side confirmation...
CVE-2026-85706: Path Traversal in GitLab Community and Enterprise Edition
GitLab Community Edition and Enterprise Edition let an unauthenticated user read arbitrary files, through improper path confinement and missing authentication enforcement in the repository commits API...
CVE-2026-86060: Privilege Escalation via Policy Mask in MikroTik RouterOS
MikroTik RouterOS allows an attacker to change the trusted policy mask through improper neutralization of argument delimiters in a command, leading to privilege escalation...
CVE-2026-19490: Authentication Bypass in Citrix NetScaler ADC and Gateway
Citrix NetScaler ADC and NetScaler Gateway allow authentication bypass via an alternate path when the appliance is configured as an AAA virtual server or as a Gateway...
CVE-2026-20079: Authentication Bypass in Cisco Secure Firewall Management Center
Cisco Secure Firewall Management Center and Security Cloud Control Firewall Management allow an unauthenticated remote attacker to bypass authentication and execute script files as root...
CVE-2026-72982 and 5 Related: Six Critical Flaws in Windows Server Components
Six flaws rated 9.8 in components that listen on the network: domain controller, cluster, VPN, storage. Five of them allow code execution with no credentials at all...
CVE-2026-75650: Critical Adobe Commerce and Magento Flaw — CVSS 10, No User Interaction
A template engine injection in Adobe Commerce allows arbitrary code execution with no user interaction at all. CVSS 10.0, actively exploited, CISA deadline 11 September...
CVE-2026-78509 and CVE-2026-78510: Critical Outlook and Word Flaws — Unauthenticated Code Execution
Two flaws rated 9.8 in the most widely used Office applications. The vector is content that reaches the user anyway: a message and a document...
CVE-2026-81376: Security Feature Bypass in Visual Studio Code — A Flaw on Developer Workstations
A 9.6-rated flaw in the editor sitting on every developer's machine - and those machines hold repository keys, tokens and access to production...
CVE-2026-81963 and CVE-2026-85880: Two Actively Exploited Windows Privilege Escalation Flaws
September's Patch Tuesday brought two privilege escalation flaws already being used in attacks. One affects new systems, the other old ones - together they cover practically the whole fleet...
CVE-2026-83941: Missing Authorization in Entra ID — A Flaw You Cannot Patch Yourself
A 9.9-rated flaw in Microsoft's identity service. There is no patch to install here - it is a cloud service the vendor fixes. What remains on your side is checking what happened...
CVE-2026-86218: Pre-Auth RCE in N-able N-central — A Flaw in the Tool That Manages Other People's Infrastructure
N-central is an RMM platform - it manages client endpoints from a single place. The flaw allows code execution without logging in, so compromising the server means access to the entire managed fleet...
CVE-2026-85046: Actively Exploited V8 Flaw in Google Chrome
Google has patched another V8 flaw - this one already used in attacks. A crafted HTML page allows code execution inside the browser sandbox. The fixed version is 152.0.7977.82...
CVE-2026-19117: authentication bypass via FIDO2 registration in Delinea Secret Server
Under specific conditions an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate as that user — in a privileged access management system...
CVE-2026-20212: unauthenticated root code execution in Cisco Nexus 9000 switches
TCP ports 43210 and 43211 of the Silicon One integration are reachable in the default Layer 3 VRF, letting an unauthenticated attacker execute code with root privileges on the switch...
CVE-2026-20274 and CVE-2026-20279: Cisco IOS XR hardening release — no workarounds
Cisco published IOS XR hardening releases closing seven vulnerability classes found in its own code review — all releases are affected, regardless of device configuration...
CVE-2026-49869: Authentication Bypass in Kestra OSS — One endsWith and Full RCE as Root
The authentication filter checked whether the path ended with /configs. Any API path ending in that word skips authentication - and Kestra ships with script execution plugins enabled by default...
CVE-2026-59822: Authentication Bypass in LiteLLM — The AI Gateway Let Requests Through Without a Key
Failed key validation ended not in a refusal but in an empty permissions object being substituted. The request reached MCP tooling without a valid LiteLLM key...
CVE-2026-83548 and CVE-2026-83549: Two SonicWall SMA1000 Flaws — Pre-Auth SSRF and Post-Auth Command Execution
Two vulnerabilities in the SMA1000 access gateway: one works without logging in, the other after logging in as administrator. Together they form a chain that is hard to ignore...
CVE-2026-84325 and 5 related: critical flaws in Google Chrome 152 — sandbox escape
The Chrome 152.0.7977.75 stable release closes six critical flaws — five of them allow code execution outside the browser sandbox via a crafted HTML page...
CVE-2026-58574: Missing Authentication in Dell PowerStore Management Interface
A critical function in the Dell PowerStore management interface requires no authentication. An attacker can read information from the appliance filesystem, including administrative credentials...
CVE-2026-82854: SMTP Command Injection in Nodemailer
Nodemailer before 8.0.4 concatenates an unsanitized envelope.size value into the SMTP MAIL FROM command. CRLF characters in that value allow arbitrary SMTP protocol commands to be injected...
CVE-2026-18527: Privilege Escalation in IBM Administration Runtime Expert for i
Processing in the ARE for i GUI component allows an unauthenticated attacker to execute actions under another user's authenticated session and gain elevated privileges...
CVE-2026-19295 and CVE-2026-19286: Remote Code Execution in IBM Langflow OSS
Two critical vulnerabilities in IBM Langflow OSS allow OS command execution in the server process - through a crafted flow and through an insufficiently protected public A2A endpoint...
CVE-2026-42007: Use-After-Free in Dovecot via Sieve editheader Extension
An attacker with valid credentials can use a Sieve script with the editheader extension to trigger a use-after-free and write memory contents beyond the intended buffer into the delivered mail...
CVE-2026-82266: Redpanda Admin API Treats Unauthenticated Requests as Superuser
Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with authentication disabled by default, treating unauthenticated requests as coming from a superuser...
CVE-2026-82277: Argo Rollouts Dashboard Exposes Mutating Operations Without Auth
The Argo Rollouts dashboard through 1.10.0 binds to all interfaces and allows PromoteRollout, AbortRollout and SetRolloutImage to be invoked with no authentication whatsoever...
CVE-2026-82329: Administrative Takeover in JFrog Artifactory
JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges...
CVE-2023-49105: Authentication Bypass in ownCloud Server
An attacker who knows a victim's username can read, modify or delete any of their files without authentication, provided the victim has no signing key configured...
CVE-2026-59270: Spring Security Embedded LDAP Binds to All Interfaces
The embedded UnboundID LDAP server in Spring Security registers an administrative credential unconditionally and binds its listener to every available network interface...
Linux Kernel: 17 Security Fixes in Networking, Ceph and MPTCP (CVE-2026-74746)
A batch of 17 Linux kernel security fixes covering a use-after-free in netfilter flowtable, out-of-bounds reads in libceph, MPTCP option handling flaws and SCTP cookie validation...
UniFi OS: 12 Vulnerabilities Including Authentication Bypass (CVE-2026-77550)
Ubiquiti published a bulletin covering 12 vulnerabilities in UniFi OS and UniFi applications. The most severe lets an attacker with network access bypass authentication on UniFi OS devices...
CVE-2026-81934: Use-After-Free in Redis TLS Handling
A use-after-free in the tlsProcessPendingData() function handling the TLS pending-data list allows a remote, unauthenticated attacker to execute arbitrary commands with Redis server privileges...
CVE-2026-8452: Memory Buffer Overflow in Citrix NetScaler ADC and Gateway
A memory buffer handling flaw in NetScaler ADC and NetScaler Gateway leads to unpredictable behaviour and denial of service when the appliance acts as an SSL VPN, ICA Proxy, CVPN, RDP Proxy or AAA virtual server...
CVE-2026-49845: SQL injection in Hive Metastore — tampering with Apache Hive warehouse metadata
Apache Hive before 4.2.1 lets an authenticated user with Hive Metastore API access read and modify partition metadata through a crafted partition name in a metastore RPC request...
CVE-2026-60004: remote code execution in Gitea via the diffpatch endpoint (CISA KEV, due 28 August)
Gitea from 1.17 up to 1.27.1 lets any user with write access to a repository execute shell commands on the server — with open registration enabled, creating an account is enough...
CVE-2026-63586: unauthenticated root code execution in Weidmüller IE-SR-2TX-WL routers
Weidmüller IE-SR-2TX-WL industrial security routers let an unauthenticated attacker run arbitrary commands as root — a crafted username in the HTTP Authorization header is enough...
CVE-2026-76193, 76195, 76197: three CVSS 10 flaws in Adobe Campaign Classic leading to code execution
Adobe Campaign Classic has three vulnerabilities scored CVSS 10.0 — one SSRF and two OS command injections. Each leads to arbitrary code execution and none requires user interaction...
CVE-2026-21962: Oracle HTTP Server and WebLogic Proxy Plug-in takeover (actively exploited, CVSS 10)
Oracle Fusion Middleware 12.2.1.4.0, 14.1.1.0.0 and 14.1.2.0.0 contain an access control flaw letting an unauthenticated attacker over HTTP gain complete access to server data and the systems behind it...
CVE-2026-59568 and CVE-2026-59564: remote code execution and authentication bypass in Zscaler Client Connector
The Zscaler Client Connector agent contains flaws letting an unauthenticated, unprivileged user execute arbitrary code in the ZCC context and bypass authentication against the ZCC Portal...
CVE-2026-76835: authentication bypass in OAuth2 Proxy via the X-Forwarded-Uri header (no patch available)
In its default reverse-proxy configuration OAuth2 Proxy still trusts a client-supplied X-Forwarded-Uri header, letting an attacker bypass authentication and reach protected application routes...
CVE-2026-17145 and 12 more: IBM's August bulletin for AIX and PowerVM VIOS
IBM patched 13 vulnerabilities in AIX 7.2, AIX 7.3 and PowerVM VIOS 4.1. Ten of them let an unauthenticated remote attacker execute arbitrary code on the operating system...
CVE-2026-69836 and 12 more: Microsoft's August cloud bulletin (Entra ID, Azure, Exchange Online)
Microsoft disclosed 13 critical vulnerabilities in cloud services - Entra ID, Exchange Online, Azure SQL Database, Azure Arc, Logic Apps, Data Factory and Fabric. Find out which ones need action from you...
CVE-2026-11861 and CVE-2026-13097: FreeIPA authentication bypass via Active Directory trust
Active Directory users can bypass authentication to FreeIPA services - the portal, SMB server and LDAP directory - by impersonating a client name in the Kerberos Ticket Granting Service...
CVE-2026-76312: Four Splunk Enterprise flaws — session material exposed via embedded reports
An unauthenticated user who can read the HTML source of a page embedding a Splunk report can use exposed session material to access all relevant data...
CVE-2026-16816: Four critical flaws in IBM AIX and PowerVM VIOS
IBM AIX 7.2 and 7.3 and PowerVM VIOS 4.1 contain four critical vulnerabilities — from remote command execution to unauthenticated root compromise...
CVE-2026-20357: Three critical flaws in Cisco Crosswork — hardening release
An internal Cisco security review uncovered multiple vulnerabilities in Crosswork. The hardening release closes, among others, missing authentication for a critical function...
CVE-2026-32475: Unrestricted file upload leading to RCE in Elementor Pro
Elementor Pro through 4.2.1 allows unrestricted upload of dangerous file types. Patchstack describes a path from unauthenticated upload to RCE...
CVE-2026-64849: Actively exploited SSRF in MLflow (CISA KEV)
MLflow's unauthenticated webhook test endpoint validates only the original URL and then follows redirects, opening an SSRF...
CVE-2026-66794: Authentication bypass in Red Hat Multicluster Engine
Manipulating URL path segments lets an unauthenticated attacker bypass authentication and authorization checks and proxy requests to arbitrary in-cluster services...
CVE-2026-12564: Kubernetes service account token exfiltration from Ansible Automation Platform
The HashiCorp Vault credential plugin in AAP Controller reads the Kubernetes service account token and sends it to an attacker-supplied URL when testing credentials...
CVE-2026-18963: Account takeover in Keycloak via forced password reset
A flaw in the reset-credentials flow allows forcing a password reset for any user without clicking the verification link, leading to account takeover...
CVE-2026-59310: Actively exploited VMware vCenter flaw — CISA deadline August 21
A directory traversal flaw in the vCenter Syslog server allows remote code execution. The vulnerability is under active exploitation, with hundreds of victim IPs observed...
CVE-2026-65400: macOS Screen Sharing authentication bypass — CISA deadline August 21
A state management flaw in macOS authentication allows an attacker on the same network to connect to Screen Sharing without knowing the password...
CVE-2026-67271: Remote code execution via SMB in Dell PowerStore
An out-of-bounds write in SMB/CIFS handling in Dell PowerStore SDNAS. A crafted SMB packet causes a crash that persists despite automatic restarts...
CVE-2026-73930: Ten critical flaws in Oracle Helidon — August Oracle bulletin
The August Oracle bulletin contains ten critical flaws in the Imperative Web Server component of the Helidon framework, spanning the 1.x, 3.x and 4.x lines...
CVE-2026-19478: Unauthenticated Data Modification in GitLab CE/EE
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allo...
CVE-2026-66792: Privilege Escalation in Red Hat ACM (multicloud-operators-subscription)
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafte...
CVE-2026-66795: CSR Validation Flaw in Red Hat ACM (managedcluster-import-controller)
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name o...
CVE-2026-71472: Command Injection in Red Hat ACM (acm-search-v2)
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or...
CVE-2026-75045: Unauthenticated Database Backup Download in YouTrack
In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature...
CVE-2026-50517: deserialization of untrusted data enabling code execution in M365 Copilot (CVSS 9.9)
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network....
CVE-2026-54120: improper input validation enabling code execution in Microsoft Surface (CVSS 9.9)
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network....
CVE-2026-56160: improper authorization in Azure Red Hat OpenShift (ARO) (CVSS 9.1)
Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network....
CVE-2026-56163: missing authentication for critical function in Azure Kubernetes Service (CVSS 10.0)
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-56165: heap-based buffer overflow in Microsoft Account (CVSS 9.8)
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network....
CVE-2026-56191: improper authentication enabling tampering in Microsoft Exchange Online (CVSS 10.0)
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network....
CVE-2026-57106: server-side request forgery in Microsoft Data Quality (CVSS 10.0)
Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-58275: missing authorization in Azure DNS (CVSS 10.0)
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-58630: improper access control in Azure App Service (CVSS 10.0)
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-62825: improper authentication in Azure Key Vault (CVSS 10.0)
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-62835: improper authorization in Azure Portal (CVSS 9.3)
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network....
CVE-2026-64812: unauthorized input injection in Remote Development in JetBrains IntelliJ IDEA (CVSS 10.0)
In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session...
CVE-2026-64813: unauthorized settings modification in Remote Development in JetBrains IntelliJ IDEA (CVSS 10.0)
In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session...
CVE-2026-6516: unauthenticated RCE via agent API in ManageEngine ADAudit Plus (CVSS 10.0)
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API....
CVE-2026-65907: In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible...
CVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability
Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with ful...
CVE-2026-40712: Privilege Escalation in Dell PowerProtect Data Manager
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially explo...
CVE-2026-46738: Improper Input Validation in Dell PowerProtect Data Manager
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially explo...
CVE-2026-62144: Auth Bypass in Check Point Security Management
An authentication bypass vulnerability in Check Point Security Management and Multi-Domain Security Management allows an unauthenticated remote attacker to execute administrative commands on the Manag...
CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. ...
CVE-2026-28302: IDOR to RCE via Group Admin in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation and remote code execution as root. This issue requires group administrat...
CVE-2026-28304: Remote Code Execution as Root in SolarWinds Serv-U
SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments....
CVE-2026-28305: IDOR to RCE via Domain Account in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution as root. A domain account with admin privileges and read and write acce...
CVE-2026-28306: Privilege Escalation to SysAdmin in SolarWinds Serv-U
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to elevate their privileges to a system administrator. The impact is lower in Windows deploymen...
CVE-2026-28307: Privilege Escalation to Admin Group in SolarWinds Serv-U
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain user group to be elevated into an administrator group. The impact is lower in Windows deployments....
CVE-2026-28308: IDOR to RCE via Domain Admin in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to remote code execution. Domain administrator access is required. The impact is lower in Window...
CVE-2026-28309: Broken Access Control in SolarWinds Serv-U
SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments....
CVE-2026-28310: User Type Escalation to SysAdmin in SolarWinds Serv-U
SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows d...
CVE-2026-28312: Group Privilege Escalation to Root in SolarWinds Serv-U
SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system administrator and allow code execution as root. The impact is lower in Windows depl...
CVE-2026-28313: IDOR to SMTP Hijacking Account Takeover in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to SMTP hijacking leading to arbitrary account takeover. The impact is lower in Windows deployme...
CVE-2026-28314: IDOR to Account Takeover in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference vulnerability that leads to an account takeover. User authentication is required. The impact is lower in Windows deployments....
CVE-2026-28316: IDOR to Root Privilege Escalation in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the ro...
CVE-2026-28317: IDOR to Privilege Escalation in SolarWinds Serv-U
SolarWinds Serv-U is affected by an insecure direct object reference (IDOR) vulnerability that can lead to privilege escalation. This issue requires domain administrator access. The impact is lower in...
CVE-2026-28321: Broken Access Control to Root RCE in SolarWinds Serv-U
SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain ...
CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-202...
CVE-2026-64879: command injection in Tenable Security Center (CVSS 9.9)
A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via th...
CVE-2026-16242: unauthenticated agent access via misconfigured Konnectivity proxy-server
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication...
CVE-2026-47865: authentication bypass granting Avi Control plane access in VMware Avi Load Balancer (CVSS 9.8)
VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. A...
CVE-2026-15091: cross-site scripting in IBM Engineering AI Hub
IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation....
CVE-2026-53412: improper input validation enabling account takeover in Zoom clients for Windows (CVSS 9.8)
Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network...
CVE-2026-11386: input validation and injection flaw in Canonical ubuntu-pro-client
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-...
CVE-2026-22752: Authentication Bypass in Spring Authorization Server
Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1....
CVE-2026-63087: unauthenticated PluginAuthToken acquisition in Grafana OnCall (CVSS 9.8)
Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install ...
CVE-2026-46817: Oracle E-Business Suite Improper Privilege Management Vulnerability
Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks o...
CVE-2026-15265: path traversal in Tenable Agent plugin directory
A path traversal vulnerability in Tenable Agent 11.2.0 and 11.1.3 and lower allows a privileged attacker to write arbitrary files outside the intended plugin directory, potentially leading to remote c...
CVE-2026-27690: HTTP Request Smuggling in SAP Approuter
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could re...
CVE-2026-42990: heap-based buffer overflow in SQL Server ODBC driver (CVSS 9.8)
Heap-based buffer overflow in SQL Server ODBC driver allows an unauthorized attacker to execute code over a network....
CVE-2026-44747: memory corruption via logical errors in SAP NetWeaver Application Server ABAP (CVSS 9.9)
SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modific...
CVE-2026-44761: Sample OAuth2 Credentials in SAP Commerce Cloud
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, a...
CVE-2026-48259: SSRF Vulnerability in Adobe Experience Manager
Adobe Experience Manager is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker c...
CVE-2026-48356: Unrestricted File Upload in Adobe Commerce
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could explo...
CVE-2026-48358: Improper Output Encoding in Adobe Commerce
Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does...
CVE-2026-48359: XXE Vulnerability in Adobe Experience Manager
Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary code execution in the context of the current user....
CVE-2026-48561: improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot (CVSS 9.6)
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network....
CVE-2026-49172: heap-based buffer overflow in Windows FTP Service (CVSS 9.8)
Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a network....
CVE-2026-49798: use after free in Windows Kernel (CVSS 9.3)
Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally....
CVE-2026-50380: Heap Buffer Overflow in Microsoft Windows GDI+ (CVSS 9.6)
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network....
CVE-2026-50447: heap-based buffer overflow in Windows Message Queuing (CVSS 9.8)
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network....
CVE-2026-50518: heap-based buffer overflow in Windows DHCP Server (CVSS 9.8)
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network....
CVE-2026-50522: deserialization of untrusted data in Microsoft Office SharePoint (CVSS 9.8)
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
CVE-2026-54990: heap-based buffer overflow in Remote Desktop Client (CVSS 9.8)
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network....
CVE-2026-55008: improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server (CVSS 9.6)
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network....
CVE-2026-55040: weak authentication in Microsoft Office SharePoint (CVSS 9.1)
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network....
CVE-2026-55944: deserialization of untrusted data in Microsoft Dynamics NAV (CVSS 9.8)
Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network....
CVE-2026-56159: heap-based buffer overflow in Windows DHCP Server (CVSS 9.8)
Heap-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network....
CVE-2026-56188: race condition enabling code execution in Windows Server Network driver (CVSS 9.8)
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Network driver allows an unauthorized attacker to execute code over a network....
CVE-2026-56190: use of uninitialized resource in Windows RDP (CVSS 9.8)
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network....
CVE-2026-56451: JWT algorithm confusion enabling authentication bypass in Siemens Opcenter X (CVSS 10.0)
A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly validate the algorithm specified in the JSON Web Token (JWT) header. This could allow an...
CVE-2026-57092: use after free enabling privilege escalation in Windows VMSwitch (CVSS 9.9)
Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network....
CVE-2026-58644: deserialization of untrusted data in Microsoft Office SharePoint (CVSS 9.8)
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....
CVE-2026-59083: security constraint bypass via URL encoding in Apache Tomcat rewrite valve (CVSS 9.1)
Improper Handling of URL Encoding (Hex Encoding) vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0...
CVE-2026-59084: insufficient documentation for secure EncryptInterceptor setup in Apache Tomcat (CVSS 9.1)
Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: ...
CVE-2026-62422: authentication bypass in JetBrains YouTrack (CVSS 10.0)
In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access w...
CVE-2026-4769: undocumented unauthenticated diagnostic capability during boot in WAGO System I/O Field (CVSS 9.8)
Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible...
CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and...
CVE-2026-56291: Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability
Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to ...
CVE-2026-56688: OS Command Injection in Dell PowerFlex Manager
Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker wit...
CVE-2026-59792: Path Traversal RCE in JetBrains IntelliJ IDEA
In JetBrains IntelliJ IDEA before 2026.1.4 and 2026.2, code execution via path traversal in project workspace ID handling was possible...
CVE-2026-47646: XSS in Microsoft Dynamics 365 Customer Voice
Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network....
CVE-2026-9074: SQL Injection in IBM API Connect
IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality....
CVE-2026-33264: unrestricted import_string in Apache Airflow DAG deserialization (CVSS 9.8)
A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a...
CVE-2026-48908: JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type Vulnerability
JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and...
CVE-2026-53481: unauthenticated path traversal in Dell PowerProtect Data Domain (CVSS 9.8)
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 throu...
CVE-2026-53483: improper authentication enabling full system takeover in Dell PowerProtect Data Domain (CVSS 9.8)
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 throu...
CVE-2026-55255: Langflow Authorization Bypass Through User-Controlled Key Vulnerability
Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow...
CVE-2026-56290: Joomlack Page Builder Improper Access Control Vulnerability
Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload....
CVE-2026-40047: argument injection in Apache Camel Docling component (CVSS 9.1)
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component. The camel-docling component invokes the external `docling` command-...
CVE-2026-48203: header-driven injection and SSRF in Apache Camel Solr component (CVSS 9.1)
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr com...
CVE-2026-48204: header-controlled GridFS operation selection in Apache Camel MongoDB GridFS (CVSS 9.8)
Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the ...
CVE-2026-48205: header-controlled DNS parameters and SSRF in Apache Camel DNS component (CVSS 9.1)
Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component. The camel-dns producers read DNS operation parameters - the resolver to query, the name or d...
CVE-2026-41106: url redirection to untrusted site ('open redirect') in M365 Copilot (CVSS 9.3)
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-45499: server-side request forgery in Azure OpenAI (CVSS 9.9)
Server-side request forgery (ssrf) in Azure OpenAI allows an authorized attacker to elevate privileges over a network....
CVE-2026-57100: server-side request forgery in Microsoft Entra Provisioning Service (CVSS 9.9)
Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network....
CVE-2026-10109: pre-auth DRDA handshake RCE in IBM Db2 (CVSS 9.8)
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling....
CVE-2026-11708: cross-site scripting in IBM WebSphere Application Server
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console's integrated help system....
CVE-2026-11712: cross-site scripting in IBM WebSphere Application Server
IBM WebSphere Application Server 9.0, and 8.5 is affected by a cross-site scripting vulnerability in the administrative console help system....
CVE-2026-48286: incorrect authorization leading to code execution in Adobe Campaign Classic (CVSS 10.0)
Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current ...
CVE-2026-13762: AWS WAF body inspection bypass via fragmented HTTP/2 in Amazon CloudFront (CVSS 9.8)
Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragm...
CVE-2026-13763: AWS WAF body inspection bypass via fragmented HTTP/2 in AWS Application Load Balancer (CVSS 9.8)
Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 request...
CVE-2026-41120: acceptance of extraneous untrusted data enabling RCE in Dell Wyse Management Suite (CVSS 9.8)
Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability. A low privileged attacker with remote access could potent...
CVE-2026-11374: SSO Token Prediction in ManageEngine ADSelfService Plus
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, le...
CVE-2026-11807: missing authorization exposing plaintext credentials in Event-Driven Ansible websocket API (CVSS 9.6)
A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user permissions when processing Worker messa...
CVE-2026-12249: Cleartext HTTP Cert Enrollment in Canonical ADSys
An issue was discovered in Canonical ADSys upstream versions through v0.16.2. During Active Directory Certificate Services (AD CS) certificate auto-enrollment via the vendored Samba client script (int...
CVE-2026-28381: Snowflake datasource GET/PUT commands enabling file read/write in Grafana (CVSS 9.6)
The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/write files between the local grafana server and the connected...
CVE-2026-12048: Stored XSS in pgAdmin 4 Error and Plan Rendering
Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, including object names quoted back inside relati...
CVE-2026-45480: improper authentication allowing privilege elevation in Azure Active Directory (CVSS 10.0)
Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-47647: improper access control enabling privilege escalation in Microsoft Dynamics 365 (CVSS 9.9)
Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network....
CVE-2026-48582: missing authorization in Microsoft Exchange Online (CVSS 9.6)
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network....
CVE-2026-48584: execution with unnecessary privileges in Azure Synapse (CVSS 9.9)
Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network....
CVE-2026-50242: Auth Bypass via Direct DB Access in JetBrains Hub
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was po...
CVE-2026-54130: missing authentication for critical function in M365 Copilot (CVSS 9.8)
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network....
CVE-2026-56141: Account Takeover via Predictable Restore Codes in Hub
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 account takeover via predictable restore codes was possible...
CVE-2026-56142: Privilege Escalation in JetBrains Hub
In JetBrains Hub before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 privilege escalation by attaching authentication details to accounts was possible...
CVE-2026-20181: Authenticated Command Execution in Cisco ISE
A vulnerability in Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerabi...
CVE-2026-20266: OS Command Execution via btool in Splunk AI Toolkit
In Splunk AI Toolkit versions below 5.7.4, a user who holds the "admin" Splunk role could execute arbitrary OS commands on the host running the Splunk Enterprise instance. The vulnerability is poss...
CVE-2026-9862: OS command injection in boks_autoregisterd in Fortra Core Privileged Access Manager (CVSS 9.8)
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to ca...
CVE-2026-20253: unauthenticated arbitrary file write via PostgreSQL sidecar in Splunk Enterprise (CVSS 9.8)
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.3 and 10.2.2510.14, an unauthenticated user could create or truncate arbitrary files through a...
CVE-2026-53469: Missing Authorization in Red Hat Migration Planner
A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. Th...
CVE-2026-53470: ownership check bypass exposing presigned OVA URLs in migration-planner (CVSS 9.6)
A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker ...
CVE-2026-53471: missing source_id claim validation collapsing tenant isolation in migration-planner (CVSS 9.6)
A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the s...
CVE-2026-53474: SQL injection via crafted RVTools spreadsheet in migration-planner (CVSS 9.6)
A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicio...
CVE-2026-53475: Hardcoded Insecure TLS in Red Hat Assisted Migration Agent
A flaw was found in assisted-migration-agent. The application hardcodes insecure Transport Layer Security (TLS) connections when communicating with vCenter. This vulnerability allows a Man-in-the-Midd...
CVE-2026-53476: path traversal via crafted tarball in assisted-migration-agent (CVSS 9.6)
A flaw was found in assisted-migration-agent. An unauthenticated attacker, located on the same local area network (LAN), can exploit a path traversal vulnerability. By crafting a specially designed gz...
CVE-2026-10520: unauthenticated root-level OS command injection in Ivanti Sentry (CVSS 10.0)
An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution...
CVE-2026-10523: authentication bypass allowing admin account creation in Ivanti Sentry (CVSS 9.9)
An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts ...
CVE-2026-25089: unauthenticated OS command injection in Fortinet FortiSandbox (CVSS 9.8)
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox ...
CVE-2026-27671: memory corruption via crafted RFC request in SAP Kernel (CVSS 9.8)
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploi...
CVE-2026-34691: Stored XSS in Adobe Experience Manager Forms JEE
Adobe Experience Manager Forms JEE versions LTS SP1, 6.5.24.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scri...
CVE-2026-40128: Path Traversal in SAP NetWeaver AS Java Web Container
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and...
CVE-2026-42904: heap-based buffer overflow enabling privilege escalation in Windows TCP/IP (CVSS 9.6)
Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network....
CVE-2026-44748: XML signature verification bypass in SAP NetWeaver Application Server ABAP (CVSS 9.9)
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier....
CVE-2026-44815: stack-based buffer overflow enabling code execution in Windows DHCP Client (CVSS 9.8)
Stack-based buffer overflow in Windows DHCP Client allows an unauthorized attacker to execute code over a network....
CVE-2026-45447: use-after-free during PKCS#7 signature verification in OpenSSL (CVSS 9.8)
Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes,...
CVE-2026-45602: no cwe for this issue in Windows DHCP Server (CVSS 9.1)
No cwe for this issue in Windows DHCP Server allows an unauthorized attacker to perform tampering over a network....
CVE-2026-45657: Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.
Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network....
CVE-2026-47281: improper input validation in Visual Studio Code (CVSS 9.6)
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-47291: integer overflow enabling code execution in Windows HTTP.sys (CVSS 9.8)
Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network....
CVE-2026-47643: external control of file name or path in Azure Stack Edge (CVSS 9.8)
External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network....
CVE-2026-47938: SSRF leading to arbitrary code execution in Adobe Campaign Classic (CVSS 10.0)
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of th...
CVE-2026-48303: incorrect authorization leading to arbitrary code execution in Adobe Campaign Classic (CVSS 10.0)
Adobe Campaign Classic (ACC) versions 7.4.3 build 9394 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current ...
CVE-2026-44631: buffer underwrite via crafted configuration regexes in Apache HTTP Server (CVSS 9.8)
Buffer Underwrite vulnerability in Apache HTTP Server on crafted regular expressions in the configuration. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to ...
CVE-2026-50751: Auth Bypass in Check Point VPN Remote Access (IKEv1)
Check Point confirms active exploitation of an authentication bypass on VPN Remote Access and Mobile Access via the deprecated IKEv1 key exchange. A hotfix is available — install immediately....
CVE-2026-48567: Authentication Bypass in Microsoft Azure HorizonDB
Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-48579: Improper Authorization in Microsoft Exchange Online
Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network....
CVE-2026-10840: Excessive RBAC permissions in Red Hat OpenShift Pipelines
A flaw was found in the OpenShift Pipelines operator. The tekton-scheduler-rolebinding ClusterRoleBinding grants the system:authenticated group write access to Kueue and cert-manager custom resources ...
CVE-2026-8037: OS command injection (RCE) in Progress LoadMaster
OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting uns...
CVE-2025-14771: Files accessible to external parties in ABB T-MAC Plus
Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24....
CVE-2026-42252: Command Injection in Apache Airflow
Apache Airflow's official documentation at `core-concepts/dag-run.html` ("Passing Parameters when triggering Dags") showed a verbatim `BashOperator(bash_command="echo value: {{ dag_run.conf['conf1'] }...
CVE-2026-8644: IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing.
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to identity spoofing....
CVE-2026-9311: Remote Code Execution in IBM WebSphere Application Server
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to remote code execution caused by the bypass of security controls....
CVE-2026-9319: Remote code execution in IBM WebSphere Application Server
IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to potential remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security....
CVE-2026-0257: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection....
CVE-2026-32998: Critical RCE in Veeam Service Provider Console and Backup & Replication
Critical RCE vulnerability in Veeam Service Provider Console (9.x < 9.2.0.33215) and Veeam Backup & Replication (13.x < 13.0.1.2067) - attackers can remotely execute code on backup management systems...
CVE-2026-42945: Critical RCE in NGINX ngx_http_rewrite_module (Public PoC Available)
Critical RCE vulnerability in NGINX ngx_http_rewrite_module present in source code since 2008 - heap buffer overflow in rewrite and set directive handling allows unauthenticated remote code execution...
CVE-2026-4408: Remote command execution in Samba
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configu...
CVE-2025-12686: Buffer overflow RCE in Synology BeeStation Manager
Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation Manager (BSM) before 1.3.2-65648 and Synology BeeStation OS before 1.3.2-6564...
CVE-2026-45321: TanStack Unspecified Vulnerability
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity....
CVE-2026-8175: Buffer overflow in IBM Aspera High-Speed Transfer Server
IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected...
CVE-2026-23652: Command injection in Microsoft Power Pages
Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network....
CVE-2026-2651: Broken access control in MLflow artifact upload
A vulnerability in MLflow versions <=3.10.1.dev0 allows unauthorized access to multipart upload (MPU) endpoints when the `--serve-artifacts` mode is enabled. The authorization logic does not enforce r...
CVE-2026-33843: Authentication bypass in Microsoft Azure Active Directory B2C
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-39821: Privilege escalation in Go golang.org/x/net/idna
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com"...
CVE-2026-40411: Improper Input Validation in Azure Virtual Network Gateway
Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network....
CVE-2026-40412: Unrestricted File Upload in Azure Orbital Spatio
Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network....
CVE-2026-41090: Command injection in Microsoft Copilot
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network....
CVE-2026-41104: Untrusted Data Deserialization in Microsoft Planetary Computer Pro
Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network....
CVE-2026-42901: Origin Validation Error in Microsoft Entra ID
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-44930: LDAP Injection in Apache CXF (XKMS server)
An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository. Users are recommended...
CVE-2026-47280: Improper authentication in Microsoft Azure Resource Manager
Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-48172: LiteSpeed cPanel Plugin Privilege Escalation Vulnerability
LiteSpeed cPanel Plugin contains privilege escalation vulnerability that is exposed via the user-end cPanel plugin, which can be abused by any cPanel user account to execute arbitrary scripts with roo...
CVE-2026-8633: Remote code execution in IBM WebSphere Application Server
IBM Web Server Plug-ins for WebSphere Application Server and WebSphere Liberty 8.5, 9.0 IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to remote code executio...
CVE-2026-33000: Command injection in Ubiquiti UniFi OS
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection....
CVE-2026-34908: Improper access control in Ubiquiti UniFi OS
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system....
CVE-2026-34909: Path traversal in Ubiquiti UniFi OS
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an unde...
CVE-2026-34910: Command injection in Ubiquiti UniFi OS
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection....
CVE-2026-6960: Arbitrary file upload in WordPress BookingPress Pro plugin
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all version...
CVE-2026-9082: Drupal Core SQL Injection Vulnerability
Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API....
CVE-2026-5433: Command injection in Honeywell Control Network Module (CNM)
Honeywell Control Network Module (CNM) contains command injection vulnerability in the web interface. An attacker could exploit this vulnerability via command delimiters, potentially resulting in Remo...
CVE-2026-6279: Unauthenticated RCE in WordPress Avada Builder plugin
The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2. This is due to the `wp...
CVE-2008-4250: 2008 Vulnerability Now Actively Exploited (Microsoft)
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow duri...
CVE-2009-1537: 2009 Vulnerability Now Actively Exploited (Microsoft)
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a craft...
CVE-2009-3459: 2009 Vulnerability Now Actively Exploited (Adobe)
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption....
CVE-2010-0806: 2010 Vulnerability Now Actively Exploited (Microsoft)
Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion o...
CVE-2026-20223: Critical Authentication Bypass in Cisco Secure Workload
Critical access-validation vulnerability in Cisco Secure Workload internal REST APIs (3.9.x and earlier, 3.10.x < 3.10.8.3, 4.0.x < 4.0.3.17) - unauthenticated remote attacker can obtain Site Admin privileges...
CVE-2026-24207: Authentication bypass in NVIDIA Triton Inference Server
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A successful exploit of this vulnerability might lead to code execution, escalation of p...
CVE-2026-45444: Arbitrary file upload in Gift Cards For WooCommerce Pro (plugin)
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files. This issue affects Gift Cards For WooCommerce Pro: from n/a thr...
CVE-2026-6555: Arbitrary File Upload in WordPress ProSolution WP Client (plugin)
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 2.0.0. This is due to an array validation mismatch where only the first file in ...
CVE-2026-7637: PHP Object Injection in WordPress Boost (plugin)
The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. This make...
CVE-2026-8495: Missing Authorization in Drupal Date iCal
Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing. This issue affects Date iCal: from 0.0.0 before 4.0.15....
CVE-2026-8598: Unauthenticated config export port in ZKTeco CCTV Camera
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as ope...
CVE-2026-2586: Authenticated RCE in Eclipse GlassFish Admin Console
An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of a...
CVE-2026-2587: Server-side EL injection RCE in Eclipse GlassFish
A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler. The application processes .xml files and evalu...
CVE-2026-2611: Improper origin validation RCE in MLflow Assistant
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests fro...
CVE-2026-31986: Hard-coded cryptographic key in Apache OFBiz
Use of Hard-coded Cryptographic Key vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade to version 24.09.06, which fixes the issue....
CVE-2026-41919: LDAP Injection in Apache OFBiz
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 24.09.06. Users are recommended to upgrade...
CVE-2026-43633: Unauthenticated Deserialization RCE in HestiaCP
HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js that allows unauthenticated remo...
CVE-2026-4883: Arbitrary File Upload in WordPress Piotnet Forms plugin
The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to, and including,...
CVE-2026-4885: Arbitrary File Upload in WordPress Piotnet Addons for Elementor Pro
The Piotnet Addons for Elementor Pro plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'pafe_ajax_form_builder' function in all versions up to, and...
CVE-2026-8948: Same-Origin Policy Bypass in Mozilla Firefox
Same-origin policy bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 151....
CVE-2026-8953: Use-after-free sandbox escape in Mozilla Firefox
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, and Firefox ESR 140.11....
CVE-2026-8959: Sandbox Escape in Mozilla Firefox
Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 151 and Firefox ESR 140.11....
CVE-2026-8974: Memory safety bugs in Mozilla Firefox
Memory safety bugs present in Firefox ESR 140.10 and Firefox 150. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited...
CVE-2026-7301: Unauthenticated RCE in SGLang multimodal runtime
SGLangs multimodal generation runtime scheduler's ROUTER socket binds to 0.0.0.0 by default and contains a sink that calls pickle.loads() on incoming messages, enabling RCE when exposed to the interne...
CVE-2026-7304: Unauthenticated RCE in SGLang custom logit processor
SGLangs multimodal generation runtime is vulnerable to unauthenticated remote code execution when the --enable-custom-logit-processor option is enabled, as Python objects loaded via dill.loads() will ...
CVE-2018-25332: Unauthenticated RCE in GitBucket
GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token generation and insecure file upload...
CVE-2026-5229: Authentication Bypass in WordPress Form Notify plugin
The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This is due to the plugin trusting user-controlled cookie data to determine which Wo...
CVE-2026-8398: Supply chain attack trojanizing DAEMON Tools Lite installers
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc be...
CVE-2026-20182: Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges ...
CVE-2026-41615: Information Disclosure in Microsoft Authenticator
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network....
CVE-2026-6510: Privilege Escalation in WordPress InfusedWoo Pro plugin
The InfusedWoo Pro plugin for WordPress is vulnerable to privilege escalation via missing authorization in all versions up to, and including, 5.1.2. This is due to missing nonce verification and capab...
CVE-2026-8181: Authentication bypass in WordPress Burst Statistics (plugin)
Authentication bypass in Burst Statistics WordPress plugin versions 3.4.0 to 3.4.1.1 due to incorrect return-value handling in is_mainwp_authenticated(). Unauthenticated attackers with knowledge of admin username can impersonate that administrator...
CVE-2026-8511: Use-after-free in UI in Google Chrome (sandbox escape)
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)...
CVE-2026-8580: Use-after-free in Mojo in Google Chrome (sandbox escape)
Use after free in Mojo in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)...
CVE-2025-11159: Remote Code Execution via JDBC in Hitachi Vantara Pentaho
Hitachi Vantara Pentaho Data Integration & Analytics of all versions contain a JDBC driver for H2 databases which is vulnerable to external script execution when a new connection is created by a data ...
CVE-2026-41225: Arbitrary Command Execution in F5 BIG-IP iControl REST
Vulnerability in F5 BIG-IP iControl REST allows a highly privileged authenticated attacker with at least the Manager role to create configuration objects that enable running arbitrary commands...
CVE-2025-40949: Unauthenticated RCE in Siemens RUGGEDCOM ROX
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.17.1), RUGGEDCOM ROX MX5000RE (All versions < V2.17.1), RUGGEDCOM ROX RX1400 (All versions < V2.17.1), RUGGEDCOM ROX RX15...
CVE-2026-22924: Resource Exhaustion DoS in Siemens SIMATIC CN 4100
A vulnerability has been identified in SIMATIC CN 4100 (All versions < V5.0). The affected application does not properly restrict unauthenticated connections and is susceptible to resource exhaustion ...
CVE-2026-25786: Stored XSS via PLC Name in Siemens SIMATIC Web Interface
Affected devices do not properly validate and sanitize PLC/station name rendered on the "communication" parameters page of the web interface. This could allow an authenticated attacker who is authoriz...
CVE-2026-25787: Stored XSS via Technology Object Name in Siemens SIMATIC
Affected devices do not properly validate and sanitize Technology Object (TO) name rendered on the "Motion Control Diagnostics" page of the web interface. This could allow an authenticated attacker wh...
CVE-2026-26083: Missing authorization in Fortinet FortiSandbox
A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSandbox PaaS 23.4 all versions, Forti...
CVE-2026-29204: Insufficient ownership checks in cPanel clientarea.php
Insufficient ownership checks in clientarea.php allow an authenticated client area user to submit requests using another user's addonId without any ownership validation leading to unauthorized acc...
CVE-2026-33117: Improper authentication in Azure SDK allows security feature bypass
Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network....
CVE-2026-34260: SQL Injection in SAP S/4HANA Enterprise Search for ABAP
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The applicat...
CVE-2026-34263: Unauthenticated Code Injection in SAP Commerce Cloud
Due to improper Spring Security configuration, SAP Commerce cloud allows an unauthenticated user to perform malicious configuration upload and code injection, resulting in arbitrary server-side code e...
CVE-2026-40379: Sensitive Information Exposure in Azure Entra ID
Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network....
CVE-2026-40402: Use-After-Free Privilege Escalation in Microsoft Windows Hyper-V
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally....
CVE-2026-41089: Stack-based Buffer Overflow in Microsoft Windows Netlogon
Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network, enabling unauthenticated remote code execution...
CVE-2026-41096: Heap-based Buffer Overflow in Microsoft Windows DNS
Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network, enabling critical unauthenticated remote code execution...
CVE-2026-41551: Path Traversal in Siemens ROS#
Path traversal vulnerability in Siemens ROS# (versions prior to 2.2.2) allows a remote attacker to access arbitrary files due to insufficient sanitization of user input...
CVE-2026-42823: Improper Access Control in Azure Logic Apps
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network....
CVE-2026-42833: Execution with Unnecessary Privileges in Microsoft Dynamics 365
Execution with unnecessary privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network....
CVE-2026-42898: Code Injection in Microsoft Dynamics 365 (on-premises)
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network....
CVE-2026-44277: Improper Access Control in Fortinet FortiAuthenticator
An improper access control vulnerability in Fortinet FortiAuthenticator versions 8.0.2, 8.0.0, 6.6.0-6.6.8 and 6.5.0-6.5.6 may allow an attacker to execute unauthorized code or commands....
CVE-2026-8043: File name external control in Ivanti Xtraction
External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to i...
CVE-2026-40636: Hard-coded Credentials in Dell ECS and ObjectScale
Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectScale versions prior to 4.3.0.0 contain a hard-coded credentials vulnerability allowing unauthenticated local attackers to gain filesystem access...
CVE-2026-33109: Improper access control in Azure Managed Instance for Apache Cassandra
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network....
CVE-2026-33823: Improper authorization in Microsoft Teams allows information disclosure
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network....
CVE-2026-33844: Improper Input Validation in Azure Managed Instance for Apache Cassandra
Improper input validation in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network....
CVE-2026-35428: Command Injection in Azure Cloud Shell
Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network....
CVE-2026-42826: Sensitive Information Exposure in Azure DevOps
Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network....
CVE-2026-40982: Directory Traversal in VMware Spring Cloud Config
Directory traversal vulnerability in VMware Spring Cloud Config (versions 3.1.0-3.1.13 and 4.1.0-4.1.9) allows attackers with crafted URLs to access arbitrary files via the spring-cloud-config-server module...
CVE-2026-28780: Heap-based buffer overflow in Apache HTTP Server mod_proxy_ajp
Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server this AJP server can send a malicious AJP message back to mod_proxy_...
CVE-2026-25293: Buffer overflow in Qualcomm PLC Firmware
A buffer overflow caused by incorrect authorization in Qualcomm PLC firmware allows an attacker on an adjacent network to impact device confidentiality, integrity and availability...
CVE-2026-42376: Hardcoded telnet backdoor in D-Link DIR-456U
The D-Link DIR-456U Hardware Revision A1 (End-of-Life) router contains an embedded telnet backdoor with a static password. An unauthenticated attacker on the local network can obtain root privileges...
CVE-2026-42796: Unauthenticated RCE in Arelle (/rest/configure)
Arelle before 2.39.10 contains an unauthenticated remote code execution vulnerability in the /rest/configure endpoint - the plugins parameter is forwarded to the plugin manager without authorization, allowing remote code execution...
CVE-2026-42809: Privilege escalation in Apache Polaris via vended storage credentials
Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated, allowing an attacker to direct the scope of those credentials to a target of their choice...
CVE-2026-42812: Metadata validation bypass in Apache Polaris (Iceberg)
In Apache Iceberg, table metadata files are control files - they tell readers which data files belong to the table and which version to read. Changing write.metadata.path via ALTER TABLE bypasses Polaris-side validation...
CVE-2026-7482: Heap out-of-bounds read in Ollama (GGUF loader)
Ollama before 0.17.1 contains a heap out-of-bounds read vulnerability in its GGUF model loader. A crafted GGUF file submitted to /api/create can leak server memory, including API keys and system prompts...
CVE-2026-4882: Arbitrary file upload in WordPress User Registration Advanced Fields
The User Registration Advanced Fields plugin for WordPress (versions up to and including 1.6.20) allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution on the server...
CVE-2026-7458: Authentication bypass in WordPress User Verification by PickPlugins
The User Verification by PickPlugins plugin for WordPress (versions up to and including 2.0.46) allows unauthenticated attackers to log in as any user with a verified email by submitting an OTP value of "true"...
CVE-2026-42483: Heap buffer overflow in hashcat Kerberos hash parser
A heap-based buffer overflow in the Kerberos hash parser in hashcat v7.1.2 allows an attacker to cause denial of service or possibly execute arbitrary code via a crafted Kerberos hash file.
CVE-2026-42778: Incomplete deserialization fix in Apache MINA (2.1.X/2.2.X branches)
The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches of Apache MINA. The classname allowlist in AbstractIoBuffer.getObject() was applied too late - a static initializer in the class to be read might already have executed.
CVE-2026-42779: Deserialization allowlist bypass in Apache MINA (2.1.X/2.2.X)
The fix for CVE-2026-41635 was not applied to the 2.1.X and 2.2.X branches. AbstractIoBuffer.resolveClass() in Apache MINA contains two branches; one (for static classes/primitive types) does not check the class at all, bypassing the allowlist.
CVE-2026-7567: Authentication bypass in WordPress Temporary Login plugin
The Temporary Login plugin for WordPress (versions up to and including 1.0.0) contains an authentication bypass in the maybe_login_temporary_user() function. Passing an array instead of a string in the GET parameter lets an attacker log in as an arbitrary user, typically an administrator...
CVE-2026-41940: Authentication bypass in cPanel & WHM login flow
cPanel and WHM versions prior to 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.134.0.20, and 11.136.0.5 contain an authentication bypass vulnerability in the login flow allowing unauthenticated remote attackers to access the control panel.
CVE-2026-42523: Stored XSS in Jenkins GitHub Plugin
Jenkins GitHub Plugin 1.46.0 and earlier improperly processes the current job URL inside JavaScript validating the 'GitHub hook trigger for GITScm polling' feature, resulting in a stored XSS exploitable by users with Overall/Read.
CVE-2026-40976: Spring Boot default web security ineffective, allows unauthorized access
Under specific conditions Spring Boot 4.0.0-4.0.5 default web security is ineffective and allows unauthorized access to all endpoints in servlet web applications relying on the default filter chain...
CVE-2026-33453: Header injection in Apache Camel camel-coap leads to RCE
Apache Camel's camel-coap component is vulnerable to Camel message header injection, leading to remote code execution when routes forward CoAP requests to header-sensitive producers...
CVE-2026-33454: Header injection in Apache Camel camel-mail
Apache Camel's camel-mail component filters headers only on the 'out' direction, missing the 'in' direction - this allows control headers to be injected via inbound mail...
CVE-2026-40453: Incomplete header filter fix in Apache Camel
The fix for CVE-2025-27636 was not applied to five non-HTTP HeaderFilterStrategy implementations in camel-jms, camel-sjms, camel-coap and camel-google-pubsub, allowing case-variant header bypass...
CVE-2026-40860: Unsafe JMS ObjectMessage deserialization in Apache Camel
JmsBinding classes in camel-jms and camel-sjms deserialize JMS ObjectMessage without any ObjectInputFilter or class allowlist, allowing an attacker to achieve remote code execution via a crafted JMS message...
CVE-2024-57726: 2024 Vulnerability Now Actively Exploited (SimpleHelp )
SimpleHelp contains a missing authorization vulnerability that could allow low-privileged technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges t...
CVE-2026-1952: Denial of service in Delta Electronics AS320T
Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability...
CVE-2026-21515: Privilege escalation in Microsoft Azure IoT Central
Azure IoT Central exposes sensitive information to an unauthorized actor, allowing an authorized attacker to elevate privileges over a network...
CVE-2026-24303: Privilege escalation in Microsoft Partner Center via improper access control
Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network...
CVE-2026-32210: SSRF in Microsoft Dynamics 365 (Online)
Server-side request forgery (SSRF) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-33102: Open redirect in Microsoft M365 Copilot
URL redirection to an untrusted site (open redirect) in M365 Copilot allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-33819: Deserialization of untrusted data in Microsoft Bing - RCE
Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network...
CVE-2026-35431: SSRF in Microsoft Entra ID Entitlement Management
Server-side request forgery (SSRF) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-29198: NoSQL injection and account takeover in Rocket.Chat
A NoSQL injection in Rocket.Chat (<8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, <7.10.9) can lead to account takeover of the first user with a generated token when an OAuth app is configured...
CVE-2026-1555: Arbitrary file upload in WebStack theme for WordPress
The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function, which may enable remote code execution...
CVE-2026-34279: Scope-change compromise in Oracle Enterprise Manager Event Management
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are affected are 13.5 and 24.1. Easily exploi...
CVE-2026-34286: Unauthenticated data tampering in Oracle Identity Manager Connector (Fusion Middleware)
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability a...
CVE-2026-40050: Unauthenticated path traversal in CrowdStrike LogScale
CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale. This vulnerability only requires mitigation by customers that...
CVE-2026-6768: Mitigation bypass in Firefox Networking Cookies component
Mitigation bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 150....
CVE-2025-32975: Quest KACE Systems Management Appliance (SMA) Improper Authentication Vulnerability
Quest KACE Systems Management Appliance (SMA) contains an improper authentication vulnerability that could allow attackers to impersonate legitimate users without valid credentials....
CVE-2026-33557: SASL OAuth JWT validation flaw in Apache Kafka
A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.D...
CVE-2026-25917: XCom arbitrary code execution by DAG authors in Apache Airflow
Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execute arbitrary code. Since Dag Authors are already highly tru...
CVE-2025-41118: Data handling vulnerability in Grafana Pyroscope
Pyroscope is an open-source continuous profiling database. The database supports various storage backends, including Tencent Cloud Object Storage (COS). If the database is configured to use Tencent C...
CVE-2026-20147: Authenticated command execution in Cisco ISE
A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vul...
CVE-2026-20180: Authenticated command execution in Cisco Identity Services Engine
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit...
CVE-2026-20184: SSO impersonation in Cisco Webex Services Control Hub
A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service. ...
CVE-2026-20186: Authenticated command execution in Cisco Identity Services Engine
A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit...
CVE-2026-27304: Improper input validation leading to RCE in Adobe ColdFusion
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio...
CVE-2026-6296: Buffer overflow in Google Chrome
Heap buffer overflow in ANGLE in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)...
Critical Vulnerabilities in Fortinet Products – FortiSandbox, FortiDDoS-F, and FortiAnalyzer Cloud (April 2026)
Fortinet has published PSIRT advisories for four vulnerabilities across its products. Two critical flaws in FortiSandbox allow unauthenticated attackers to achieve remote code execution and authentication bypass with privilege escalation...
CVE-2009-0238: 2009 Vulnerability Now Actively Exploited (Microsoft)
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that in...
CVE-2026-26149: Security feature bypass in Microsoft Power Apps
Improper neutralization of escape, meta, or control sequences in Microsoft Power Apps allows an authorized attacker to bypass a security feature over a network....
CVE-2026-27681: Critical SQL Injection Vulnerability in SAP Business Planning and Consolidation and SAP Business
Critical SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse allows data manipulation, service disruption, and potential system compromise. Affects versions HANABPC 810, BPC4HANA 300, SAP_BW 750-758, 816.
CVE-2026-33824: Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network....
CVE-2026-38526: Arbitrary file upload in Krayin Krayin CRM
An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to execute arbitrary code via uploading a crafted PHP file....
CVE-2026-39808: OS command injection in Fortinet FortiSandbox
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code ...
CVE-2026-39813: Path traversal in Fortinet FortiSandbox
A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via <insert attack vector here...
CVE-2026-5752: Sandbox escape via prototype chain in Terrarium
Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal....
CVE-2026-21643: Fortinet SQL Injection Vulnerability
Fortinet FortiClient EMS contains a SQL injection vulnerability that may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests....
CVE-2026-34621: Prototype pollution leading to RCE in Adobe Acrobat Reader
Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier are affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could res...
CVE-2026-33784: Default password in Juniper Networks Support Insights
A Use of Default Password vulnerability in the Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows an unauthenticated, network-based attacker to take full control o...
CVE-2026-34424: Backdoored Smart Slider 3 Pro plugin for WordPress
Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute ...
CVE-2026-6057: Arbitrary file upload in FalkorDB Browser
FalkorDB Browser 1.9.3 contains an unauthenticated path traversal vulnerability in the file upload API that allows remote attackers to write arbitrary files and achieve remote code execution....
CVE-2025-57735: JWT token reuse after logout in Apache Airflow
When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted. In Airflow 3.2 we implemented the mechanis...
CVE-2026-1340: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution....
CVE-2026-1346: Local privilege escalation to root in IBM Security Verify Access
IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Container 10.0 through 10.0.9.1 and IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Acces...
CVE-2026-25776: Perl code injection in Movable Type
Movable Type provided by Six Apart Ltd. contains a code injection vulnerability which may allow an attacker to execute arbitrary Perl script....
CVE-2026-3535: Arbitrary file upload in WordPress
The DSGVO Google Web Fonts GDPR plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the `DSGVOGWPdownloadGoogleFonts()` function in all versions up to, a...
CVE-2021-4473: Command injection in Tianxin Internet Behavior Management System
Tianxin Internet Behavior Management System contains a command injection vulnerability in the Reporter component endpoint that allows unauthenticated attackers to execute arbitrary commands by supplyi...
CVE-2026-0740: Arbitrary file upload in Ninja Forms File Uploads plugin for WordPress
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'NF_FU_AJAX_Controllers_Uploads::handle_upload' function in all v...
CVE-2026-22679: Unauthenticated RCE via Dubbo debug endpoint in Weaver E-cology
Weaver (Fanwei) E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows atta...
CVE-2026-23696: SQL injection in Windmill
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through th...
CVE-2026-4631: SSH command injection via login endpoint in Cockpit
Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization. An attacker with network access to the Cockpit ...
CVE-2018-25236: Authentication bypass in Hirschmann HiOS/HiSecOS management
Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthentica...
CVE-2018-25237: Buffer overflow in Hirschmann HiSecOS
Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled that allows remote attackers to crash th...
CVE-2021-4477: IPv6 IPsec firewall bypass in Hirschmann HiLCOS OpenBAT
Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers ...
CVE-2026-35616: Access control bypass in Fortinet Forticlientems
A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests....
CVE-2017-20237: Authentication bypass in Hirschmann Industrial HiVision
Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthenticated remote attackers to execute arbit...
CVE-2026-0545: Unauthenticated RCE via job endpoints in MLflow
In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. This vulnerability affects the lates...
CVE-2026-26135: SSRF in Microsoft Azure Custom Locations Resource Provider
Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network....
CVE-2026-32211: Missing authentication in Azure MCP Server
Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network....
CVE-2026-32213: Improper authorization in Azure AI Foundry
Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-33105: Improper authorization in Microsoft Azure Kubernetes Service
Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-33107: SSRF in Azure Databricks
Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network....
CVE-2026-2699: Unauthenticated configuration access in Citrix ShareFile Storage Zones Controller
Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages. This leads to changing system configuration and potential remote ...
CVE-2026-2701: Authenticated file upload RCE in Citrix ShareFile Storage Zones Controller
Authenticated user can upload a malicious file to the server and execute it, which leads to remote code execution....
CVE-2026-20093: Authentication bypass in Cisco Integrated Management Controller
A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authentication and gain access to the sys...
CVE-2026-20160: Unauthenticated command execution in Cisco Smart Software Manager On-Prem
A vulnerability in Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected SS...
CVE-2026-29014: Unauthenticated PHP code injection in MetInfo CMS
MetInfo CMS versions 7.9, 8.0, and 8.1 contain an unauthenticated PHP code injection vulnerability that allows remote attackers to execute arbitrary code by sending crafted requests with malicious PHP...
CVE-2026-5290: Use-after-free in Google Chrome
Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML pag...
CVE-2026-1579: Unauthenticated command execution via unsigned MAVLink in PX4 Autopilot
The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message -- including SERIAL_CONTROL, which provides ...
CVE-2026-33579: Privilege escalation in Openclaw
OpenClaw before 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privil...
CVE-2026-3300: PHP code injection RCE in Everest Forms Pro plugin for WordPress
The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's process_fi...
CVE-2026-4257: Remote code execution in WordPress
The Contact Form by Supsystic plugin for WordPress is vulnerable to Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in all versions up to, and including, 1.7.36. This is d...
CVE-2026-34714: Code execution via crafted file in Vim
Vim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr} injection occurs with tabpanel lacking P_MLE....
CVE-2026-22738: SpEL injection in Spring AI SimpleVectorStore
In Spring AI, a SpEL injection vulnerability exists in SimpleVectorStore when a user-supplied value is used as a filter expression key. A malicious actor could exploit this to execute arbitrary code. ...
CVE-2026-27876: Remote code execution in Grafana
A chained attack via SQL Expressions and a Grafana Enterprise plugin can lead to a remote arbitrary code execution impact (RCE). This is enabled by a feature in Grafana (OSS), so all users are always ...
CVE-2026-4809: Arbitrary file upload in Laravel
plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling....
CVE-2026-20688: Sandbox escape via path handling in Apple iOS/iPadOS
A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, visionOS 26.4. An app may be...
CVE-2026-28827: Sandbox escape via directory path parsing in Apple macOS
A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able t...
CVE-2026-28858: Critical Vulnerability in Apple iOS - Immediate Update Required
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.4 and iPadOS 26.4. A remote user may be able to cause unexpected system termination or corrupt kernel memor...
CVE-2026-33017: Langflow Code Injection Vulnerability
Langflow contains a code injection vulnerability that could allow building public flows without requiring authentication....
CVE-2026-4001: Critical Vulnerability in WordPress Woocommerce Custom Product Addons Pro - Immediate Update Required
The Woocommerce Custom Product Addons Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 5.4.1 via the custom pricing formula eval() in the process_c...
CVE-2026-3587: Critical Vulnerability in Embedded Device CLI - Immediate Update Required
An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface and gain root access to the underlying Linux based OS, leading to full compromise ...
CVE-2026-21992: Critical Vulnerability in Oracle Oracle Identity Manager - Immediate Update Required
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Servi...
CVE-2026-22732: Critical Vulnerability in VMware Spring Security - Immediate Update Required
When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP Headers will not be written. This issue affects Spring Security:...
CVE-2026-32194: Critical Vulnerability in Microsoft Bing Images - Immediate Update Required
Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network....
CVE-2026-20131: unauthenticated RCE as root in Cisco Secure Firewall Management Center (CVSS 10.0)
Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain a deserialization of untrusted data vulnerability in the web-based management ...
CVE-2026-22557: Critical Path Traversal in Ubiquiti UniFi Network (CVSS 10.0)
Critical Path Traversal vulnerability in Ubiquiti UniFi Network Application (CVSS 10.0) allows unauthenticated attackers to access OS files and achieve account takeover. Affects Dream Machine and all UniFi Network Application installations <= 10.1.85.
CVE-2026-27542: Critical Vulnerability in Woocommerce Wholesale Lead Capture - Immediate Update Required
Incorrect Privilege Assignment vulnerability in Rymera Web Co Pty Ltd. Woocommerce Wholesale Lead Capture allows Privilege Escalation.This issue affects Woocommerce Wholesale Lead Capture: from n/a th...
CVE-2026-28363: tools.exec.safeBins validation bypass in OpenClaw
In OpenClaw before 2026.2.23, tools.exec.safeBins validation for sort could be bypassed via GNU long-option abbreviations (such as --compress-prog) in allowlist mode, leading to approval-free executio...
CVE-2026-20127: Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass Vulnerability
Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, contain an authentication bypass vulnerability could allow an unauthenticated, rem...
CVE-2026-26980: Unauthenticated database read in Ghost CMS
Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1....
CVE-2026-22769: Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability
Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlyin...
CVE-2026-1731: BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection Vulnerability
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA)contain an OS command injection vulnerability. Successful exploitation could allow an unauthenticated remote attacker to execute opera...
CVE-2026-24423: SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability
SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a mali...
CVE-2026-1281: Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution....
CVE-2026-24858: Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel Vulnerability
Fortinet FortiAnalyzer, FortiManager, FortiOS, and FortiProxy contain an authentication bypass using an alternate path or channel that could allow an attacker with a FortiCloud account and a registere...
CVE-2026-23760: SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability
SmarterTools SmarterMail contains an authentication bypass using an alternate path or channel vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and ...
CVE-2026-24061: GNU InetUtils Argument Injection Vulnerability
GNU InetUtils contains an argument injection vulnerability in telnetd that could allow for remote authentication bypass via a "-f root" value for the USER environment variable....
CVE-2025-15036: Path traversal in MLflow extract_archive_to_dir
A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow repository. This vulnerability, present ...
CVE-2025-15379: Command injection in MLflow model serving
A command injection vulnerability exists in MLflow's model serving container initialization code, specifically in the `_install_model_dependencies_to_env()` function. When deploying a model with `env_...
CVE-2025-53521: F5 BIG-IP Unspecified Vulnerability
F5 BIG-IP AMP contains an unspecified vulnerability that could allow a threat actor to achieve remote code execution....
CVE-2025-71275: Critical Vulnerability in Zimbra Zimbra Collaboration Suite - Immediate Update Required
Zimbra Collaboration Suite (ZCS) PostJournal service version 8.8.15 contains a command injection vulnerability that allows unauthenticated attackers to execute arbitrary system commands by exploiting ...
CVE-2025-32432: High-Risk Craft CMS Vulnerability (EPSS: 79%)
Craft CMS contains a code injection vulnerability that allows a remote attacker to execute arbitrary code....
CVE-2025-54068: Laravel Livewire Code Injection Vulnerability
Laravel Livewire contain a code injection vulnerability that could allow unauthenticated attackers to achieve remote command execution in specific scenarios....
CVE-2025-68613: High-Risk n8n Vulnerability (EPSS: 79%)
n8n contains an improper control of dynamically managed code resources vulnerability in its workflow expression evaluation system that allows for remote code execution....
CVE-2025-26399: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds Web Help Desk contain a deserialization of untrusted data vulnerability in AjaxProxy that could allow an attacker to run commands on the host machine....
CVE-2025-40538: Access control bypass in Solarwinds Serv-U
A broken access control vulnerability exists in Serv-U which when exploited, gives a malicious actor the ability to create a system admin user and execute arbitrary code as a privileged account via do...
CVE-2025-40539: Type confusion leading to RCE in SolarWinds Serv-U
Security Alert - CVE-2025-40539 (Solarwinds Serv-U). CVSS: 9.1 (critical). EPSS: 0%.
CVE-2025-40540: Type confusion leading to RCE in SolarWinds Serv-U
Security Alert - CVE-2025-40540 (Solarwinds Serv-U). CVSS: 9.1 (critical). EPSS: 0%.
CVE-2025-40541: IDOR leading to RCE in SolarWinds Serv-U
Security Alert - CVE-2025-40541 (Solarwinds Serv-U). CVSS: 9.1 (critical). EPSS: 0%.
CVE-2025-49113: High-Risk Webmail Vulnerability (EPSS: 90%)
RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/a...
CVE-2025-13590: Remote code execution in Wso2 Api Control Plane
A malicious actor with administrative privileges can upload an arbitrary file to a user-controlled location within the deployment via a system REST API. Successful uploads may lead to remote code exec...
CVE-2025-11953: React Native Community CLI OS Command Injection Vulnerability
React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary ex...
CVE-2025-40551: SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability
SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This co...
CVE-2025-52691: SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability
SmarterTools SmarterMail contains an unrestricted upload of file with dangerous type vulnerability that could allow an unauthenticated attacker to upload arbitrary files to any location on the mail se...
CVE-2017-20229: Buffer overflow in Invisible Island Mawk
MAWK 1.3.3-17 and prior contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code by exploiting inadequate boundary checks on user-supplied input. Attackers ...
CVE-2018-25223: Buffer overflow in Ftnapps Crashmail Ii
Crashmail 1.6 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by sending malicious input to the application. Attackers can craft payloads wi...
CVE-2006-10003: Critical buffer overflow in Perl XML::Parser - Immediate Update Required
XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will ...
CVE-2017-7921: 2017 Vulnerability Now Actively Exploited (Hikvision)
Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information....
CVE-2021-22681: 2021 Vulnerability Now Actively Exploited (Rockwell)
Multiple Rockwell products contain an insufficient protected credentials vulnerability. Studio 5000 Logix Designer software may allow a key to be discovered. This key is used to verify Logix controlle...
CVE-2008-0015: 2008 Vulnerability Now Actively Exploited (Microsoft)
Microsoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the ...
CVE-2020-7796: 2020 Vulnerability Now Actively Exploited (Synacor)
Synacor Zimbra Collaboration Suite (ZCS) contains a server-side request forgery vulnerability if WebEx zimlet installed and zimlet JSP is enabled....
CVE-2024-43468: 2024 Vulnerability Now Actively Exploited (Microsoft)
Microsoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment wh...
CVE-2019-19006: 2019 Vulnerability Now Actively Exploited (Sangoma)
Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin....