511 of 511 advisories
FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path, which does not validate the MIC offset in a crafted AUTHENTICATE_MESSAGE. CVSS 4.0 8.3 (CVSS 3.1 7.4).
phpMyFAQ from 3.2.0-alpha before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks, including on administrator accounts. CVSS 3.1 8.1.
phpMyFAQ before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, does not require the current password when changing an account email, so an attacker with a hijacked session can point the account at their own mailbox and take it over through password reset, including superadmin accounts. CVSS 3.1 8.3.
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption flaw in its unauthenticated faqs and search API endpoints, which load all database records into memory and can be flooded to exhaust CPU and memory. CVSS 4.0 8.7 (CVSS 3.1 7.5).
phpMyFAQ before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, checks only the global edit_faq permission on the FAQ update endpoint, so authenticated editors can modify restricted FAQs they cannot view, bypass moderation, and change publication state. CVSS 3.1 8.3.
phpMyFAQ before 4.1.9 has a missing authorization flaw in the deleteUser API that lets authenticated non-superadmin users holding delete_user permission delete superadmin accounts, removing administrative access and accountability. CVSS 3.1 8.1.
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass in its WebAuthn registration endpoints that lets an unauthenticated attacker register a passkey on any account and log in, bypassing passwords and TOTP. CVSS 3.1 9.8.
Fleet before 4.89.0 contains an unbounded recursion flaw in Apple MDM enrollment property list parsing, so an unauthenticated attacker can crash the server with a crafted binary plist payload of about 150 bytes. CVSS 4.0 8.7 (CVSS 3.1 7.5).
Fleet before 4.83.0 contains a denial of service flaw in gzip-compressed request handling, so unauthenticated attackers can send small, highly compressed bodies that expand during decoding and crash the whole Fleet instance. CVSS 4.0 8.7 (CVSS 3.1 7.5).
Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 trusts any domain that is a string prefix of a workspace-proxy access URL, so an attacker can capture a redirected application_connect API key and replay it against the victim workspace. CVSS 4.0 8.7 (CVSS 3.1 7.7).
FreeRDP servers from 3.0.0 before 3.32.0 grow an unbounded receive buffer when a pre-authentication client streams bytes that are not a valid NLA frame. CVSS 4.0 8.7.
FreeRDP clients on macOS and iOS before 3.32.0 compute an audio buffer size in 32-bit arithmetic, so a malicious RDP server can wrap the size and trigger a heap out-of-bounds write. CVSS 3.1 8.8.
FreeRDP clients before 3.32.0 write one row past the destination planes when combining AVC444 video frames with an odd height, giving a malicious server a heap out-of-bounds write. CVSS 3.1 8.8.
Frappe HRMS before 14.38.2, 15.64.0, and 16.18.0 leaves some endpoints open to SQL injection, letting any authenticated account, however low-privilege, extract sensitive database information. CVSS 4.0 8.3.
A heap-based buffer overflow in Microsoft Word lets an unauthenticated attacker execute code when a victim opens a crafted document. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word, tracked separately from its sibling October Word flaws, lets an attacker execute code via a crafted document. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows code execution when a crafted document is opened. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word enables remote code execution through a malicious document. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows code execution via a crafted document, and the vendor record covers Mac builds as well as Windows. Microsoft rates it CVSS 3.1 8.8.
A stack-based buffer overflow in Microsoft Word lets an attacker execute code when a crafted document is opened, on Windows and listed Mac builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows code execution through a malicious document across the listed Windows and Mac Office builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word permits code execution via a crafted document. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows an attacker to execute code with a crafted document across Microsoft 365 Apps and LTSC builds, including Mac. Microsoft rates it CVSS 3.1 8.8.
A stack-based buffer overflow in Microsoft Word enables code execution through a crafted document on the listed Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word lets a crafted document execute code on affected Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
A use-after-free flaw in Microsoft Word allows code execution via a crafted document on affected Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
An off-by-one error in Microsoft Word allows an attacker to execute code through a crafted document on the listed Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
Microsoft disclosed a remote code execution vulnerability in Microsoft Office itself, tied to a heap-based buffer overflow, affecting 365 Apps and LTSC builds including Mac. Microsoft rates it CVSS 3.1 8.8.
A stack-based buffer overflow in Microsoft Word allows code execution via a crafted document on affected Windows and Mac builds. Microsoft rates it CVSS 3.1 8.8.
A use-after-free flaw in Microsoft Excel allows code execution via a crafted spreadsheet, and the vendor record also lists Office Online Server before 16.0.10417.20228 as affected. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word permits code execution through a crafted document on Microsoft 365 Apps and LTSC builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word allows code execution via a malicious document across the listed Windows and Mac Office builds. Microsoft rates it CVSS 3.1 8.8.
A heap-based buffer overflow in Microsoft Word, with a numeric truncation weakness also listed, allows code execution via a crafted document. Microsoft rates it CVSS 3.1 8.8.
A numeric truncation error in Microsoft Word allows an attacker to execute code through a crafted document on 365 Apps and LTSC builds. Microsoft rates it CVSS 3.1 8.8.
A path traversal flaw in Microsoft SharePoint Server Subscription Edition lets an authorized low-privilege attacker execute code over the network. Microsoft rates it CVSS 3.1 8.8.
The FreeRDP shadow server from 3.0.0 before 3.32.0 dispatches input before authentication, letting unauthenticated attackers inject keystrokes into a host session. CVSS 4.0 8.7.
GitPython before 3.2.0 has a regular expression denial of service in actor and date parsing that crafted commit or tag objects can trigger. CVSS 4.0 8.7.
GitPython from 3.1.30 before 3.2.0 checks unsafe pull options only in keyword arguments, letting a positional refspec carry an upload-pack option into command execution. CVSS 3.1 8.1, CVSS 4.0 9.2.
GitPython before 3.2.0 lets a branch name be parsed as a git option in Head.checkout, so a crafted repository can leak local file contents through error messages. CVSS 4.0 8.7.
Better Auth from 1.4.0-beta.18 before 1.7.7 reuses OAuth state values as magic link tokens, letting unauthenticated attackers sign in as other users. CVSS 3.1 9.1.
The Better Auth SSO package from 1.7.0-rc.2 before 1.7.3 lets an authenticated user register a personal SSO provider and sign in as another user. CVSS 3.1 8.1, CVSS 4.0 8.6.
Better Auth from 1.5.0-beta.12 before 1.7.7 has an OAuth Proxy authentication bypass when the proxy shares the global secret and cookie-stored state is used. CVSS 4.0 9.1.
Renovate before 44.60.1 lets a shared preset set restricted environment variables, which can affect child processes on self-hosted instances. CVSS 3.1 8.5, CVSS 4.0 9.0.
Renovate before 44.79.0 can be pointed at arbitrary internal URLs through presets or custom datasources, exposing internal services and cloud metadata. CVSS 3.1 8.5.
Nodemailer from 3.0.0 before 10.0.13 has a regular expression denial of service in EHLO handling that a malicious or intercepted SMTP server can trigger. CVSS 4.0 8.7.
An OS command injection flaw in pfSense CE 2.7.0 through 2.9.0 lets a user with QinQ edit privilege store a crafted parent interface name that is later interpolated into ifconfig shell commands, executing as root. The disclosure record rates it CVSS 4.0 8.6 (CVSS 3.1 7.2).
An OS command injection flaw in pfSense CE through 2.9.0 lets a user with gateway edit privilege place shell metacharacters in an IPv6 link-local zone index, which is passed unescaped into the dpinger monitoring command and runs as root. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
An OS command injection flaw in pfSense CE through 2.9.0 lets a user with Virtual IP edit privilege store a CARP VHID containing shell metacharacters, which executes through ifconfig calls or CARP status rendering. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
An OS command injection flaw in pfSense CE 2.4.5 through 2.9.0 lets a WebGUI user with Advanced Admin Access place newline or command-substitution payloads in sshguard settings, which are written to sshguard.conf and sourced as root on restart. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
A command injection flaw in pfSense CE 2.7.0 through 2.9.0 in captive portal high-availability sync handling lets a privileged user inject shell commands that reach pfctl operations. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
An authorization bypass in pfSense CE through 2.9.0 lets read-only WebGUI users replace config.xml because the restore and install paths ignore the deny-config-write privilege, leading to root-level code execution after reload or reboot. Rated CVSS 4.0 8.6 (CVSS 3.1 7.2).
A Jinja2 template injection flaw in Ansible Operator Plugins lets a low-privileged Kubernetes user run code inside the operator pod through crafted custom resource values, taking over its service account. Red Hat rates it CVSS 3.1 8.5.
A flaw in the DPDK GSO library: when software GSO copies packet headers into a new mbuf it does not check that the header fits in the source first segment or the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation, so a remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write. Red Hat rates it CVSS 3.1 8.6.
A heap-based buffer overflow in eventd on Junos OS and Junos OS Evolved lets an unprivileged local attacker cause a denial of service or escalate privileges to root with crafted IPC event messages. Juniper rates it CVSS 4.0 8.6 (CVSS 3.1 7.8).
A NULL pointer dereference in the routing protocol daemon (RPD) of Junos OS and Junos OS Evolved lets a configured peer sending a BGP UPDATE cause a denial of service when an import policy with source-based-forwarding next-hop next-table references a routing table that does not exist. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A NULL pointer dereference in the rpd routing daemon of Junos OS and Junos OS Evolved lets an unauthenticated configured BGP peer cause a denial of service via a BGP UPDATE when ISO-VPN and egress-protection configuration is enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A NULL pointer dereference in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured BGP neighbor cause a denial of service via a BGP route update when specific routing-policy resolution-map and policy event-tracing configuration is enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An improper handling of length parameter inconsistency vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an unauthenticated network attacker cause a denial of service via a malformed EVPN Type-3 or Type-4 route received from a configured EVPN peer and processed during re-advertisement. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An improper input validation vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an unauthenticated network attacker cause a denial of service via a crafted BGP EVPN update message. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An integer overflow or wraparound vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an attacker cause a denial of service via specially crafted EVPN route updates from an accepted EVPN BGP peer. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An integer overflow or wraparound vulnerability in the rpd process of Junos OS and Junos OS Evolved lets a remote attacker with an established EVPN BGP peering relationship cause a denial of service via EVPN BGP route processing, disrupting control-plane adjacencies on EVPN-enabled routing instances. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A heap-based buffer overflow in the Secure Vector Routing (SVR) component of Junos OS on SRX Series lets an unauthenticated network attacker cause a denial of service and potentially compromise confidentiality and integrity with malformed IPv4 packets. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
An improper authentication vulnerability in the J-Web management interface and its NETCONF session handling in Junos OS and Junos OS Evolved lets an unauthenticated network attacker obtain root-level device configuration access via a reachable J-Web service when web management is enabled. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
A stack-based buffer overflow in the UTM Anti-Spam SBL of Junos OS on SRX Series lets an unauthenticated remote attacker execute arbitrary code or deny service with a malformed DNS packet when Anti-Spam SBL inspection is enabled. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an unauthenticated adjacent LDP peer crash rpd or execute arbitrary code with a malformed LDP Label Mapping message. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured BGP/EVPN peer execute root code on Junos OS, or crash rpd on Junos OS Evolved, via protocol-valid route advertisements for an EVPN-VPWS service. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
A stack-based buffer overflow in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured BGP peer crash rpd, or execute code on Junos OS, with a flow-spec update that is selected for re-advertisement. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
An SQL injection vulnerability in ipfd on Junos OS SRX Series lets an unauthenticated network attacker execute code with root privileges through a configured Security Intelligence feed connection. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A reachable assertion vulnerability in the na-grpcd process of Junos OS Evolved lets a remote unauthenticated attacker cause a denial of service via a gRPC telemetry subscription request. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A stack-based buffer overflow in the authd process of Junos OS lets an attacker able to influence a configured RADIUS server crash authd or execute code with root privileges through a malicious RADIUS response. Juniper rates it CVSS 3.1 8.8.
A heap-based buffer overflow in the secure-dot1xd process of Junos OS and Junos OS Evolved lets an unauthenticated adjacent network attacker execute code as root or deny service with an EAPOL frame sent to an 802.1X-authenticated interface. Juniper rates it CVSS 3.1 8.8.
An improper validation of specified quantity in input vulnerability in the rpd process of Junos OS and Junos OS Evolved lets a configured BGP MVPN peer cause a denial of service via a BGP MVPN signaling update. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A reachable assertion vulnerability in the rpd process of Junos OS and Junos OS Evolved lets an authenticated network-based attacker cause a denial of service via BGP-LS routing updates. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A reachable assertion vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an attacker with access to a configured BGP-LS peer cause an rpd crash via crafted BGP-LS Link NLRI advertisements. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A reachable assertion vulnerability in fwstatsd of Junos OS Evolved lets an authenticated network attacker cause a denial of service via an SNMP firewall-counter MIB query when at least one firewall counter is configured. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An integer overflow or wraparound vulnerability in the routing daemon (rpd) of Junos OS and Junos OS Evolved lets an authenticated BGP peer cause a denial of service via BGP route updates when extended-nexthop-tunnel is enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A mismatched memory management routines vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an authenticated network attacker cause a denial of service via a BGP route update when extended next-hop tunneling and SRv6 service processing are used. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An improper control of a resource through its lifetime vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an adjacent eBGP peer cause a routing-daemon crash via a BGP route update when RIB sharding is enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An incorrect calculation of buffer size vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a configured eBGP neighbor cause an rpd crash via BGP labeled-unicast UPDATEs when the affected multipath features are enabled. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A NULL pointer dereference vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets a remote BGP peer cause a denial of service when multiple UPDATEs occur over a single TCP session with bgp family l2vpn auto-discovery-only configured. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
A NULL pointer dereference vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an unauthenticated configured MSDP peer or adjacent PIM sender cause a denial of service via an MSDP or PIM policy that uses AS-path expansion. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An incomplete cleanup vulnerability in the rpd process of Junos OS and Junos OS Evolved lets a configured MVPN neighbor cause a denial of service via a BGP MVPN update when an inter-region segmented VRF with protocols mvpn inter-region-template is configured. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An OS command injection vulnerability in TACACS handling on Junos OS Evolved lets a low-privileged TACACS+-authenticated user execute commands with root privileges when periodic TACACS+ authorization-refresh is enabled. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
An XML injection vulnerability in the Unified Threat Management daemon (utmd) of Junos OS on SRX Series lets an unauthenticated network attacker commit arbitrary device configuration with root privileges through a malicious response from a configured custom URL-feed server. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A stack-based buffer overflow in the l2cpd process of Junos OS and Junos OS Evolved lets an adjacent unauthenticated attacker deny service or execute arbitrary code with root privileges via LLDP traffic received on an interface with Unified Access Policy enabled. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the l2cpd daemon of Junos OS and Junos OS Evolved lets an unauthenticated adjacent attacker deny service in Layer 2 control-plane processing via LLDP packets received on an interface configured for LLDP, with repeated triggering disrupting LLDP and other Layer 2 protocols device-wide. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the jdhcpd process of Junos OS and Junos OS Evolved lets an adjacent unauthenticated attacker deny service or execute arbitrary code with root privileges via a malformed DHCPv4 server response when the DHCPv4 local-client feature is used. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the cfmd process of Junos OS on MX Series and Junos OS Evolved on PTX Series lets an unauthenticated adjacent-network attacker execute arbitrary code as root or deny service via a specific CFM message sent to a configured down-MEP with enhanced CFM mode enabled. Juniper rates it CVSS 3.1 8.8.
An OS command injection vulnerability in the phone-home daemon (phcd) of Junos OS and Junos OS Evolved on EX, SRX, and QFX Series lets an adjacent unauthenticated attacker execute arbitrary commands with root privileges via a rogue DHCP server. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the phone-home daemon (phcd) of Junos OS and Junos OS Evolved lets an adjacent unauthenticated attacker execute arbitrary code as root via a crafted DHCP SZTP bootstrap message, on platforms that support Secure-ZTP. Juniper rates it CVSS 3.1 8.8.
A use of externally-controlled format string vulnerability in the ipfd daemon of Junos OS on SRX Series lets an unauthenticated network attacker execute code with root privileges via a compromised or impersonated configured HTTPS feed server. Juniper rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A reachable assertion vulnerability in the routing protocol daemon (rpd) of Junos OS and Junos OS Evolved lets an attacker cause an rpd crash via malformed BGP MCAST-VPN updates from a configured eBGP peer. Juniper rates it CVSS 4.0 8.7 (CVSS 3.1 7.5).
An OS command injection vulnerability in the Junos OS CLI lets a local low-privileged attacker take complete control of the device: a specific request csds command does not sanitize user input, so it can be interpreted as a command and executed with root privileges. Juniper rates it CVSS 4.0 8.5 (CVSS 3.1 7.8), affecting MX Series releases from 24.4.
A stack-based buffer overflow in the iked IKE key-management daemon of Junos OS on SRX Series lets an authenticated remote-access VPN client execute code with root privileges or deny service via the remote-access VPN authentication and JIMS identity-publishing path. Juniper rates it CVSS 3.1 8.8.
A heap-based buffer overflow in the sdxd service-deployment daemon of Junos OS and Junos OS Evolved lets a remote unauthenticated attacker who can control or intercept the configured SDX/SRC server connection execute code as root or cause a denial of service with a crafted frame. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
A buffer copy without checking the size of input vulnerability in the SDK service process of Junos OS lets an unauthenticated network attacker deny service or compromise the Routing Engine by sending specific packets when the SDK service and a JDAF routing instance are enabled. Juniper rates it CVSS 3.1 8.8.
A stack-based buffer overflow in the BGP routing daemon of Junos OS and Junos OS Evolved lets a configured BGP flowspec peer compromise the routing engine or deny service via flowspec route re-advertisement when BGP update-threading is enabled. Juniper rates it CVSS 3.1 9.8 (CVSS 4.0 9.3).
NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress: it may mishandle the HTTP response from an OAuth IdP and allow an attacker to acquire unauthenticated access to protected paths before proper external authentication can happen. F5 rates it CVSS 4.0 8.7 (CVSS 3.1 7.5), affecting the 5.6.0 line before 5.7.0.
A vulnerability exists in NGINX Plus and NGINX Open Source when a location uses the alias directive together with rewrite and a set or return directive referencing the request_filename variable, or when that variable is used in an access log format: crafted HTTP requests can cause a heap buffer overflow in the worker process, restarting it, and can execute code where ASLR is disabled or bypassed. F5 rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
A flaw in DPDK lib/vhost: the VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap that a local low-privilege attacker can turn into code execution with changed scope. Red Hat rates it CVSS 3.1 8.8.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. Microsoft rates CVE-2026-88164 CVSS 3.1 8.8 for SharePoint Server Subscription Edition before 16.0.20326.20190.
NGINX Gateway Fabric renders the realm fields of a namespaced AuthenticationFilter verbatim into the shared data-plane nginx.conf, so a namespaced authenticated attacker can craft a realm value that injects arbitrary NGINX directives into that Gateway's data-plane config, potentially reading co-located tenants' mounted secrets, SSRF via proxy_pass, the pod ServiceAccount token, or hijacking other tenants' routes. F5 rates it CVSS 3.1 8.8, affecting 2.4.0 before 2.8.0.
A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before referencing the map output variable: crafted HTTP requests can cause a heap buffer overflow in the worker process, restarting it, and possibly code execution where ASLR is disabled or bypassed. F5 rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
An authentication and authorization bypass exists in F5 NGINX Kubernetes Ingress Controller when configured with the ExternalAuth policy or Ingress external authentication: client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal authentication subrequest, so an unauthenticated remote attacker may spoof request attributes the external authentication provider evaluates and reach protected paths. F5 rates it CVSS 4.0 8.7 (CVSS 3.1 7.5), affecting 5.5.0 before 5.7.0.
NGINX Plus and NGINX Open Source have a vulnerability in ngx_http_core_module: when asynchronous file I/O is enabled in certain configurations, processing a Server Side Includes page containing include virtual commands may trigger a use-after-free in the worker process, causing memory corruption or a crash, and possibly code execution where ASLR is disabled or bypassed. F5 rates it CVSS 3.1 8.1 (CVSS 4.0 9.2).
Frappe before 14.81.4 and 15.x before 15.41.0 has an improper privilege management flaw in a document action that lets a Website User escalate to System Manager. CVSS 3.1 8.8.
Adobe Commerce has a stored script injection flaw: an attacker can plant JavaScript in a form field and have it run in the browser of whoever views the page, with changed scope. Adobe rates it CVSS 3.1 9.3.
Microsoft Message Queuing (MSMQ) has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Microsoft Office Excel has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Excel has a use after free flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Excel has a use after free flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Dynamics NAV 2017 and 2018 (Business Central's predecessors) deserialize untrusted data in a way an authorized low-privilege attacker can use to execute code over the network. Microsoft rates it CVSS 3.1 8.8.
The Windows Remote Desktop Gateway service has a use-after-free flaw an unauthenticated attacker can use over the network to execute code. Microsoft rates it CVSS 3.1 8.1.
Microsoft's QUIC implementation has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code on Windows 11 and recent Windows Server releases. Microsoft rates it CVSS 3.1 9.8.
The Windows media video decoder has a heap-based buffer overflow a remote attacker can use to execute code when a victim interacts with crafted media. Microsoft rates it CVSS 3.1 8.8.
Windows Network Policy Server (NPS) has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Windows RPC Runtime has a type confusion flaw a remote attacker can use to execute code when a victim interacts. Microsoft rates it CVSS 3.1 8.8.
The Windows Text Shaping component has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Windows Hyper-V has a use-after-free flaw an authorized local attacker can use to execute code with changed scope. Microsoft rates it CVSS 3.1 8.8.
Windows WebDAV improperly resolves path equivalence, which an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Windows Text Shaping has an out-of-bounds read a remote attacker can use to execute code when a victim interacts with crafted content. Microsoft rates it CVSS 3.1 8.8.
Microsoft Dynamics NAV has a path traversal flaw an authorized low-privilege attacker can use over the network to affect files or data. Microsoft rates it CVSS 3.1 8.8.
Visual Studio Code does not properly confine pathnames to a restricted directory, and Microsoft says an unauthorized attacker can use that to execute code over a network when a user interacts. Microsoft rates it CVSS 3.1 9.6.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 improperly validates file paths during archive extraction, letting an authenticated attacker execute arbitrary code. IBM rates it CVSS 3.1 8.8.
Microsoft Office Access has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Access has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Visio has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office Visio has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft Office OneNote has a heap-based buffer overflow flaw a remote attacker can use to execute code when a user opens a crafted file. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server has a improper access control flaw an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server has a missing authorization flaw an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server has a incorrect authorization flaw an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server has a code injection flaw an authorized attacker can use to elevate privileges over the network. Microsoft rates it CVSS 3.1 8.8.
Microsoft SharePoint Server does not properly verify cryptographic signatures, which an unauthenticated attacker can use to affect data over the network. Microsoft rates it CVSS 3.1 8.1.
A type confusion flaw spanning .NET Framework and Visual Studio can let a remote attacker elevate privileges when a victim interacts. Microsoft rates it CVSS 3.1 8.8.
ASP.NET Core has a code injection flaw in the WebAssembly server component that a remote attacker can use to execute code when a victim interacts. Microsoft rates it CVSS 3.1 8.8.
Visual Studio Tools for Applications has a code injection flaw a remote attacker can use to execute code when a victim interacts with crafted content. Microsoft rates it CVSS 3.1 8.8.
The Windows Remote Desktop Client has a use-after-free flaw a remote attacker can use to execute code when a victim connects or interacts. Microsoft rates it CVSS 3.1 8.8.
Adobe Experience Manager does not neutralize special elements in operating system commands, so a low-privileged attacker can execute arbitrary commands with changed scope. Adobe rates it CVSS 3.1 9.9.
Adobe Commerce does not safely neutralize special elements used by its template engine, and an unauthenticated attacker can turn that into arbitrary code execution with changed scope. Adobe rates it CVSS 3.1 10.0.
The Microsoft Windows Search Component has a use-after-free flaw Microsoft describes as letting an unauthorized attacker elevate privileges over a network. Microsoft rates it CVSS 3.1 9.8.
Microsoft QUIC has a heap-based buffer overflow an unauthenticated attacker can trigger over the network; the affected list spans Windows, .NET 8 through 11, and Visual Studio. Microsoft rates it CVSS 3.1 9.8.
Adobe Experience Manager improperly validates input in a path a low-privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.9.
ColdFusion lets an attacker upload a file of a dangerous type without adequate restriction, which can become arbitrary code execution with changed scope and no authentication. Adobe rates it CVSS 3.1 10.0.
ColdFusion improperly controls code generation, so a low-privileged attacker can inject code that the server executes with changed scope. Adobe rates it CVSS 3.1 9.9.
ColdFusion has an incorrect authorization vulnerability a low-privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.9.
ColdFusion improperly validates input in a path that can result in arbitrary code execution, though Adobe's vector requires high attack complexity. Adobe rates it CVSS 3.1 9.0.
ColdFusion has an incorrect authorization vulnerability a low-privileged attacker can use to bypass a security feature, with high confidentiality and integrity impact. Adobe rates it CVSS 3.1 9.6.
ColdFusion improperly controls code generation in a path an unauthenticated attacker can use to execute arbitrary code. Adobe rates it CVSS 3.1 9.1.
ColdFusion has a server-side request forgery vulnerability Adobe says can result in privilege escalation, reachable without authentication or user interaction. Adobe rates it CVSS 3.1 10.0.
ColdFusion has a further code generation flaw in APSB26-144 that an unauthenticated attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 10.0.
Adobe Experience Manager has an improper input validation flaw a highly privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.1.
Adobe Experience Manager has a stored script injection flaw: an attacker's JavaScript can be saved and later run in a victim's browser with changed scope. Adobe rates it CVSS 3.1 9.3.
Adobe Experience Manager has a second stored script injection flaw in the same bulletin, also rated 9.3 with changed scope. Adobe rates it CVSS 3.1 9.3.
phpMyFAQ before 4.1.9 has an SQL injection flaw in its autocomplete escaping that unauthenticated attackers can reach through the search parameter when the database runs in NO_BACKSLASH_ESCAPES mode, exposing credentials and configuration secrets. CVSS 3.1 8.1, CVSS 4.0 9.2.
ERPNext before 15.121.0 and 16.x before 16.34.0 has SQL injection in several endpoints lacking input validation, letting any authenticated user read sensitive information and escalate to a privileged account. CVSS 3.1 8.8.
ERPNext before 15.119.1 and 16.x before 16.32.0 does not validate user-controlled message fields before template rendering, letting an authenticated attacker run expressions that read and write arbitrary database data. CVSS 3.1 8.8.
ERPNext before 15.111.0 and 16.x before 16.22.0 has a record-creation endpoint that inserts records with permission checks disabled, letting any authenticated user create privileged accounts and take full control. CVSS 3.1 8.8.
FreeRDP 3.0.0-beta1 through the releases before 3.32.0 have a use-after-free flaw in smartcard handling that a remote attacker can use to corrupt memory or crash the client. The project rates it CVSS 3.1 8.8.
NLTK through 3.10.3 does not validate WekaClassifier model paths well enough, so a crafted model path can escape its containment and write or probe files outside the allowed roots. VulnCheck rates it CVSS 4.0 8.3 (CVSS 3.1 7.0).
IBM Planning Analytics 2.0 and 2.1 has an improper authentication flaw that could let a remote attacker gain unauthorized administrative access. IBM rates it CVSS 3.1 8.8.
IBM Planning Analytics 2.0 and 2.1 improperly validates sub-requests, letting a remote attacker bypass authentication and escalate privileges. IBM rates it CVSS 3.1 8.8.
IBM Planning Analytics 2.0 and 2.1 improperly validates file paths, letting a remote attacker read arbitrary host files and overwrite certain application files without authentication. IBM rates it CVSS 3.1 8.2.
Adobe Experience Manager checks authorization incorrectly in a path an unauthenticated attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 10.0.
Adobe Experience Manager has another incorrect authorization vulnerability in the same bulletin that can be used by an unauthenticated attacker to execute arbitrary code. Adobe rates it CVSS 3.1 10.0.
The Windows iSCSI component has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Libarchive component bundled with Windows has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Windows iSCSI has an out-of-bounds write an unauthenticated attacker can trigger over the network to execute code, separate from the other iSCSI flaws in this month's updates. Microsoft rates it CVSS 3.1 9.8.
Windows iSCSI has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Windows Imaging Component has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Windows Internet Information Services (IIS) has a stack-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Windows Rich Text Edit Control has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Microsoft PostScript Printer Driver has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
The Microsoft PostScript Printer Driver has a second heap-based buffer overflow in the same month's updates, also allowing unauthenticated network code execution. Microsoft rates it CVSS 3.1 9.8.
The Windows System Information Console has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Microsoft Exchange Server has an input neutralization flaw during web page generation: script an attacker plants can run in a victim's browser with changed scope. Microsoft rates it CVSS 3.1 9.3.
Wazuh manager 4.1.0 through the releases before 4.14.8 do not check the origin of agent upgrade commands properly, so an enrolled agent may be able to read arbitrary files as root. VulnCheck rates it CVSS 4.0 8.7.
Wazuh agent 4.3.0 through the releases before 4.14.8 trust SCA policy files by path, so whoever controls the manager side may be able to run unsigned policy commands as root on agents. VulnCheck rates it CVSS 4.0 8.6.
Wazuh manager 4.0.0 through the releases before 4.14.8 did not properly invalidate revoked run_as tokens, so a former administrator's token may keep working. VulnCheck rates it CVSS 4.0 8.6.
Wazuh 3.9.0 through the releases before 4.14.8 let a cluster worker overwrite protected manager files such as ossec.conf, which can become root code execution across the manager and its agents. The project rates it CVSS 3.1 9.1.
Wazuh 4.14.3 through the releases before 4.14.8 validate remote commands case-sensitively in one component and not in another, so an authenticated manager user can smuggle a command entry that logcollector later runs as root. CVSS 3.1 9.1.
Adobe Experience Manager has an incorrect authorization vulnerability a low-privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.9.
ColdFusion has an incorrect authorization vulnerability that could result in arbitrary code execution, exploitable from an adjacent network without authentication. Adobe rates it CVSS 3.1 9.6.
IBM DataStage on Cloud Pak for Data 5.4.0.0 does not properly neutralize special elements in OS commands, letting an authenticated attacker execute arbitrary commands. IBM rates it CVSS 3.1 8.8.
IBM DataStage on Cloud Pak for Data 5.4.0.0 lets an authenticated remote attacker use a path traversal flaw to cause a denial of service. IBM rates it CVSS 3.1 9.6.
IBM DataStage on Cloud Pak for Data 5.4.0.0 exposes sensitive information to unauthorized actors, letting an authenticated attacker read data they should not see. IBM rates it CVSS 3.1 9.6.
IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly neutralizes special elements, letting an authenticated remote attacker execute arbitrary code. IBM rates it CVSS 3.1 8.8.
IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly validates pathnames, letting an authenticated remote attacker execute arbitrary code. IBM rates it CVSS 3.1 9.6.
Adobe Experience Manager has a reflected script injection flaw: an attacker can craft input that AEM reflects into a page so script runs in a victim's browser. Adobe rates it CVSS 3.1 9.3.
IBM Planning Analytics 2.0 and 2.1 has a stack-based buffer overflow that an authenticated remote attacker can use to execute arbitrary code. IBM rates it CVSS 3.1 8.1.
Windows Schannel improperly verifies cryptographic signatures, a flaw Microsoft scores 9.0 with changed scope that an unauthenticated attacker can use over a network. Microsoft rates it CVSS 3.1 9.0.
SAP S/4HANA's Manage Substitution/Validation Rules does not sufficiently validate input for its domain-specific scripting language, letting an authenticated attacker get input interpreted as ABAP code and fully compromise the system. SAP rates it CVSS 3.1 9.9.
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries in administrative functionality, letting an MII administrator provision an elevated account on the underlying Java application server. SAP rates it CVSS 3.1 9.1.
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in portal functionality, letting a low-privileged attacker invoke internal operations on a preconfigured remote system, up to full compromise of that system. SAP rates it CVSS 3.1 9.9.
SAP Commerce Cloud does not sufficiently validate user input before it reaches a database query, letting an authenticated user inject arbitrary SQL and read, modify, or delete sensitive data. SAP rates it CVSS 3.1 8.8.
ColdFusion Remote Development Services (RDS) improperly limits pathnames, which Adobe says could lead to arbitrary file system read and write. Adobe rates it CVSS 3.1 9.3.
Adobe Experience Manager has a further incorrect authorization vulnerability in APSB26-152 that an unauthenticated attacker can use to execute arbitrary code. Adobe rates it CVSS 3.1 10.0.
Adobe Commerce has another stored script injection flaw in the same bulletin: script saved by an attacker runs for later page viewers with changed scope. Adobe rates it CVSS 3.1 9.3.
Adobe Commerce improperly validates input in a path a highly privileged attacker can use to execute arbitrary code with changed scope. Adobe rates it CVSS 3.1 9.1.
Adobe Commerce checks authorization incorrectly in a path an unauthenticated attacker can use to execute arbitrary code. Adobe rates it CVSS 3.1 9.8.
IBM i 7.3 through 7.6 does not properly validate user-supplied input, letting an authenticated attacker execute arbitrary script code. IBM rates it CVSS 3.1 8.3.
IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 exposes session tokens in HTML responses, letting an authenticated attacker obtain sensitive information. IBM rates it CVSS 3.1 8.1.
IBM WebSphere Application Server Liberty 20.0.0.12 through 26.0.0.10 can let an unauthenticated remote attacker bypass access controls configured on gRPC service methods. IBM rates it CVSS 3.1 9.1.
IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 has an authentication bypass when the samlWeb-2.0 feature is enabled. IBM rates it CVSS 3.1 9.1.
IBM WebSphere Application Server 8.5 and 9.0 have an improper authentication weakness an authenticated attacker can use to bypass authorization and impersonate an administrator across the cell. IBM rates it CVSS 3.1 8.0.
The Windows DNS Server service has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
IBM i 7.3 through 7.6 has an improper data sanitization flaw in the HTTP Server Administration web application that can let an authenticated attacker read sensitive information or execute arbitrary code. IBM rates it CVSS 3.1 9.9.
Microsoft Office Outlook has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code, affecting Microsoft 365 Apps and Office LTSC lines. Microsoft rates it CVSS 3.1 9.8.
The Windows Partition Management Driver has an out-of-bounds read Microsoft scores 9.8, describing it as allowing an unauthorized attacker to execute code over a network. Microsoft rates it CVSS 3.1 9.8.
Windows Text Shaping has a second heap-based buffer overflow this month, also allowing unauthenticated network code execution. Microsoft rates it CVSS 3.1 9.8.
Windows Error Reporting has a heap-based buffer overflow an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
OpenSSH for Windows has a use-after-free flaw an unauthenticated attacker can trigger over the network to execute code. Microsoft rates it CVSS 3.1 9.8.
Non-admin Crawl4AI API clients can wrap forbidden configuration objects in dictionary wrappers to defeat the untrusted-config gate, read the server SECRET_KEY and provider keys through the config dump, and forge admin tokens. Fixed in 0.9.4.
Unauthenticated Crawl4AI API clients can enable link preview on crawl requests so the URL seeder fetches internal, private, and cloud metadata links from a controlled page and returns their parsed head data. Fixed in 0.9.4.
Any website can post unvalidated messages to Open WebUI's SyncStatsModal, redirect an authenticated stats export to the authentication endpoint with a traversal chat id, and receive the signed-in user's JWT for full API access. Fixed in 0.11.4.
Non-admin Craft CMS users with the System Messages permission can escape the Twig sandbox through the has some and has every operators, invoking PHP callables to execute code as the web server user. Fixed in Craft CMS 5.10.14.
Authenticated Craft CMS control panel users with the performUpdates permission can inject behavior configuration through the raw updates parameter of the cache-updates action and execute arbitrary code. Fixed in 4.18.7 and 5.10.14.
LibreNMS in LDAP or Active Directory authorization mode inserts usernames unescaped into LDAP search filters, so an unauthenticated attacker sending a wildcard username over HTTP Basic authentication can match all users and groups and gain admin access. Fixed in 26.9.0.
The hosted ZITADEL Login V1 change-username handler acts on the account bound to a login flow before any factor is verified, so an unauthenticated attacker can rename any active human user, including administrators, and lock them out. Fixed in 4.18.0.
The ZITADEL Login V2 UI accepts forged unsigned session cookies, so unauthenticated attackers who guess time-ordered session IDs can obtain rotated tokens and take over accounts, including MFA-completed administrator sessions. Fixed in 4.19.2.
Customizing a generated Quarkus REST Data Panache operation with @MethodProperties, without re-declaring security roles, drops the class-level security requirements and leaves the endpoint open to unauthenticated access.
An authenticated attacker can send a crafted request to IBM Db2 Mirror for i 7.4, 7.5, or 7.6 that bypasses authorization and input validation checks, executes malicious code, and gains elevated privileges.
Versions through 0.31.0 interpolate spec-controlled values into single-quoted string literals without escaping; a crafted spec can execute arbitrary JavaScript when a generated client is imported or a service method is called.
Azure SRE Agent had a missing authorization check that an authenticated attacker could abuse over the network to elevate privileges, rated critical at CVSS 9.6.
A missing authentication check on a critical function in Azure App Service for Linux let attackers run code over the network without any credentials, rated critical at CVSS 9.8.
Azure API Center exposed sensitive information to unauthorized actors over the network, rated high at CVSS 8.7 with changed scope and high confidentiality and integrity impact.
Microsoft Dataverse deserialized untrusted data without validating it, letting unauthenticated attackers execute code over the network, rated critical at CVSS 9.8.
An authorization bypass via a user-controlled key in Microsoft Bookings let unauthenticated attackers elevate privileges over the network, rated critical at CVSS 9.9.
Microsoft Partner Center did not properly validate certificates, letting unauthenticated attackers elevate privileges over the network, rated a perfect 10.0 on CVSS.
ILIAS lets question authors inject ImageMagick options through uploaded image filenames, allowing remote code execution on the server.
System Informer's privileged helper accepts connections from any Authenticode-signed process, letting local attackers reach SYSTEM-level APIs.
IBM DataPower Gateway can let a remote attacker in as an administrator with an empty password during LDAP authentication.
IBM DataPower Gateway can be tricked into reading attacker-defined external entities when processing XML data, exposing files or draining memory.
IBM DataPower Gateway is vulnerable to a remotely triggerable buffer overflow that can crash the appliance or worse.
A remote attacker can bypass security restrictions in IBM Security Verify Access due to improper authentication.
A remote authenticated attacker can execute arbitrary code on IBM Security Verify Access due to a protection mechanism failure.
An unauthenticated user can embed arbitrary JavaScript in the IBM Security Verify Access Web UI, potentially stealing credentials from trusted sessions.
A remote authenticated attacker can inject arguments in IBM Security Verify Access to perform unauthorized actions.
A remote authenticated attacker can execute arbitrary commands on IBM Security Verify Access through improper neutralization of command arguments.
A remote attacker can bypass authentication in IBM Security Verify Access due to improper authentication handling.
A remote authenticated attacker can bypass security restrictions in IBM Security Verify Access due to improper authentication.
IBM Security Verify Access deserializes untrusted data, letting a remote unauthenticated attacker execute arbitrary code on the system.
A second deserialization flaw in IBM Security Verify Access lets a remote unauthenticated attacker execute arbitrary code on the system.
A crafted TDS LOGIN7 packet can trigger a heap out-of-bounds read in IBM Guardium Data Protection, risking information disclosure or denial of service.
A crafted MongoDB SCRAM username with excessive length can corrupt memory in IBM Guardium Data Protection, risking denial of service or code execution.
Crafted TDS login fragments can overflow a fixed-size reassembly buffer in IBM Guardium Data Protection, risking denial of service or code execution.
An unauthenticated attacker who can influence monitored database traffic can plant a script that runs in the browser of an authenticated Guardium user.
IBM Guardium Data Protection 12.2 ships a hard-coded recovery key in its passkey component, letting a local attacker recover the root password.
IBM Guardium Data Protection 12.1 and 12.2.2 leave the edge-controller unauthenticated, so a remote attacker can execute arbitrary container images and take over managed edge clusters.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker read sensitive files through improper restriction of a pathname to its intended directory. IBM rates it high at CVSS 8.1.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote, unauthenticated attacker execute arbitrary code through an improperly constrained code generation path. IBM rates it critical at CVSS 9.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper access control. IBM rates it high at CVSS 8.8.
Candlepin in Red Hat Satellite 6 grants access when any one of several checked parameters is authorized instead of requiring all of them, letting a low-privilege authenticated attacker read and modify subscription resources across organizations. Red Hat rates it high at CVSS 8.1.
An unauthenticated attacker can abuse improper checks in the Cisco License On-Prem password reset process to reset the password of any account, including administrators.
Splunk Enterprise search head cluster members expose a Patroni REST API without authentication, letting remote attackers run OS commands. Fixed in 10.4.3 and 10.2.7.
Cisco's October 2026 NX-OS hardening release addresses internally found improper-neutralization vulnerabilities grouped under CVE-2026-76453, rated 8.8.
The Cisco Smart Licensing Utility API of Cisco License On-Prem lacks authentication and input validation, letting remote attackers write arbitrary files or cause denial of service.
Cisco's October 2026 NX-OS hardening release addresses internally found improper-handling-of-exceptional-conditions issues grouped under CVE-2026-76458, rated 8.6.
Cisco's October 2026 NX-OS hardening release addresses internally found out-of-bounds write issues grouped under CVE-2026-76459, with Cisco assigning a maximum CVSS of 9.8.
Cisco's October 2026 Meraki hardening release addresses internally found improper-input-validation issues grouped under CVE-2026-76468, rated 8.2.
Cisco's October 2026 Meraki hardening release addresses internally found improper-neutralization issues grouped under CVE-2026-76472, rated 8.8.
Cisco's October 2026 hardening release for Cisco License On-Prem addresses internally found missing-authentication vulnerabilities grouped under CVE-2026-76480, rated 9.8.
Improper input validation in the NGOAM feature of Cisco NX-OS Software lets an unauthenticated remote attacker execute arbitrary code with root privileges on Nexus 3000 and 9000 switches.
CVE-2026-76486 affects Nexus 3000/9000 switches with NGOAM plus SRv6 or NV Overlay enabled, allowing unauthenticated remote code execution with root privileges.
Cisco's October 2026 hardening release for Application Policy Infrastructure Controller addresses internally found improper-resource-control vulnerabilities grouped under CVE-2026-76500, rated 9.8.
CVE-2026-76501 affects Nexus switches with both NGOAM and SRv6 enabled, letting an unauthenticated remote attacker execute arbitrary code with root privileges.
A heap buffer over-read in libexpat's XML_ParseBuffer, fixed by upstream commit 13c5f63, lets attackers recover heap and libc pointers and defeat address randomization.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper control of code generation. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper neutralization of special elements used in code. IBM rates it high at CVSS 8.1.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper control of code generation, with effects that cross the component's security scope. IBM rates it high at CVSS 8.5.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote, unauthenticated attacker run arbitrary OS commands through improper neutralization of special elements in an OS command. IBM rates it critical at CVSS 9.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote attacker execute arbitrary code through a dependency confusion flaw. IBM rates it high at CVSS 8.8; no authentication is required, only a user action such as installing or updating.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code by slipping past the code security scanner's incomplete blocklist. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper input validation. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary OS commands through improper neutralization of special elements used in an OS command. IBM rates it high at CVSS 8.1.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker escape the code sandbox and execute arbitrary code through improper neutralization of special elements used in code. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary code through improper input validation. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker execute arbitrary OS commands through code injection rooted in improper input validation. IBM rates it high at CVSS 8.8.
Langflow OSS releases 1.0.0 through 1.12.2 let a remote authenticated attacker read sensitive data or inject malicious data through improper access control in the vertex result caching subsystem. IBM rates it high at CVSS 8.3.
Planka 2.2.0 through 2.2.1 does not limit incorrect TOTP codes submitted to the verify endpoint, letting an attacker who knows a user's password guess six-digit codes inside the ten-minute pending-token window and obtain a full access token.
Mooncake Store through 0.3.13.post1 exposes object-deletion RPCs without authentication, letting unauthenticated attackers delete arbitrary objects, wipe keys matching a regex, or clear the entire store, causing cache loss and request failures.
An unauthenticated attacker who knows the exact file path can read files from the web root of affected Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye Data Center instances. Atlassian rates it critical at CVSS 9.3.
Smarty before 4.5.8 and 5.x before 5.8.5 mishandles the top-level nocache hash during extends-based template inheritance, letting attacker-supplied data carrying a forged SmartyNocache marker be written verbatim into the regenerated PHP cache file and executed as PHP on include.
The HyperShift operator copies user-supplied kubeconfig secrets into the privileged control plane namespace without validation, so an authenticated tenant user can smuggle in an executable plugin and gain code execution in the control plane.
Legcord 1.1.0 through 1.3.0 fails to validate theme IDs in its theme IPC handlers, letting script in the Discord page escape the themes directory to launch executables, delete directories, and write files.
Legcord 1.1.0 through 1.3.0 lets script in the Discord page write any config key, so an attacker can persistently add Chromium proxy flags and route all client traffic through an interception proxy.
Camunda 7's first-run setup check only counts members of the default camunda-admin group, so when admins exist through other routes the setup endpoint can become reachable again, letting an unauthenticated attacker create a new administrator.
AVideo's safeString() strips tags before decoding entities and runs twice, so doubly-encoded entities in video titles survive sanitization and execute as stored XSS on trending, gallery, embed, and playlist pages.
AVideo renders the video trailer1 URL unescaped in YouPHPFlix2 templates and channel playlists, letting users with upload permission inject script that executes in viewers' browsers.
MindSearch's unauthenticated POST /solve endpoint passes planner-agent Python straight to exec() with full builtins and process globals, giving any network attacker root code execution in the default Docker deployment.
Unauthenticated attackers who know a victim's login name can link their own external identity provider account to the victim's ZITADEL user and sign in as them, with no primary-factor check.
ZITADEL encrypts IdP intent tokens without authentication, letting attackers tamper with their own token so it is accepted for another user's external login intent and steal IdP tokens or sessions.
ZITADEL validates the organization from a request header instead of the target user's organization when issuing passkey enrollment codes, letting attackers from one org register authenticators on users in another org.
ZITADEL's hosted Login V1 UI processes second-factor enrollment on identify-only sessions before any primary factor is verified, letting attackers enroll their own TOTP, SMS, or U2F factors on victim accounts.
ZITADEL Login V2 exposes one-time passcodes through the returnCode delivery type, letting unauthenticated attackers read OTP-Email and OTP-SMS codes from server responses and take over accounts, including admin accounts.
ZITADEL's hosted Login V1 and V2 UIs allow passkey or authenticator enrollment on identify-only sessions before any primary factor is verified, so unauthenticated attackers can register their own authenticator and log in as the victim.
ZITADEL Login V2 checks only the individual user's status and not the organization's inactive state, so users of deactivated organizations can still sign in, create sessions, and refresh tokens.
ZITADEL's hosted Login V1 UI trusts attacker-supplied external identity fields before any IdP callback completes, letting unauthenticated attackers pre-create accounts bound to a victim's external identity.
go-micro's shared TLS helper sets InsecureSkipVerify to true by default, letting network attackers impersonate services and intercept gRPC, HTTP, broker, and registry traffic including auth tokens.
gopay disables TLS certificate verification in its default HTTP client, letting man-in-the-middle attackers impersonate payment provider APIs to read merchant credentials and rewrite payment responses.
mammoth.js's style-map tokeniser has overlapping regex alternatives that an attacker can exploit with a crafted .docx, blocking the Node.js event loop in a regular-expression denial of service.
Mooncake transfer engine before 0.3.13 trusts pointer values in TCP transport session headers, letting unauthenticated attackers read or overwrite process memory, including KV cache contents.
Mooncake through 0.3.13.post1 exposes an unauthenticated /metadata handler that lets attackers rewrite transfer engine metadata, poison segment descriptors, and redirect KV cache transfers.
An authenticated EST user can obtain CA-signed certificates with arbitrary subject names because a Dogtag PKI enrollment check treats the request as agent-privileged.
389-ds-base keeps plaintext bytes buffered across a StartTLS upgrade, letting an on-path attacker inject an LDAP message whose response a client mistakes for a successful bind.
Zod's array schema validation accumulated an unbounded number of per-element error objects with no cap or early exit, letting attackers exhaust server memory with a single large array.
Registering a node tool on an n8n inline agent decrypted and used whatever credential the caller named, with no ownership check, letting an ordinary member exfiltrate plaintext secrets to a host of their choosing.
n8n's MongoDB Chat Memory node passed an unvalidated sessionId straight into a MongoDB query, letting unauthenticated callers read other users' conversation histories and perform unauthorized writes and deletes.
Tornado's CurlAsyncHTTPClient accumulated decompressed response bytes with no size accounting, letting a remote server OOM-kill the whole application with a small gzip bomb.
Ghost's content API let unauthenticated visitors retrieve gated post content directly, bypassing the paywall restrictions publishers rely on.
A Ghost session-handling bug let any authenticated staff user log in as any other staff user with only the password, bypassing two-factor authentication entirely.
A command injection flaw in Foreman's errors:fetch_log rake task let users with sudo rights to the task inject shell metacharacters and run arbitrary code.
OS command injection flaws in Foreman's database dump and import rake tasks let users with foreman-rake sudo rights append malicious shell commands to file path parameters.
An authenticated Foreman user with low-level Viewer permissions could abuse template preview endpoints to disclose sensitive host data, including root passwords, and potentially run commands as the Foreman service account.
A DontCheckLogin parameter skips authentication on getemaildata.php, and an unvalidated filePath parameter lets remote attackers read arbitrary files, including database and service credentials.
The exec-approval shell unwrapper fails to split pipeline stages and command substitutions, so a benign allow rule silently approves and executes a smuggled command on the Windows host.
system.execApprovals.set accepts broad wildcard allow rules such as *.* that match nearly every command, letting a caller weaken the exec-approval policy into arbitrary code execution.
LightLLM through 1.2.0 exposes an unauthenticated RPyC server with pickle deserialization in the router profiler service when started with --enable_profiling, letting attackers execute arbitrary code by sending crafted serialized objects.
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization on all interfaces, letting attackers send crafted serialized objects to execute arbitrary code.
LightLLM through 1.2.0 lets unauthenticated attackers exhaust KV-transfer worker memory through the NCCL control channel's exposed_set_value method when started with --pd_trans_mode nccl, crashing workers and triggering node failure.
Deno 2.7.0 through 2.9.7 on Windows escapes shell arguments for the wrong shell type, so an argument containing a quote can break out of quoting and run arbitrary OS commands.
iperf3 before 3.22 crashes its UDP receive worker into an unrecoverable infinite loop when it receives a crafted control-channel parameter message followed by a single 16-byte UDP datagram, pinning a thread at 100 percent CPU until SIGKILL.
Nginx Proxy Manager through 2.16.0 has no rate limiting on the login and 2FA endpoints, so unauthenticated attackers can brute-force credentials and TOTP codes to gain full administrative control.
mall4j through 4.0 leaves PUT /user/updatePwd without authentication, letting anyone reset any storefront account password by supplying the target username in the request body.
When max-incoming-payload-size is unlimited, libsoup's SoupWebsocketConnection grows its incoming buffer from an attacker-controlled frame length until it wraps, causing a heap buffer overflow while reading frame data.
When building a masked WebSocket client frame for a very large outgoing payload, libsoup passes truncated size values to allocation APIs while the masking routine uses the full length, causing a heap buffer overflow.
CTranslate2 before 4.8.1 fails to validate payload length against the allocated buffer when loading binary model files, allowing a crafted model to cause a heap-based buffer overflow and arbitrary code execution.
VLC media player before 3.0.24 fails to validate member names in .vlt skin archives, allowing a crafted skin to write arbitrary files and execute code through Lua script injection.
SurrealDB before 3.3.0 verifies credentials against the Surreal-Auth-NS and Surreal-Auth-DB headers but builds the session from the unauthenticated Surreal-NS and Surreal-DB headers, letting an authenticated user cross tenant boundaries.
A remote authenticated attacker can execute arbitrary code on IBM DataStage on Cloud Pak for Data 5.4.0.0 because archive extraction does not properly validate entry paths.
A privileged authenticated CLI user of IBM Guardium Data Protection 12.2 can inject shell commands into the certificate export function and execute them with root privileges.
An authenticated remote attacker can exploit path traversal in the IBM Guardium Data Protection 12.2 Datasource REST component to delete arbitrary files and degrade system integrity.
Unsloth Zoo before 2026.8.14 builds a Python import statement from model_type values without an allowlist, so a crafted config.json newline injects arbitrary Python that runs when the model is loaded.
LiteLLM's JWT flow falls back to an email-based user lookup without checking the email_verified claim, so a token from the configured identity provider with a victim's email inherits the victim's role, including proxy_admin.
The InputSql function in class/database.py of aaPanel BaoTa passes the attacker-supplied Password parameter into a shell command, so an authenticated panel user can execute arbitrary commands as root. A working public exploit exists and no vendor fix has been published.
The merge_split_file endpoint in aaPanel BaoTa builds a shell command around the attacker-supplied split_file_path argument, so an authenticated panel user can execute arbitrary commands as root. A working public exploit exists and no vendor fix has been published.
The panelTask.bt_task._unzip function in aaPanel BaoTa interpolates the attacker-supplied Password argument into a shell command, so an authenticated panel user can execute arbitrary commands as root. A working public exploit exists and no vendor fix has been published.
A prefix-match flaw in vm2's NodeVM external-module resolver lets untrusted guest code load non-allowlisted modules through the host require, escaping the sandbox.
MONAI's bundle engine resolves _target_ values to arbitrary importables and passes $ expressions to eval(), so a malicious bundle runs code on load.
A local user with write access to a shared MONAI cache directory can plant a malicious pickle that executes code in another user's pipeline.
The algo_from_pickle function in MONAI's auto3dseg module runs pickle.loads() on attacker-supplied files, executing arbitrary system commands.
The nnUNetV2Runner concatenates user-controlled config values into a shell command, so a crafted YAML runs arbitrary commands as the training user.
The NumpyReader unconditionally loads .npy and .npz files with allow_pickle=True, so a malicious data file executes code in the data pipeline.
In MONAI before 1.5.2, algo_from_pickle passes attacker-supplied pickle files straight to pickle.loads, executing arbitrary code in the application.
AzuraCast's sortOrder API parameter accepts arbitrary DQL expressions with no authentication, exposing user credentials and station settings.
AzuraCast fails to quote streamer usernames in Liquidsoap config generation, so an authenticated station user gets command execution as the Liquidsoap user.
An incomplete sanitization migration in AzuraCast lets users with RemoteRelays permission inject Liquidsoap interpolation syntax into relay passwords for code execution.
AzuraCast's config writer fails to sanitize Liquidsoap string interpolation, so Media or Profile users can inject shell commands that run when the station restarts.
Sylius built admin password-reset links from the unvalidated request Host header, letting unauthenticated attackers divert reset tokens to their own domains and seize admin accounts.
Sylius issued Admin and Shop API JWTs without firewall identification, so a token from a shop account registered with an admin email was accepted by the Admin API.
Sylius 2.x did not revalidate payment amounts during cart recalculation, so an attacker could pay a small amount, enlarge the order, and have it marked fully paid.
pnpm expanded ${VAR} placeholders in proxy settings from a repo-controlled pnpm-workspace.yaml, routing install traffic and secrets like NPM_TOKEN through attacker hosts.
Fleet-maintained macOS install and uninstall scripts generated from Homebrew cask metadata failed to escape shell metacharacters at every site, allowing root command execution via upstream cask content.
Obot before 0.23.0 exposed OAuth dynamic client registration without authentication or redirect-URI limits, letting attackers mint victim-scoped tokens usable across the whole API.
Obot before 0.23.0 did not validate destinations when privileged users registered remote MCP servers, enabling SSRF against internal services and cloud metadata endpoints.
The documented Obot Docker quickstart listened on 0.0.0.0:8080 with auth disabled, mapping every request to an Owner-role synthetic user, while mounting the host Docker socket.
Obot before 0.21.1 did not enforce Access Control Rules on the /mcp-connect endpoint, letting any authenticated user reach restricted MCP servers and their stored OAuth credentials.
Nezha 2.2.3 reflects an attacker-supplied Host header into the OAuth2 redirect_uri when dashboard_host is empty, letting an attacker capture authorization codes and take over accounts.
Flowise through 3.1.4 (enterprise/platform mode with SSO) has an authentication bypass in the SSO login path: when an SSO callback arrives with an email matching a user in INVITED status, the server copies the stored single-use invitation tempToken into the registration check instead of requiring the caller-supplied token. Anyone who can authenticate at a configured SSO provider with a pending invitee's email can take over the invitation and its organization access. No patched version is available.
Flowise through 3.1.4 resolves SSO and local-password users solely by email, without storing provider or subject-identifier bindings. An attacker can authenticate as any existing user by claiming their email at any configured SSO provider, gaining complete access to chatflows, credentials, and API keys. No patched version is available.
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. In queue mode with the dashboard enabled outside cloud mode, the /admin/queues mount validates the JWT but performs no role, permission, or workspace scoping, so any authenticated user, including the lowest-privileged member of any tenant, can view queues and job payloads across the instance (chat inputs, credentials in overrideConfig, chatflow definitions) and use write actions like retry, remove, and promote. No patched version is available.
Parse Server before 8.6.90 (and 9.0.0 before 9.10.1-alpha.9) does not validate the type of client-supplied installation fields before building database queries in the device-token deduplication logic. An unauthenticated remote attacker who knows only the public application ID can inject query operators to make the elevated deduplication cleanup delete every device registration in the application, killing push delivery until every client re-registers. No workaround other than upgrading exists.
Netty's HttpServerCodec tracks the HTTP method of each still-unanswered pipelined request in an unbounded queue. A remote, unauthenticated attacker who pipelines HTTP/1.1 requests on one connection while withholding reads can grow that queue without bound, exhausting heap and denying service. Fixed in 4.1.138.Final and 4.2.18.Final.
Netty's StompSubframeDecoder allocates a chunk buffer while waiting for a frame's terminating NUL byte and never releases it if the byte never arrives. A remote peer can leak one allocator buffer per connection by sending a well-formed frame body and withholding the NUL terminator, accumulating memory for the process lifetime. Fixed in 4.1.138.Final and 4.2.18.Final.
Netty's HTTP/3 codec retains unbounded per-stream QPACK encoder state keyed by the peer-controlled QUIC stream ID, released only when the remote decoder sends a Section Acknowledgment or Stream Cancellation. A remote, unauthenticated HTTP/3 client that advertises a non-zero dynamic-table capacity and omits the mandatory acknowledgments can grow heap without bound over a single connection. Fixed in 4.2.18.Final.
Netty's HTTP/3 QPACK prefixed-integer decoder does not bound the number of continuation bytes it processes. A remote, unauthenticated peer can send an endless run of continuation bytes on a QPACK unidirectional stream; each decode re-scans the whole accumulated buffer, yielding quadratic CPU cost and unbounded heap growth. Fixed in 4.2.18.Final.
Netty's HTTP/3 QPACK encoder-stream instruction decoder accepts an attacker-declared string-literal length of up to roughly 2 GiB with no per-instruction cap. A remote, unauthenticated peer that declares a huge literal length and trickles fewer bytes than declared makes the per-connection buffer grow without bound, ending in OutOfMemoryError. Fixed in 4.2.18.Final.
Netty's HTTP/3 codec mishandles HTTP/1 CONNECT authority-form request-targets when converting to HTTP/3: the CONNECT target's host is emitted as the scheme, the path becomes /, and the HTTP/1 Host header becomes the authority, or the target is dropped entirely. In an HTTP/1-to-HTTP/3 proxy, a client can bypass tunnel allow-lists and egress policy with a CONNECT whose Host header names a different authority than the request-target. Fixed in 4.2.18.Final.
Netty's HTTP/3 codec builds the :authority pseudo-header from the HTTP/1 Host header before considering the authority of an absolute-form request-target, contrary to the HTTP/1.1 rule that the request-target authority must win. A remote client can send 'GET https://trusted.example/admin' with 'Host: attacker.example' so authorization and routing decisions split from what the upstream HTTP/3 peer receives. Fixed in 4.2.18.Final.
Netty 4.2.11.Final through 4.2.17.Final contains an incomplete hostname-verification fix in the QUIC certificate verification path when using a plain X509TrustManager: the BoringSSL verify callback discards the SSLEngine, so endpoint identification never runs even when HTTPS verification is configured. A network-path attacker can present a certificate for the wrong hostname that the trust manager accepts. Fixed in 4.2.18.Final.
Grav before 2.0.25 ships web server configuration samples whose access-control deny rules are matched case-sensitively. In web.config for IIS, every deny rule sets ignoreCase='false', overriding the IIS default; on case-insensitive NTFS, an unauthenticated remote attacker can vary the case of a folder or extension (e.g. requesting /user/CONFIG/system.YAML) so no deny rule matches and the static file handler returns the file, disclosing configuration secrets or account password hashes. Fixed in 2.0.25; operators must re-copy the corrected sample files after upgrading because the installer heal does not touch web.config or lighttpd.conf.
Grav CMS 2.0.14 through 2.0.24 has a privilege escalation in the group and account blueprints: the access map guard 'admin.super' is resolved by the field's exact path, so a submitted flat dot-notation key like 'access.admin.super' matches no blueprint rule, survives filtering, and is written by setNestedProperty, which splits on dots and rebuilds the nested value. An authenticated backend operator with admin.users but not admin.super can grant admin.super to their own account or group, escalating to full super-admin with control over configuration, plugins, themes, the file manager, and all accounts. Fixed in 2.0.25.
Grav 2.0.19 through 2.0.24 (and 1.7.x with content Twig explicitly enabled) renders page content from a page-write user through a Twig sandbox that allowlists get_cookie(), returning any cookie of the current request, including the session cookie, server-side where HttpOnly offers no protection. The finished output is stored in a page-content cache keyed without any session or user dimension. A page published by a page-write user can capture the session identifier of the next administrator who views it, and the cache then serves that identifier to unauthenticated visitors, who replay the cookie to authenticate as the administrator. Fixed in 2.0.25; 1.7.x is outside the backport scope.
The Comments plugin for Grav CMS through 1.2.10 registers an admin handler that returns comment data as JSON without any authentication check: it branches on isAdmin(), which only indicates the admin service is registered on the route rather than that the visitor is authenticated, and it echoes the JSON before the classic Admin plugin would render its login screen. On a site using the classic Admin plugin with Comments enabled, an unauthenticated remote attacker can request the comments admin route and retrieve every comment from the last 7 days, including commenter email addresses and the absolute server filesystem path of the data file. Fixed in 1.2.11, which requires an authenticated user with admin.comments or admin.super and removes the absolute filePath.
The Grav Data Manager plugin 1.0.1 through 1.4.4 renders stored data entries in the item-detail view without escaping, applying Twig's raw filter, in some cases after a striptags call that PHP's strip_tags bypasses by preserving allowed tags with attributes. An unauthenticated visitor who submits a front-end form whose submissions are saved to user/data can store an HTML payload that executes as JavaScript in the session and origin of an administrator who later opens that entry in the classic admin panel, running with the administrator's privileges and CSRF token. Fixed in 1.4.5.
Budibase before 3.45.0 fails to disable external JSON reference resolution in the OpenAPI/Swagger import validator. An authenticated builder can embed file:// references in an OpenAPI specification submitted to the import endpoint and exfiltrate arbitrary local files, including environment variables carrying JWT secrets, API keys, and database credentials. Fixed in 3.45.0.
Budibase Server before 3.45.0 extracts user-supplied ZIP archives in the PWA icon upload endpoint without proper symlink validation. A BUILDER-role attacker can craft a malicious ZIP with leaf symlink entries followed by duplicate file entries to write arbitrary files as root, enabling remote code execution. Fixed in 3.45.0.
Budibase before 3.45.0 builds MySQL and MSSQL column-rename DDL by interpolating identifiers directly into a raw query string without applying its identifier-quoting helpers. An attacker with DDL rights on a connected datasource can create a column whose name contains a backtick or quote plus SQL; when a builder later renames that column through the UI, the embedded quote terminates the identifier and the injected SQL runs as the Budibase datasource user (MySQL connections allow stacked statements), enabling arbitrary reads, writes, or destructive operations outside Budibase's permission model. Fixed in 3.45.0.
Budibase 3.41.0 before 3.45.0 has an authentication bypass in the OIDC/SSO login path: when no existing user matches the incoming SSO subject, the server looks up pending invites by the IdP-asserted email alone, without validating an invite code or requiring email_verified. An attacker who can register at a trusted IdP and assert a victim's invited email claims the pending invite with all its privileges, including builder and admin.global, for full tenant compromise. Fixed in 3.45.0.
Budibase before 3.45.0 fails to scope the GET /api/chat-links endpoint by workspace. A builder with access to a single workspace can enumerate chat identity link records across all workspaces in the tenant, retrieving user IDs and external chat service identifiers from workspaces they have no permission to access. Fixed in 3.45.0.
Budibase before 3.45.0 fails to validate per-app authorization in POST /api/global/groups/:groupId/apps. A builder of a single workspace can exploit the missing per-app authorization checks to grant themselves admin roles in other workspaces by modifying user group role mappings. Fixed in 3.45.0.
Hugo v0.161.0 through v0.165.0 runs Node.js tools (PostCSS, TailwindCSS, Babel) under the Node.js permission model to restrict file reads to the project directory, but the model validates only the lexical path and follows symlinks pointing outside the allowed set. A contributor can commit a symlink such as assets/css/x.css pointing at a sensitive file plus a PostCSS plugin that reads it, disclosing any file the Hugo build process can read, potentially embedded in the published site. Fixed in v0.166.0, which fails the build when a symlink resolves outside the allowed paths.
Hugo after v0.123.0 and before v0.166.0 stopped symlink confinement checks at the mount root itself, so a theme or vendored module could contain a symlink at a mount root (for example themes/mytheme/assets pointing outside the module). Files behind the symlink were readable during builds via resources.Get and could be published to public/ via static mounts, bypassing the rule that theme and module mount sources must be local paths. Fixed in v0.166.0.
Hugo v0.162.0 before v0.166.0 has a case-sensitive validation flaw in the security.http.urls IP-literal deny rule: mixed-case URL schemes in resources.GetRemote calls bypass the restriction, letting a build fetch from restricted IP addresses like localhost. Fixed in v0.166.0.
Adminer 6.0.0 through 6.0.1, with the official ClickHouse driver plugin loaded, is vulnerable to pre-authentication server-side request forgery. An unauthenticated attacker can submit auth[driver]=clickhouse with auth[server] set to an arbitrary URL, making the Adminer server POST 'SELECT version()' to that host; when the target returns a non-2xx status, the raw response body lands on the login page. That enables internal network and port reconnaissance and leaks sensitive details from internal error pages. Fixed in 6.0.2.
nodemailer before 10.0.6 has a denial-of-service vulnerability in the addressparser free-text fallback regex, which exhibits quadratic backtracking. Crafted email header values with long whitespace-free runs can block the Node.js event loop for tens of seconds, taking the service down. Fixed in 10.0.6.
IBM Guardium Data Protection 12.2 passes attacker-controlled arguments from a crafted GIM bundle to the tar command, letting an authenticated attacker execute arbitrary commands with elevated privileges on the Central Manager.
BerriAI LiteLLM before 1.101.0-rc.1 has a tenant isolation bypass in the semantic cache layer that lets an authenticated user retrieve other tenants' cached responses, including PII, financial data, and source code.
A race condition in QEMU's 9pfs subsystem lets a malicious guest craft a fid path from stale heap data, escape the shared directory boundary, and read or write arbitrary host files or execute code as the QEMU process user.
A remote code execution flaw in Outlook rated HIGH at CVSS 8.8 lets an attacker run code as the user once a crafted message is opened or previewed.
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1 and 3.33.1 through 3.33.3.SP1 lets a remote unauthenticated attacker send crafted SQL statements to view, add, modify, or delete information in the back-end database.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements used in an OS command, allowing a remote authenticated attacker to execute arbitrary code with low privileges.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements used in an OS command, letting a remote authenticated attacker execute arbitrary commands on the host.
Improper neutralization of special elements in an OS command in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote authenticated attacker to run arbitrary commands on the server.
IBM DataStage on Cloud Pak for Data 5.4.0.0 improperly neutralizes environment variables, allowing a remote authenticated attacker to execute arbitrary commands on the host.
IBM DataStage on Cloud Pak for Data 5.4.0.0 deserializes untrusted data without safety checks, allowing a remote authenticated attacker to execute arbitrary code on the server.
A path traversal flaw in pulpcore's content upload API lets an authenticated low-privilege user read any file the Pulp server can access; deployments with Pulp Container risk exposure of the token signing private key and forged access to all private container repositories.
SigNoz before 0.143.0 signed session tokens with an empty key when no JWT secret was configured, letting unauthenticated attackers forge admin session tokens.
DCMTK through 3.7.0 copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames, so a crafted DICOM instance triggers heap over-reads that crash the application or leak adjacent heap memory.
HFS2 2.4.0 and earlier lets an unauthenticated attacker embed template syntax in an uploaded filename, bypass the dispatcher authorization check, and execute arbitrary commands on the host with a crafted exec macro.
A remote attacker with no credentials can execute arbitrary code on IBM Financial Transaction Manager for RedHat OpenShift because user-controlled input reaches the new Function constructor.
IBM Financial Transaction Manager for RedHat OpenShift deserializes untrusted data, letting a remote attacker with no credentials execute arbitrary code.
A remote authenticated attacker can bypass symbolic-link validation in IBM Financial Transaction Manager for RedHat OpenShift to read sensitive files, rated critical at CVSS 9.9.
IBM Concert 1.0.0 through 3.0.0 incorporates specially crafted input into OS commands, allowing an unauthenticated remote attacker to execute arbitrary commands with the application's privileges.
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local user overflow a buffer and execute arbitrary code on the system.
IBM Concert 1.0.0 through 3.0.0 accesses memory after it has been freed, allowing an attacker who can influence program input to corrupt memory, crash the application, or execute arbitrary code.
An incomplete blocklist on the AWX container group pod_spec_override field lets an AAP platform administrator inject initContainers and service account overrides, escalating to OpenShift namespace-level access and secret exfiltration.
The AWX CopyAPIView POST handler never performs the object-level read check that the GET handler does, letting users copy job templates they are not allowed to read.
IBM DataStage on Cloud Pak for Data 5.4.0.0 fails to neutralize special elements in OS commands, letting a remote authenticated attacker execute arbitrary commands.
Improper escaping of connector property values during OSH script generation in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker execute arbitrary code.
A further OS command injection in IBM DataStage on Cloud Pak for Data 5.4.0.0 lets a remote authenticated attacker execute arbitrary commands through improperly neutralized special elements.
The automation controller's job output view expands ANSI OSC 8 hyperlinks into clickable anchors without filtering schemes, letting a low-privilege user plant javascript: links that execute in a higher-privileged viewer's session.
An administrator-controlled log message template in automation controller is rendered with a live user object, allowing format string traversal that reads the Django secret key and database password into forwardable logs.
Copying a WorkflowJobTemplate in automation controller skips permission checks on instance groups, letting a workflow admin launch attacker-influenced automation in the control-plane execution context.
A compromised Flatpak repository can write attacker-controlled content to arbitrary host filesystem locations through extract_extra_data, running as root on system installs via symlink following and unsanitized path traversal.
An apostrophe in an OpenAPI path segment breaks out of single-quoted route literals in @orval/hono output, injecting arbitrary JavaScript that executes when the generated module is imported.
Schema defaults containing ${...} syntax are converted into template literals by the @orval/effect generator, executing injected JavaScript at module scope when the generated code is built or imported.
orval emits the operationId into generated TanStack Query mutator metadata without escaping, so a crafted operationId in an OpenAPI spec injects JavaScript that runs when the generated hooks are called.
A chained authorization flaw in Meta Box AIO (and the standalone Meta Box Frontend Submission and Meta Box User Profile plugins) lets unauthenticated attackers overwrite any page with a crafted shortcode and register an Administrator account. Fixed in Meta Box AIO 3.12.0.
SolarWinds Observability Self-Hosted contains an unauthenticated remote code execution flaw from insufficient integrity checks, affecting non-default, non-secure configurations. CVSS 9.8.
SolarWinds Observability Self-Hosted is affected by an unauthenticated remote code execution flaw from deserialization of untrusted data in a specific communication mode. CVSS 8.8.
A path traversal flaw in Adobe Connect lets an unauthenticated attacker read arbitrary files outside the intended scope. CVSS 8.6.
Adobe Campaign Classic is affected by an unauthenticated improper code-generation flaw that can lead to arbitrary code execution with scope changed. CVSS 10.0.
A SQL injection flaw in Adobe Connect lets a low-privileged attacker execute arbitrary SQL and reach code execution with changed scope. CVSS 9.9.
A stored cross-site scripting flaw in Adobe Connect lets an attacker run malicious JavaScript in a victim's browser and potentially take over accounts or sessions. CVSS 9.3.
A stored cross-site scripting flaw in Adobe Connect lets an attacker run malicious JavaScript in a victim's browser and potentially take over accounts or sessions. CVSS 9.3.
A reflected cross-site scripting flaw in Adobe Connect lets an attacker run malicious JavaScript in a victim's browser and potentially take over accounts or sessions. CVSS 9.3.
Adobe Campaign Classic is affected by an unauthenticated improper code-generation flaw that can lead to arbitrary code execution with scope changed. CVSS 10.0.
Adobe Campaign Classic is affected by an unauthenticated improper code-generation flaw that can lead to arbitrary code execution with scope changed. CVSS 10.0.
An incorrect authorization flaw in Adobe Campaign Classic lets an unauthenticated attacker reach arbitrary code execution without user interaction. CVSS 9.1.
An incorrect authorization flaw in Adobe Experience Manager Forms JEE lets an unauthenticated attacker execute arbitrary code with changed scope. CVSS 10.0.
An unauthenticated-facing but credentialed command injection via the undocumented mfc eeprom write command lets any authenticated user run arbitrary shell commands as root on Lantronix SLC8000, EMG8500/7500 and sibling out-of-band management devices. CVSS 9.9.
A command injection in the set cifs password command on Lantronix out-of-band devices lets authenticated users with the services permission run arbitrary commands as root. CVSS 9.1.
A stack-based buffer overflow in the undocumented mfc eeprom read command on Lantronix out-of-band devices lets any authenticated user potentially execute arbitrary code by supplying oversized input. CVSS 9.9.
A server-side request forgery in the WebSSH/WebTelnet listener of Lantronix out-of-band devices lets an unauthenticated attacker redirect SSH terminal connections to arbitrary hosts and probe internal networks. CVSS 8.6.
An OS command injection in the set nfs download command on Lantronix out-of-band devices lets authenticated users with the services permission execute arbitrary commands as root. CVSS 9.1.
An OS command injection in the set script schedule command on Lantronix out-of-band devices lets authenticated users with the services permission execute arbitrary commands as root. CVSS 9.1.
A path-truncation flaw in the web management portal of Lantronix out-of-band devices lets unauthenticated attackers bypass session checks, read sensitive config files, and upload files anywhere, leading to remote code execution. CVSS 10.0.
A path traversal flaw in the web management upload endpoint of Lantronix out-of-band devices lets authenticated attackers write arbitrary files anywhere on the filesystem, leading to remote code execution. CVSS 9.1.
An improper input validation flaw in Adobe Experience Manager Forms JEE lets an attacker with high privileges execute arbitrary code. CVSS 9.1.
A server-side request forgery flaw in Adobe Experience Manager Forms JEE lets a low-privileged attacker reach internal resources and escalate privileges. CVSS 9.6.
An improper input validation flaw in Adobe Campaign Classic lets a low-privileged attacker execute arbitrary code, though exploitation depends on conditions beyond the attacker's control. CVSS 8.5.
A SQL injection flaw in Adobe Campaign Classic lets an attacker with high privileges execute arbitrary SQL commands and reach code execution. CVSS 9.1.
A SQL injection flaw in Adobe Campaign Classic lets a low-privileged attacker bypass security measures and gain unauthorized read and limited write access. CVSS 9.1.
A server-side request forgery flaw in Adobe Campaign Classic lets a low-privileged attacker reach internal resources and escalate privileges. CVSS 9.9.
A server-side request forgery flaw in Adobe Campaign Classic can be exploited without authentication to escalate privileges against internal resources. CVSS 9.9.
Adobe Campaign Classic is affected by an unauthenticated improper code-generation flaw that can lead to arbitrary code execution with scope changed. CVSS 10.0.
An improper code-generation flaw in Adobe Campaign Classic lets a low-privileged attacker execute arbitrary code with changed scope. CVSS 9.9.
An unauthenticated local file inclusion flaw in the HUSKY Products Filter for WooCommerce Professional plugin lets visitors include and execute arbitrary .php files via the 'shortcode' parameter, because the only nonce check uses a value emitted into every front-end page.
A privilege escalation flaw in CUPS with the cups-filters serial backend lets a local user in the lpadmin group point a printer's device URI at an arbitrary path, so the root-privileged backend writes attacker-controlled data to any file. A public proof of concept exists.
Vaultwarden through 1.37.3 fails to validate organization membership status in cipher access queries, so revoked and unconfirmed members retain read, write, delete, and attachment access to organization secrets. CVSS 8.6.
CRI-O's container checkpoint/restore feature validates restore metadata insufficiently, so a privileged user restoring from crafted checkpoint content can perform unintended operations on the host filesystem. The feature is not enabled by default.
A tie-breaking bug in the pki-core v2 REST ACL filter resolves colliding literal and wildcard ACL keys by lexicographic comparison instead of specificity, letting the Certificate Manager Agents group's lower-privileged profiles.approve override the Administrator-only profiles.create required by POST /v2/profiles/raw.
Kamailio's CDP Diameter receiver has a heap-based buffer overflow in shm_malloc that can be triggered remotely with a crafted message. A public exploit exists. Fixed in 6.0.8 with upstream patch commits available for other branches.
Expat through 2.8.4 fails to validate low surrogates after high surrogates in UTF-16 input, letting lone high surrogates swallow following code units and hide markup from the parser. Fixed upstream via PR #1282.
Argo Workflows 4.1.0 through 4.1.3 skips cluster-scoped access review in ListArchivedWorkflows when the metadata.namespace selector uses the NotEquals operator, letting namespace-scoped users read archived workflows from other namespaces. Fixed in 4.1.4.
Mistral Vibe before 2.25.5 executes git hooks during worktree creation before trust validation, so opening a crafted repository can run arbitrary shell commands with the user's privileges. Fixed in 2.25.5.
getID3 before 1.9.26 concatenates media filenames into shell commands without escaping, letting attackers inject arbitrary OS commands that run with the PHP process's privileges. Fixed in 1.9.26.
OpenShift's console exposes devfile endpoints that let remote attackers force internal requests or exhaust console memory.
Deserialization of untrusted data can let a remote unauthenticated attacker execute arbitrary code on IBM Guardium Data Protection 12.2.
A flaw in vm2's bridge lets sandboxed code reach the host global object and execute arbitrary commands when a non-strict host function is exposed.
NodeVM's denylist omits child_process, so sandboxed code can execute arbitrary host commands when builtins are broadly allowed.
A logic error in the Pixel cellular modem allows adjacent-network privilege escalation with no user interaction; the September 2026 patch level fixes it.
An unauthenticated API request can bypass authentication on Cisco Identity Services Engine and ISE Passive Identity Connector, and Cisco warns successful exploitation can lead to root command execution.
A SQL injection flaw in the email parsing of Cisco AsyncOS for Secure Email Gateway lets an unauthenticated attacker execute arbitrary commands with root privileges by sending a malicious email.
JFrog Artifactory validates token signatures but not token scopes, so an attacker with a low-privileged token can escalate to administrative privileges. Wiz observed in-the-wild chaining into full admin takeover.
A missing-authorization flaw in the ScreenConnect client lets an attacker transfer and execute files through an active remote session without host confirmation. ConnectWise fixed it in ScreenConnect 26.6.5; CISA confirms active exploitation.
A path traversal flaw in GitLab's repository commits API lets an unauthenticated attacker read arbitrary files from a self-managed server. Fixed in GitLab 19.1.8, 19.2.6, and 19.3.2; CISA confirms active exploitation.
A heap-based buffer overflow in FortiOS, FortiSwitchManager, and FortiSASE lets an attacker execute code via crafted packets. SOCRadar links in-the-wild exploitation to the PivotC2 malware campaign; CISA confirms active exploitation.
An authentication bypass in NetScaler ADC and Gateway lets an unauthenticated remote attacker skip authentication on Gateway and AAA deployments. Fixed in builds 14.1-73.32 and 13.1-63.21; CISA confirms active exploitation.
An authentication bypass in Cisco Secure Firewall Management Center lets an unauthenticated remote attacker execute scripts as root. Cisco confirms active exploitation by multiple threat clusters, including ransomware and state-sponsored actors.
An out-of-bounds write in Chrome's V8 engine lets a remote attacker run code inside the browser sandbox via a crafted page. Fixed in Chrome 153.0.8010.36; Google confirms an exploit exists in the wild.
A template-engine flaw in Adobe Commerce and Magento Open Source lets an unauthenticated attacker inject PHP and get code execution during email rendering. Adobe shipped emergency hotfix VULN-39341; exploitation began before the patch.
A link-following flaw in the Windows Update Stack lets a local attacker escalate to SYSTEM. Microsoft patched it on September 8, 2026, and confirms it was exploited as a zero-day.
A heap-based buffer overflow in Windows ALPC lets code running in a low-privilege AppContainer escalate to SYSTEM. Microsoft patched it on September 8, 2026, and confirms in-the-wild exploitation.
Starlette versions before 1.0.1 rebuild request.url from an unvalidated Host header, so middleware gating on the URL path can be bypassed with a crafted header.
An OAuth2 passthrough fallback in LiteLLM's MCP Streamable HTTP endpoint lets an unauthenticated attacker use a fabricated Bearer token to establish an authenticated MCP session and reach configured tools.
An unsafe dynamic class loading flaw in PaperCut NG/MF lets attackers execute Java bytecode on the server; PaperCut confirms active exploitation and customer incidents.
ownCloud core 10.6.0 through 10.13.0 accepts pre-signed URLs even when no signing key is configured, allowing unauthenticated access to any user's files.
CVE-2019-1068, a remote code execution flaw in SQL Server from 2019, was added to the KEV catalog in 2026: unpatched legacy database servers are being hit.
An attacker with write access to a Gitea repository can abuse the diffpatch API to plant an executable Git hook and run arbitrary commands as the Gitea service account.
A URI-normalization inconsistency between Oracle HTTP Server and the WebLogic proxy plug-in lets an unauthenticated attacker bypass access controls and reach or modify backend application data.
An unauthenticated attacker can send specially crafted SMTP requests to Zimbra Collaboration Suite and trigger OS command injection through SNMP notification processing when the zimbra-snmp package is installed.
An unauthenticated MLflow webhook test can follow redirects into internal services or cloud metadata endpoints and return their responses.
A critical double-free flaw in the Windows IKE service can allow an unauthenticated network attacker to execute code on a reachable system.
A critical JWT authentication weakness can let an unauthenticated network attacker bypass SharePoint security controls and access protected data.
A critical directory-traversal flaw in the vCenter Syslog server can allow an unauthenticated network attacker to execute arbitrary code.
A critical state-management flaw can let a network attacker authenticate to macOS Screen Sharing without valid credentials.
Ray's browser-based request protection relies on a User-Agent check that Firefox and Safari can bypass, and combined with DNS rebinding it lets a malicious website execute code on a developer's Ray instance.
A heap-inspection flaw in the Remote Access SSL VPN service of Cisco Secure Firewall ASA and FTD lets an unauthenticated attacker force the device to reload, causing a denial of service.
A use-after-free race in the Windows AFD driver let local attackers escalate to SYSTEM. Microsoft patched it August 11, 2026; Check Point attributes zero-day exploitation to the Lazarus Group's Operation Dream Job.
An unauthenticated SQL-injection path can lead to Metabase administrator access, exposed database credentials, and data theft.
An incomplete earlier fix lets attackers bypass Apache Tomcat's EncryptInterceptor, sending unencrypted cluster messages that reach Java deserialization and enable unauthenticated remote code execution.
Attackers who previously compromised a FortiGate at the filesystem level can bypass the patch for Fortinet's symlink persistence mitigation and read sensitive files via crafted HTTPS requests.
CISA reports that unsafe deserialization in the TeamCity agent polling protocol can permit unauthenticated remote code execution.
An improper authentication vulnerability in Azure Key Vault allows an unauthorized attacker to elevate privileges over the network, rated CVSS 10.0.
A sandbox escape in TeamCity's Kotlin DSL handling allows code execution on the server, fixed in TeamCity 2025.11.6 and 2026.1.2.
An unauthenticated attacker can obtain an application login token from an internet-exposed Check Point Management Server and log in via SmartConsole with full administrative privileges.
Deserialization of untrusted data in SharePoint lets an unauthorized attacker execute code over the network with no authentication, rated CVSS 9.8.
An invalid pointer in Firefox's Disability Access APIs allows a sandbox escape, fixed in Firefox 153 and Thunderbird 153.
A SQL injection in WordPress's author__not_in query parameter, chained with a REST API flaw, gives unauthenticated remote code execution on default installs.
Insufficient access control granularity in AD FS allows an authorized local attacker to elevate to administrator; Microsoft reports functional exploit code and detected exploitation.
A CVSS 10.0 path traversal in ColdFusion 2025.9 / 2023.20 and earlier allows unauthenticated remote code execution, and Adobe confirms limited in-the-wild exploitation.
CISA says default Langflow deployments may permit unauthenticated attackers to achieve full remote code execution.
SimpleHelp 5.5.15 and earlier accept OIDC identity tokens without verifying their signature, letting an unauthenticated attacker log in as any user.
Gemini CLI in headless CI mode auto-trusted workspace folders, so a malicious .gemini/.env file could execute code on the host before sandboxing applied.
Traefik's StripPrefix middleware normalizes crafted paths after routing, letting unauthenticated requests reach backends that a separate router meant to protect.
When @n8n/mcp-browser runs in HTTP transport mode, its MCP endpoint accepts session and tool requests with no authentication, exposing browser control to any network client.
Langflow OSS combines a Python builtins injection flaw with default auto-login, giving unauthenticated attackers remote code execution on the host.
An improper authentication flaw in Azure Active Directory lets an unauthorized attacker elevate privileges over the network, with a CVSS 10.0 rating.
CISA says an unauthenticated attacker can execute arbitrary commands through unsanitized input in multiple LoadMaster command endpoints.
| Published | Advisory | Technology | Signal | Priority |
|---|---|---|---|---|
FreeRDP FreeRDPCVE-2026-111880 | Remote access, Open source | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111882 | Web application, Open source, Identity | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111884 | Web application, Open source, Identity | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111901 | Web application, Open source | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111908 | Web application, Open source | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111909 | Web application, Open source, Identity | Disclosed | High priority | |
phpMyFAQ phpMyFAQCVE-2026-111911 | Web application, Open source, Identity | Disclosed | Act now | |
fleetdm FleetCVE-2026-111923 | Device management, Open source, Infrastructure | Disclosed | High priority | |
fleetdm FleetCVE-2026-111924 | Device management, Open source, Infrastructure | Disclosed | High priority | |
Coder CoderCVE-2026-111927 | Developer infrastructure, Open source, Workspaces | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-111378 | Remote desktop, Open source software | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-111380 | Remote desktop, Open source software | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-111382 | Remote desktop, Open source software | Disclosed | High priority | |
Frappe Frappe HRMSCVE-2026-111389 | Human resources, Open source software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108426 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108427 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108428 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108429 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108430 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108431 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108432 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108437 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108439 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108440 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108441 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108442 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108443 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft OfficeCVE-2026-108444 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108445 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft ExcelCVE-2026-108446 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108447 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108449 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108450 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft WordCVE-2026-108451 | Office suite, Endpoint, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-108452 | Collaboration server, Enterprise software, Web application | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-110838 | Remote desktop, Open source software | Disclosed | High priority | |
GitPython GitPythonCVE-2026-110856 | Developer infrastructure, Python, Open source software | Disclosed | High priority | |
GitPython GitPythonCVE-2026-110858 | Developer infrastructure, Python, Open source software | Disclosed | Act now | |
GitPython GitPythonCVE-2026-110859 | Developer infrastructure, Python, Open source software | Disclosed | High priority | |
Better Auth Better AuthCVE-2026-110862 | Authentication, Web applications, Developer infrastructure | Disclosed | Act now | |
Better Auth Better Auth SSOCVE-2026-110863 | Authentication, Single sign-on, Web applications | Disclosed | High priority | |
Better Auth Better AuthCVE-2026-110864 | Authentication, Web applications, Developer infrastructure | Disclosed | Act now | |
Renovate RenovateCVE-2026-110867 | Developer infrastructure, Dependency automation, CI/CD | Disclosed | Act now | |
Renovate RenovateCVE-2026-110868 | Developer infrastructure, Dependency automation, CI/CD | Disclosed | High priority | |
Nodemailer NodemailerCVE-2026-110869 | Email, Node.js, Open source software | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111214 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111216 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111217 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111226 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111229 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Netgate pfSense CECVE-2026-111231 | Firewall, Network security, Critical infrastructure | Disclosed | High priority | |
Red Hat Ansible Operator PluginsCVE-2026-92982 | Kubernetes, Operator framework, Cloud infrastructure | Disclosed | High priority | |
DPDK DPDKCVE-2026-100236 | Data plane, Virtualization, Open source | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101927 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101939 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101940 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101941 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101942 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101943 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101944 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101945 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101950 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-101954 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-101955 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101981 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-101982 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-101990 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-101997 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OS EvolvedCVE-2026-102012 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102014 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102015 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102016 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102020 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102022 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OS EvolvedCVE-2026-102023 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102024 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102025 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102026 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102027 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102028 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102029 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102030 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OS EvolvedCVE-2026-102031 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-102037 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102049 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102050 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102052 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102055 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102059 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102061 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102062 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102064 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102079 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102174 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102175 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
Juniper Networks Junos OSCVE-2026-102176 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | High priority | |
Juniper Networks Junos OSCVE-2026-102178 | Network operating system, Enterprise infrastructure, Critical infrastructure | Disclosed | Act now | |
F5 NGINX Ingress ControllerCVE-2026-104939 | Kubernetes, Ingress controller, Identity | Disclosed | High priority | |
F5 NGINX Plus and NGINX Open SourceCVE-2026-15176 | Web server, Load balancer, Critical infrastructure | Disclosed | High priority | |
DPDK DPDKCVE-2026-86567 | Data plane, Virtualization, Open source | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-88164 | Collaboration, Enterprise software | Disclosed | High priority | |
F5 NGINX Gateway FabricCVE-2026-91184 | Kubernetes, Gateway API, Multi-tenancy | Disclosed | High priority | |
F5 NGINX Plus and NGINX Open SourceCVE-2026-93479 | Web server, Load balancer, Critical infrastructure | Disclosed | High priority | |
F5 NGINX Ingress ControllerCVE-2026-94197 | Kubernetes, Ingress controller, Identity | Disclosed | High priority | |
F5 NGINX Plus and NGINX Open SourceCVE-2026-97205 | Web server, Load balancer, Critical infrastructure | Disclosed | High priority | |
Frappe Frappe FrameworkCVE-2024-58390 | Web framework, Open source | Disclosed | High priority | |
Adobe Adobe CommerceCVE-2026-100133 | E-commerce, Web application | Disclosed | Act now | |
Microsoft Windows Message QueuingCVE-2026-100202 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft Office ExcelCVE-2026-100210 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office ExcelCVE-2026-100211 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office ExcelCVE-2026-100212 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Dynamics NAVCVE-2026-100214 | ERP, Enterprise software | Disclosed | High priority | |
Microsoft Remote Desktop GatewayCVE-2026-100218 | Remote access, Operating system | Disclosed | High priority | |
Microsoft Microsoft QUICCVE-2026-100219 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Media Video DecoderCVE-2026-100220 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
Microsoft Windows Network Policy ServerCVE-2026-100222 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows RPC RuntimeCVE-2026-102203 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
Microsoft Windows Text ShapingCVE-2026-102210 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Hyper-VCVE-2026-102214 | Virtualization, Operating system | Disclosed | High priority | |
Microsoft Windows WebDAVCVE-2026-102217 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
Microsoft Windows Text ShapingCVE-2026-102225 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
Microsoft Microsoft Dynamics NAVCVE-2026-102226 | ERP, Enterprise software | Disclosed | High priority | |
Microsoft Visual Studio CodeCVE-2026-102238 | Developer tools, Open source | Disclosed | Act now | |
IBM TRIRIGA Application PlatformCVE-2026-102627 | Enterprise software, Facilities management | Disclosed | High priority | |
Microsoft Microsoft Office AccessCVE-2026-102849 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office AccessCVE-2026-102850 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office VisioCVE-2026-102856 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office VisioCVE-2026-102857 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft Office OneNoteCVE-2026-102858 | Office productivity | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102860 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102861 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102862 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102863 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft Microsoft SharePoint ServerCVE-2026-102866 | Collaboration, Enterprise software | Disclosed | High priority | |
Microsoft .NET FrameworkCVE-2026-102869 | Developer tools, Runtime | Disclosed | High priority | |
Microsoft ASP.NET CoreCVE-2026-102870 | Developer tools, Web application, Open source | Disclosed | High priority | |
Microsoft Visual StudioCVE-2026-103572 | Developer tools | Disclosed | High priority | |
Microsoft Remote Desktop ClientCVE-2026-103575 | Remote access, Operating system | Disclosed | High priority | |
Adobe Adobe Experience ManagerCVE-2026-103848 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe CommerceCVE-2026-103849 | E-commerce, Web application | Disclosed | Act now | |
Microsoft Windows Search ComponentCVE-2026-105010 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft QUICCVE-2026-105016 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-105895 | Content management, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-105899 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-105903 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106612 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106619 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106620 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106621 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106622 | Application server, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-106624 | Application server, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-106626 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-106629 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-106630 | Content management, Web application | Disclosed | Act now | |
phpMyFAQ phpMyFAQCVE-2026-109573 | Web application, Open source | Disclosed | High priority | |
Frappe ERPNextCVE-2026-109608 | ERP, Open source | Disclosed | High priority | |
Frappe ERPNextCVE-2026-109652 | ERP, Open source | Disclosed | High priority | |
Frappe ERPNextCVE-2026-109667 | ERP, Open source | Disclosed | High priority | |
FreeRDP FreeRDPCVE-2026-109676 | Remote access, Open source | Disclosed | High priority | |
NLTK NLTKCVE-2026-109956 | Machine learning, Open source, Developer infrastructure | Disclosed | High priority | |
IBM Planning AnalyticsCVE-2026-19620 | Business analytics, Enterprise software | Disclosed | High priority | |
IBM Planning AnalyticsCVE-2026-19622 | Business analytics, Enterprise software | Disclosed | High priority | |
IBM Planning AnalyticsCVE-2026-19627 | Business analytics, Enterprise software | Disclosed | High priority | |
Adobe Adobe Experience ManagerCVE-2026-48382 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-48383 | Content management, Web application | Disclosed | Act now | |
Microsoft Windows iSCSICVE-2026-69634 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows LibarchiveCVE-2026-69639 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows iSCSICVE-2026-69705 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows iSCSICVE-2026-69883 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Imaging ComponentCVE-2026-69886 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Internet Information ServicesCVE-2026-70024 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Rich Text Edit ControlCVE-2026-70096 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft PostScript Printer DriverCVE-2026-70147 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft PostScript Printer DriverCVE-2026-70153 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows System Information ConsoleCVE-2026-70157 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft Exchange ServerCVE-2026-70279 | Email, Enterprise infrastructure | Disclosed | Act now | |
Wazuh Wazuh managerCVE-2026-74034 | Security monitoring, Open source, Infrastructure | Disclosed | High priority | |
Wazuh Wazuh agentCVE-2026-74036 | Security monitoring, Open source, Infrastructure | Disclosed | High priority | |
Wazuh Wazuh managerCVE-2026-74037 | Security monitoring, Open source, Infrastructure | Disclosed | High priority | |
Wazuh Wazuh managerCVE-2026-74040 | Security monitoring, Open source, Infrastructure | Disclosed | Act now | |
Wazuh Wazuh managerCVE-2026-74041 | Security monitoring, Open source, Infrastructure | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-75732 | Content management, Web application | Disclosed | Act now | |
Adobe ColdFusionCVE-2026-75994 | Application server, Web application | Disclosed | Act now | |
IBM DataStage on Cloud Pak for DataCVE-2026-82096 | Data integration, Cloud platform | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-82101 | Data integration, Cloud platform | Disclosed | Act now | |
IBM DataStage on Cloud Pak for DataCVE-2026-82103 | Data integration, Cloud platform | Disclosed | Act now | |
IBM DataStage on Cloud Pak for DataCVE-2026-82108 | Data integration, Cloud platform | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-82110 | Data integration, Cloud platform | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-83662 | Content management, Web application | Disclosed | Act now | |
IBM Planning AnalyticsCVE-2026-85457 | Business analytics, Enterprise software | Disclosed | High priority | |
Microsoft Windows SchannelCVE-2026-85818 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
SAP S/4HANACVE-2026-89107 | ERP, Enterprise software | Disclosed | Act now | |
SAP Manufacturing Integration and IntelligenceCVE-2026-89108 | Manufacturing, Enterprise software | Disclosed | Act now | |
SAP NetWeaver Visual ComposerCVE-2026-89110 | Enterprise software, Application platform | Disclosed | Act now | |
SAP Commerce CloudCVE-2026-89113 | E-commerce, Enterprise software | Disclosed | High priority | |
Adobe ColdFusionCVE-2026-90530 | Application server, Web application | Disclosed | Act now | |
Adobe Adobe Experience ManagerCVE-2026-90532 | Content management, Web application | Disclosed | Act now | |
Adobe Adobe CommerceCVE-2026-91013 | E-commerce, Web application | Disclosed | Act now | |
Adobe Adobe CommerceCVE-2026-92464 | E-commerce, Web application | Disclosed | Act now | |
Adobe Adobe CommerceCVE-2026-92909 | E-commerce, Web application | Disclosed | Act now | |
IBM IBM iCVE-2026-93886 | Operating system, Enterprise infrastructure | Disclosed | High priority | |
IBM TRIRIGA Application PlatformCVE-2026-93892 | Enterprise software, Facilities management | Disclosed | High priority | |
IBM WebSphere Application Server LibertyCVE-2026-93895 | Application server, Enterprise infrastructure | Disclosed | Act now | |
IBM WebSphere Application Server LibertyCVE-2026-93909 | Application server, Enterprise infrastructure, Identity | Disclosed | Act now | |
IBM WebSphere Application ServerCVE-2026-95680 | Application server, Enterprise infrastructure, Identity | Disclosed | High priority | |
Microsoft Windows DNS ServerCVE-2026-96113 | Operating system, Network infrastructure | Disclosed | Act now | |
IBM IBM iCVE-2026-96119 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Microsoft Office OutlookCVE-2026-97016 | Office productivity, Email | Disclosed | Act now | |
Microsoft Windows Partition Management DriverCVE-2026-97805 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Text ShapingCVE-2026-97814 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft Windows Error ReportingCVE-2026-97815 | Operating system, Enterprise infrastructure | Disclosed | Act now | |
Microsoft OpenSSH for WindowsCVE-2026-97816 | Operating system, Remote access | Disclosed | Act now | |
Crawl4AI Crawl4AICVE-2026-109237 | AI, Web crawling, Developer infrastructure | Disclosed | High priority | |
Crawl4AI Crawl4AICVE-2026-109238 | AI, Web crawling, Cloud infrastructure | Disclosed | Act now | |
Open WebUI Open WebUICVE-2026-109286 | AI, Web applications | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-109305 | CMS, Web applications, PHP | Disclosed | High priority | |
Craft CMS Craft CMSCVE-2026-109308 | CMS, Web applications, PHP | Disclosed | High priority | |
LibreNMS LibreNMSCVE-2026-109357 | Network monitoring, Identity and access management | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-109371 | Identity and access management, Authentication | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-109373 | Identity and access management, Authentication | Disclosed | Act now | |
Red Hat Quarkus REST Data PanacheCVE-2026-87744 | Java, Web applications, Developer infrastructure | Disclosed | Act now | |
IBM Db2 Mirror for iCVE-2026-96012 | Databases, Enterprise infrastructure | Disclosed | Act now | |
ferdikoomen openapi-typescript-codegenCVE-2026-108551 | Developer tools, JavaScript/TypeScript, API tooling | Disclosed | Act now | |
Microsoft Azure SRE AgentCVE-2026-69435 | Cloud, Azure, Hosted services | Disclosed | Act now | |
Microsoft Azure App Service for LinuxCVE-2026-77900 | Cloud, Azure, PaaS, Hosted services | Disclosed | Act now | |
Microsoft Azure API CenterCVE-2026-83943 | Cloud, Azure, APIs, Hosted services | Disclosed | High priority | |
Microsoft Microsoft DataverseCVE-2026-88131 | Cloud, Dataverse, Power Platform, Hosted services | Disclosed | Act now | |
Microsoft Microsoft BookingsCVE-2026-94510 | Cloud, Microsoft 365, Hosted services | Disclosed | Act now | |
Microsoft Microsoft Partner CenterCVE-2026-96207 | Cloud, Partner ecosystem, Hosted services | Disclosed | Act now | |
ILIAS ILIASCVE-2026-107639 | E-learning, Web application, Open source | Disclosed | High priority | |
System Informer System InformerCVE-2026-107782 | Windows, System utilities, Open source | Disclosed | High priority | |
IBM DataPower GatewayCVE-2026-14502 | API gateway, Enterprise infrastructure, Integration | Disclosed | Act now | |
IBM DataPower GatewayCVE-2026-14905 | API gateway, Enterprise infrastructure, Integration | Disclosed | High priority | |
IBM DataPower GatewayCVE-2026-14992 | API gateway, Enterprise infrastructure, Integration | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-16823 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-16916 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-17189 | Identity and access management, Enterprise infrastructure | Disclosed | High priority | |
IBM Security Verify AccessCVE-2026-18740 | Identity and access management, Enterprise infrastructure | Disclosed | High priority | |
IBM Security Verify AccessCVE-2026-19482 | Identity and access management, Enterprise infrastructure | Disclosed | High priority | |
IBM Security Verify AccessCVE-2026-19491 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-19494 | Identity and access management, Enterprise infrastructure | Disclosed | High priority | |
IBM Security Verify AccessCVE-2026-78401 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Security Verify AccessCVE-2026-78406 | Identity and access management, Enterprise infrastructure | Disclosed | Act now | |
IBM Guardium Data ProtectionCVE-2026-82334 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-82335 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-82344 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-84244 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | Act now | |
IBM Guardium Data ProtectionCVE-2026-84250 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-84272 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-103360 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-104334 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-104335 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
Red Hat Red Hat Satellite 6CVE-2026-106471 | Systems management, Subscription management, Enterprise infrastructure | Disclosed | High priority | |
Cisco Cisco License On-PremCVE-2026-20328 | Network infrastructure, License management | Disclosed | Act now | |
Splunk Splunk EnterpriseCVE-2026-76268 | SIEM, Security operations, Data analytics | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76453 | Network infrastructure, Data center switching, Compute | Disclosed | High priority | |
Cisco Cisco License On-PremCVE-2026-76454 | Network infrastructure, License management | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76458 | Network infrastructure, Data center switching, Compute | Disclosed | High priority | |
Cisco Cisco NX-OS SoftwareCVE-2026-76459 | Network infrastructure, Data center switching, Compute | Disclosed | Act now | |
Cisco Cisco MerakiCVE-2026-76468 | Network infrastructure, Wireless, Security appliances, Cameras | Disclosed | High priority | |
Cisco Cisco MerakiCVE-2026-76472 | Network infrastructure, Wireless, Security appliances, Cameras | Disclosed | High priority | |
Cisco Cisco License On-PremCVE-2026-76480 | Network infrastructure, License management | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76485 | Network infrastructure, Data center switching | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76486 | Network infrastructure, Data center switching | Disclosed | Act now | |
Cisco Cisco Application Policy Infrastructure Controller (APIC)CVE-2026-76500 | Network infrastructure, Data center, SDN | Disclosed | Act now | |
Cisco Cisco NX-OS SoftwareCVE-2026-76501 | Network infrastructure, Data center switching | Disclosed | Act now | |
libexpat libexpatCVE-2026-77214 | Developer infrastructure, Libraries | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-88962 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-93445 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-93449 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-93674 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-93675 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
IBM Langflow OSSCVE-2026-97655 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97673 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97674 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97676 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97678 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97679 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
IBM Langflow OSSCVE-2026-97680 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
Planka PlankaCVE-2026-105835 | Project management, Web application | Disclosed | High priority | |
kvcache-ai MooncakeCVE-2026-106038 | AI, Machine learning, Developer infrastructure, Caching | Disclosed | Act now | |
Atlassian Atlassian Data Center productsCVE-2026-21589 | Developer infrastructure, Collaboration | Disclosed | Act now | |
Smarty SmartyCVE-2026-82531 | PHP, Web application, Templating | Disclosed | Act now | |
Red Hat Multicluster Engine for KubernetesCVE-2026-101919 | Kubernetes, Multi-cluster, Cloud infrastructure | Disclosed | High priority | |
Legcord LegcordCVE-2026-105293 | Desktop application, Messaging, Electron | Disclosed | Act now | |
Legcord LegcordCVE-2026-105294 | Desktop application, Messaging, Electron | Disclosed | Act now | |
Camunda Camunda 7CVE-2026-77226 | Process automation, BPM, Enterprise infrastructure | Disclosed | Act now | |
WWBN AVideoCVE-2026-105086 | Media, Web application | Disclosed | Act now | |
WWBN AVideoCVE-2026-105089 | Media, Web application | Disclosed | Act now | |
Shanghai AI Laboratory / InternLM MindSearchCVE-2026-105135 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
ZITADEL ZITADELCVE-2026-105207 | Identity and access management, Developer infrastructure | Disclosed | Act now | |
ZITADEL ZITADELCVE-2026-105208 | Identity and access management, Developer infrastructure | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-105209 | Identity and access management, Developer infrastructure | Disclosed | Act now | |
ZITADEL ZITADELCVE-2026-105210 | Identity and access management, Developer infrastructure | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-105211 | Identity and access management, Developer infrastructure | Disclosed | Act now | |
ZITADEL ZITADELCVE-2026-105212 | Identity and access management, Developer infrastructure | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-105213 | Identity and access management, Developer infrastructure | Disclosed | High priority | |
ZITADEL ZITADELCVE-2026-105215 | Identity and access management, Developer infrastructure | Disclosed | Act now | |
micro go-microCVE-2026-105216 | Developer infrastructure, Microservices | Disclosed | Act now | |
go-pay gopayCVE-2026-105218 | Payments, Developer infrastructure | Disclosed | Act now | |
mwilliamson mammoth.jsCVE-2026-105219 | Developer infrastructure, Web application | Disclosed | High priority | |
kvcache-ai Mooncake transfer engineCVE-2026-103764 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
kvcache-ai MooncakeCVE-2026-103765 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
Red Hat Red Hat Certificate SystemCVE-2026-104988 | PKI, Certificate authority, Identity infrastructure | Disclosed | High priority | |
Red Hat 389 Directory Server (389-ds-base)CVE-2026-86345 | Identity, Directory services, Infrastructure | Disclosed | High priority | |
Zod ZodCVE-2023-54404 | JavaScript, TypeScript, Validation libraries | Disclosed | High priority | |
n8n n8nCVE-2026-103246 | Automation, AI, Developer infrastructure | Disclosed | Act now | |
n8n n8nCVE-2026-103250 | Automation, AI, Chatbots | Disclosed | Act now | |
Tornado TornadoCVE-2026-103262 | Python, Web frameworks, HTTP clients | Disclosed | High priority | |
Ghost GhostCVE-2026-103271 | CMS, Publishing, JavaScript | Disclosed | High priority | |
Ghost GhostCVE-2026-103283 | CMS, Publishing, Authentication | Disclosed | Act now | |
Red Hat ForemanCVE-2026-12540 | Infrastructure management, Configuration management | Disclosed | High priority | |
Red Hat ForemanCVE-2026-12541 | Infrastructure management, Configuration management | Disclosed | High priority | |
Red Hat ForemanCVE-2026-96659 | Infrastructure management, Configuration management | Disclosed | Act now | |
Yonyou U8 CRMCVE-2023-54403 | CRM, Enterprise software | Disclosed | High priority | |
openclaw OpenClaw Windows NodeCVE-2026-101880 | AI agents, Windows | Disclosed | High priority | |
openclaw OpenClaw Windows NodeCVE-2026-101882 | AI agents, Windows | Disclosed | High priority | |
ModelTC LightLLMCVE-2026-103040 | AI, Machine learning, LLM inference | Disclosed | Act now | |
ModelTC LightLLMCVE-2026-103041 | AI, Machine learning, LLM inference | Disclosed | Act now | |
ModelTC LightLLMCVE-2026-103042 | AI, Machine learning, LLM inference | Disclosed | High priority | |
denoland DenoCVE-2026-103473 | JavaScript runtime, Developer infrastructure | Disclosed | Act now | |
ESnet iperf3CVE-2026-102253 | Networking, Developer infrastructure | Disclosed | High priority | |
NginxProxyManager nginx-proxy-managerCVE-2026-102334 | Reverse proxy, Infrastructure | Disclosed | High priority | |
gz-yami mall4jCVE-2026-102361 | E-commerce, Web application | Disclosed | Act now | |
Red Hat libsoupCVE-2026-102558 | Developer infrastructure, Enterprise software | Disclosed | High priority | |
Red Hat libsoupCVE-2026-102559 | Developer infrastructure, Enterprise software | Disclosed | High priority | |
OpenNMT CTranslate2CVE-2026-102566 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
VideoLAN VLCCVE-2026-102875 | Desktop software, Media | Disclosed | High priority | |
SurrealDB SurrealDBCVE-2026-102876 | Database, Developer infrastructure | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-84421 | Data integration, Enterprise software, Cloud Pak for Data | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-84436 | Data security, Enterprise software | Disclosed | Act now | |
IBM Guardium Data ProtectionCVE-2026-84842 | Data security, Enterprise software, REST API | Disclosed | High priority | |
Unsloth unsloth-zooCVE-2026-93348 | AI, Machine learning, Developer infrastructure | Disclosed | High priority | |
BerriAI LiteLLMCVE-2026-93355 | AI, API gateway, Developer infrastructure | Disclosed | High priority | |
aaPanel BaoTaCVE-2026-101007 | Web hosting, Server management, Developer infrastructure | Disclosed | High priority | |
aaPanel BaoTaCVE-2026-101008 | Web hosting, Server management, Developer infrastructure | Disclosed | Act now | |
aaPanel BaoTaCVE-2026-101009 | Web hosting, Server management, Developer infrastructure | Disclosed | High priority | |
vm2 vm2CVE-2026-100721 | JavaScript, Node.js, Developer infrastructure | Disclosed | Act now | |
Project-MONAI MONAICVE-2026-100840 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100841 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100843 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100844 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100845 | Python, AI, Machine learning | Disclosed | High priority | |
Project-MONAI MONAICVE-2026-100846 | Python, AI, Machine learning | Disclosed | High priority | |
AzuraCast AzuraCastCVE-2026-100847 | PHP, Web applications, Media streaming | Disclosed | High priority | |
AzuraCast AzuraCastCVE-2026-100852 | PHP, Web applications, Media streaming | Disclosed | High priority | |
AzuraCast AzuraCastCVE-2026-100856 | PHP, Web applications, Media streaming | Disclosed | High priority | |
AzuraCast AzuraCastCVE-2026-100857 | PHP, Web applications, Media streaming | Disclosed | High priority | |
Sylius SyliusCVE-2026-100870 | E-commerce, PHP, Symfony | Disclosed | High priority | |
Sylius SyliusCVE-2026-100871 | E-commerce, PHP, Symfony | Disclosed | High priority | |
Sylius SyliusCVE-2026-100872 | E-commerce, PHP, Symfony | Disclosed | High priority | |
pnpm pnpmCVE-2026-101043 | JavaScript, Package managers, Developer infrastructure | Disclosed | High priority | |
fleetdm FleetCVE-2026-101045 | Device management, macOS, MDM | Disclosed | High priority | |
obot-platform ObotCVE-2026-101062 | AI agents, MCP, OAuth | Disclosed | High priority | |
obot-platform ObotCVE-2026-101064 | AI agents, MCP | Disclosed | High priority | |
obot-platform ObotCVE-2026-101065 | AI agents, MCP, Docker | Disclosed | Act now | |
obot-platform ObotCVE-2026-101084 | AI agents, MCP, OAuth | Disclosed | Act now | |
nezhahq NezhaCVE-2026-101090 | Monitoring, OAuth2, Self-hosted | Disclosed | Act now | |
FlowiseAI FlowiseCVE-2026-100606 | AI, LLM applications, Authentication | Disclosed | Act now | |
FlowiseAI FlowiseCVE-2026-100607 | AI, LLM applications, Authentication | Disclosed | Act now | |
FlowiseAI FlowiseCVE-2026-100608 | AI, LLM applications, Job queues | Disclosed | High priority | |
parse-community Parse ServerCVE-2026-100631 | Backend infrastructure, Mobile backends, Push notifications | Disclosed | High priority | |
Netty NettyCVE-2026-100656 | Java, Networking, Web servers | Disclosed | High priority | |
Netty NettyCVE-2026-100657 | Java, Networking, Messaging | Disclosed | High priority | |
Netty NettyCVE-2026-100660 | Java, Networking, HTTP/3, QUIC | Disclosed | High priority | |
Netty NettyCVE-2026-100661 | Java, Networking, HTTP/3, QUIC | Disclosed | High priority | |
Netty NettyCVE-2026-100662 | Java, Networking, HTTP/3, QUIC | Disclosed | High priority | |
Netty NettyCVE-2026-100663 | Java, Networking, Proxies, HTTP/3 | Disclosed | High priority | |
Netty NettyCVE-2026-100664 | Java, Networking, Proxies, HTTP/3 | Disclosed | High priority | |
Netty NettyCVE-2026-100665 | Java, Networking, QUIC, TLS | Disclosed | High priority | |
Grav GravCVE-2026-100669 | CMS, Web servers, IIS | Disclosed | High priority | |
Grav GravCVE-2026-100670 | CMS, Web applications | Disclosed | High priority | |
Grav GravCVE-2026-100671 | CMS, Web applications | Disclosed | High priority | |
Grav Grav Comments pluginCVE-2026-100672 | CMS, Plugins | Disclosed | High priority | |
Grav Grav Data Manager pluginCVE-2026-100673 | CMS, Plugins | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100680 | Low-code platforms, Web applications | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100682 | Low-code platforms, Web applications | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100683 | Low-code platforms, Databases | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100684 | Low-code platforms, Authentication | Disclosed | Act now | |
Budibase BudibaseCVE-2026-100685 | Low-code platforms, Web applications | Disclosed | High priority | |
Budibase BudibaseCVE-2026-100686 | Low-code platforms, Web applications | Disclosed | High priority | |
Hugo HugoCVE-2026-100690 | Static site generators, Build pipelines | Disclosed | High priority | |
Hugo HugoCVE-2026-100692 | Static site generators, Build pipelines | Disclosed | High priority | |
Hugo HugoCVE-2026-100693 | Static site generators, Build pipelines | Disclosed | High priority | |
Adminer AdminerCVE-2026-100697 | Database tools, Web applications | Disclosed | High priority | |
nodemailer nodemailerCVE-2026-100700 | Node.js, Email infrastructure | Disclosed | High priority | |
IBM Guardium Data ProtectionCVE-2026-85542 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | Act now | |
BerriAI LiteLLMCVE-2026-89032 | AI, Machine learning, API gateway | Disclosed | Act now | |
QEMU QEMUCVE-2026-93834 | Virtualization, Enterprise infrastructure, Cloud infrastructure | Disclosed | Act now | |
Microsoft Microsoft OutlookCVE-2026-70125 | Email client, Office productivity | Disclosed | Act now | |
IBM Enterprise Build of QuarkusCVE-2026-77874 | Java, Application framework, Enterprise software | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-81539 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-81545 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-81548 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-81552 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
IBM DataStage on Cloud Pak for DataCVE-2026-82093 | Enterprise software, Data integration, Data pipelines | Disclosed | High priority | |
Red Hat pulpcoreCVE-2026-90959 | Repository management, Container registry, DevOps | Disclosed | High priority | |
SigNoz SigNozCVE-2026-97055 | Observability, Monitoring, Developer infrastructure | Disclosed | Act now | |
OFFIS DCMTKCVE-2026-97059 | Medical imaging, DICOM, Developer infrastructure | Disclosed | High priority | |
rejetto HFS2CVE-2026-97359 | File sharing, Web server, Developer infrastructure | Disclosed | Act now | |
IBM Financial Transaction Manager (FTM) for RedHat OpenShiftCVE-2026-18162 | Financial services, OpenShift, Kubernetes | Disclosed | Act now | |
IBM Financial Transaction Manager (FTM) for RedHat OpenShiftCVE-2026-18163 | Financial services, OpenShift, Kubernetes | Disclosed | Act now | |
IBM Financial Transaction Manager (FTM) for RedHat OpenShiftCVE-2026-18169 | Financial services, OpenShift, Kubernetes | Disclosed | Act now | |
IBM IBM ConcertCVE-2026-6721 | Enterprise software, AI operations | Disclosed | Act now | |
IBM IBM ConcertCVE-2026-6730 | Enterprise software, AI operations | Disclosed | Act now | |
IBM IBM ConcertCVE-2026-6928 | Enterprise software, AI operations | Disclosed | Act now | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-75884 | Kubernetes, OpenShift, Automation | Disclosed | Act now | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-76648 | Automation, API security | Disclosed | High priority | |
IBM IBM DataStage on Cloud Pak for DataCVE-2026-80379 | Data engineering, Enterprise software | Disclosed | High priority | |
IBM IBM DataStage on Cloud Pak for DataCVE-2026-80412 | Data engineering, Enterprise software | Disclosed | High priority | |
IBM IBM DataStage on Cloud Pak for DataCVE-2026-80425 | Data engineering, Enterprise software | Disclosed | High priority | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-84683 | Automation, Web application | Disclosed | High priority | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-84691 | Automation, Logging | Disclosed | High priority | |
Red Hat Red Hat Ansible Automation Platform 2CVE-2026-84719 | Automation, Kubernetes, OpenShift | Disclosed | Act now | |
Flatpak FlatpakCVE-2026-96275 | Linux, Package management, Sandboxing | Disclosed | High priority | |
orval-labs orvalCVE-2026-96754 | JavaScript, TypeScript, Developer infrastructure, API tooling | Disclosed | Act now | |
orval-labs orvalCVE-2026-96755 | JavaScript, TypeScript, Developer infrastructure, API tooling | Disclosed | Act now | |
orval-labs orvalCVE-2026-96759 | JavaScript, TypeScript, Developer infrastructure, API tooling | Disclosed | Act now | |
Meta Box Meta Box AIOCVE-2026-13355 | WordPress, CMS plugins, Developer infrastructure | Disclosed | Act now | |
SolarWinds Observability Self-HostedCVE-2026-28324 | IT monitoring, Observability | Disclosed | Act now | |
SolarWinds Observability Self-HostedCVE-2026-28325 | IT monitoring, Observability | Disclosed | High priority | |
Adobe Adobe ConnectCVE-2026-34689 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-73369 | Marketing automation, Web applications | Disclosed | Act now | |
Adobe Adobe ConnectCVE-2026-75682 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe ConnectCVE-2026-75684 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe ConnectCVE-2026-75689 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe ConnectCVE-2026-75698 | Collaboration, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-75699 | Marketing automation, Web applications | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-75721 | Marketing automation, Web applications | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-75728 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe AEM 6.5 Forms JEECVE-2026-75745 | Content management, Web applications | Disclosed | Act now | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80144 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80145 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80146 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80149 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80151 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80152 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80155 | Out-of-band management, Data center infrastructure | Disclosed | Act now | |
Lantronix SLC8000 / EMG8500 / EMG7500 out-of-band devicesCVE-2026-80156 | Out-of-band management, Data center infrastructure | Disclosed | High priority | |
Adobe AEM 6.5 Forms JEECVE-2026-81995 | Content management, Web applications | Disclosed | High priority | |
Adobe AEM 6.5 Forms JEECVE-2026-82000 | Content management, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-82003 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-82009 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-82011 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-82013 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-83660 | Marketing automation, Web applications | Disclosed | High priority | |
Adobe Adobe Campaign ClassicCVE-2026-89275 | Marketing automation, Web applications | Disclosed | Act now | |
Adobe Adobe Campaign ClassicCVE-2026-89276 | Marketing automation, Web applications | Disclosed | High priority | |
realmag777 HUSKY – Products Filter for WooCommerce ProfessionalCVE-2026-92969 | WordPress, WooCommerce, CMS plugins | Disclosed | High priority | |
OpenPrinting CUPSCVE-2026-95511 | Linux, Printing infrastructure, Open source | Disclosed | High priority | |
Vaultwarden VaultwardenCVE-2026-95814 | Password management, Self-hosted | Disclosed | High priority | |
Red Hat CRI-OCVE-2026-15801 | Kubernetes, Containers, Cloud infrastructure | Disclosed | High priority | |
Red Hat Red Hat Certificate SystemCVE-2026-80110 | Certificate authority, Linux servers, Identity infrastructure | Disclosed | High priority | |
Kamailio KamailioCVE-2026-93962 | Telecommunications, SIP infrastructure, VoIP | Disclosed | High priority | |
libexpat ExpatCVE-2026-93990 | Parsing libraries, Developer infrastructure, XML | Disclosed | High priority | |
argoproj Argo WorkflowsCVE-2026-93991 | Kubernetes, CI/CD, Developer infrastructure | Disclosed | High priority | |
mistralai Mistral VibeCVE-2026-93993 | AI, Developer tools, Agentic coding | Disclosed | High priority | |
James Heinrich getID3CVE-2026-94106 | Media processing, PHP libraries, Developer infrastructure | Disclosed | High priority | |
Red Hat Red Hat OpenShift Container Platform 4CVE-2026-75885 | Kubernetes, OpenShift, Container platforms | Disclosed | Act now | |
IBM Guardium Data ProtectionCVE-2026-81657 | Data security, Database monitoring, Enterprise infrastructure | Disclosed | Act now | |
vm2 vm2CVE-2026-93603 | JavaScript, Node.js, Developer infrastructure | Disclosed | Act now | |
vm2 vm2CVE-2026-93605 | JavaScript, Node.js, Developer infrastructure | Disclosed | Act now | |
Google PixelCVE-2026-58704 | Mobile devices, Android, Cellular baseband | Known exploited | Act now | |
Cisco Identity Services EngineCVE-2026-76460 | Identity and access management, Network security | Known exploited | Act now | |
Cisco Secure Email GatewayCVE-2026-76461 | Email security, Network security | Known exploited | Act now | |
JFrog ArtifactoryCVE-2026-42016 | Developer infrastructure, Artifact management, Supply chain | Known exploited | Act now | |
ConnectWise ScreenConnectCVE-2026-84869 | Remote access, IT support, Managed services | Known exploited | Act now | |
GitLab GitLabCVE-2026-85706 | DevOps, CI/CD, Source control | Known exploited | Act now | |
Fortinet FortiOSCVE-2025-25249 | Firewalls, Network security, SD-WAN | Known exploited | Act now | |
Citrix NetScalerCVE-2026-19490 | VPN, Network infrastructure, Remote access | Known exploited | Act now | |
Cisco Secure Firewall Management CenterCVE-2026-20079 | Firewalls, Network management, Security operations | Known exploited | Act now | |
Google ChromeCVE-2026-87491 | Web browsers, End-user devices | Known exploited | Act now | |
Adobe Adobe CommerceCVE-2026-75650 | E-commerce, Web applications, Payment processing | Known exploited | Act now | |
Microsoft WindowsCVE-2026-81963 | Operating systems, Endpoints | Known exploited | Act now | |
Microsoft WindowsCVE-2026-85880 | Operating systems, Endpoints | Known exploited | Act now | |
Kludex StarletteCVE-2026-48710 | Python, Web frameworks, ASGI, Developer infrastructure | Known exploited | Act now | |
BerriAI LiteLLMCVE-2026-59822 | AI, Developer infrastructure, API gateway | Known exploited | Act now | |
PaperCut PaperCut NG/MFCVE-2026-82078 | Print management, Enterprise applications, Java | Known exploited | Act now | |
ownCloud ownCloudCVE-2023-49105 | File sharing, WebDAV, Self-hosted services | Known exploited | Act now | |
Microsoft SQL ServerCVE-2019-1068 | Databases, Windows Server, Enterprise applications | Known exploited | Act now | |
Gitea GiteaCVE-2026-60004 | Developer infrastructure, Source control | Known exploited | Act now | |
Oracle Oracle HTTP ServerCVE-2026-21962 | Application servers, Enterprise middleware | Known exploited | Act now | |
Synacor Zimbra Collaboration SuiteCVE-2026-73570 | Email infrastructure, Collaboration | Known exploited | Act now | |
MLflow MLflowCVE-2026-64849 | AI, Machine learning, Developer infrastructure | Known exploited | Act now | |
Microsoft Windows IKE Service ExtensionsCVE-2026-33824 | Windows, IPsec, VPN infrastructure | Known exploited | Act now | |
Microsoft SharePoint ServerCVE-2026-55040 | Collaboration, Document management, On-premises infrastructure | Known exploited | Act now | |
Broadcom VMware vCenterCVE-2026-59310 | Virtualization, Infrastructure management | Known exploited | Act now | |
Apple macOSCVE-2026-65400 | Endpoints, Remote access, macOS | Known exploited | Act now | |
Ray-Project RayCVE-2025-62593 | AI, Machine learning, Developer infrastructure | Known exploited | Act now | |
Cisco Secure Firewall ASA and FTDCVE-2026-20349 | Network security, VPN | Known exploited | Act now | |
Microsoft WindowsCVE-2026-68820 | Operating systems, Endpoints, Kernel drivers | Known exploited | Act now | |
Metabase MetabaseCVE-2026-72898 | Analytics, Data platforms | Active exploitation | Act now | |
Apache TomcatCVE-2026-34486 | Java, Application servers | Known exploited | Act now | |
Fortinet FortiOSCVE-2025-68686 | Network security, VPN, Firewall infrastructure | Known exploited | Act now | |
JetBrains TeamCityCVE-2026-63077 | CI/CD, Developer infrastructure | Known exploited | Act now | |
Microsoft Azure Key VaultCVE-2026-62825 | Cloud, Secrets management, Microsoft Azure | Disclosed | Act now | |
JetBrains TeamCityCVE-2026-65906 | CI/CD, Developer infrastructure, Build systems | Disclosed | High priority | |
Check Point SmartConsoleCVE-2026-16232 | Network security, Security management, Firewall infrastructure | Known exploited | Act now | |
Microsoft SharePointCVE-2026-50522 | Collaboration, Enterprise applications, Windows Server | Known exploited | Act now | |
Mozilla FirefoxCVE-2026-16367 | Web browser, End-user devices, Email client | Disclosed | High priority | |
WordPress WordPress CoreCVE-2026-60137 | Content management, Web applications, PHP | Known exploited | Act now | |
Microsoft Active Directory Federation ServicesCVE-2026-56155 | Identity and access management, Active Directory, Windows Server | Known exploited | Act now | |
Adobe ColdFusionCVE-2026-48282 | Web application servers, Enterprise applications, Java | Known exploited | Act now | |
IBM LangflowCVE-2026-9198 | AI, Agent workflows | Known exploited | Act now | |
SimpleHelp SimpleHelpCVE-2026-48558 | Remote access, IT support tooling, Identity and access management | Known exploited | Act now | |
Google Gemini CLICVE-2026-12537 | AI, Developer infrastructure, CI/CD | Disclosed | High priority | |
Traefik TraefikCVE-2026-48020 | Networking, Reverse proxy, Cloud infrastructure | Disclosed | Act now | |
n8n n8nCVE-2026-54309 | Automation, AI, Developer infrastructure | Disclosed | Act now | |
IBM LangflowCVE-2026-10561 | AI, Machine learning, Developer infrastructure | Disclosed | Act now | |
Microsoft Azure Active DirectoryCVE-2026-45480 | Cloud, Identity and access management, Microsoft Azure | Disclosed | Act now | |
Progress LoadMasterCVE-2026-8037 | Infrastructure, Load balancers | Known exploited | Act now |
Either the filters are too specific, or security has finally been solved. Probably the filters.