Mon, Apr 20 · 04:16 AM CDTCVE-2026-32956
9.8/10 · Must read/watchNVDvuln
Summary
SD-330AC and AMC Manager provided by silex technology, Inc. contain a heap-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code may be executed on the device.
CVECVE-2026-32956
SeverityCRITICAL
TypeNEW
PublishedMon, Apr 20 · 04:16 AM CDT
ModifiedMon, Apr 20 · 04:16 AM CDT
CVE-2026-5963
9.8/10 · Must read/watchNVDvuln
Summary
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVECVE-2026-5963
SeverityCRITICAL
TypeNEW
PublishedMon, Apr 20 · 08:16 AM CDT
ModifiedMon, Apr 20 · 08:16 AM CDT
CVE-2026-5964
9.8/10 · Must read/watchNVDvuln
Summary
EasyFlow .NET developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents.
CVECVE-2026-5964
SeverityCRITICAL
TypeNEW
PublishedMon, Apr 20 · 08:16 AM CDT
ModifiedMon, Apr 20 · 08:16 AM CDT
CVE-2025-49794
9.1/10 · Must read/watchNVDvuln
Summary
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or
CVECVE-2025-49794
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 16 · 04:15 PM CDT
ModifiedSun, Apr 19 · 08:16 PM CDT
CVE-2025-49796
9.1/10 · Must read/watchNVDvuln
Summary
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive
CVECVE-2025-49796
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 16 · 04:15 PM CDT
ModifiedSun, Apr 19 · 08:16 PM CDT
CVE-2025-54236
9.1/10 · Must read/watchNVDvuln
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue doe
CVECVE-2025-54236
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 02:15 PM CDT
ModifiedTue, Apr 14 · 07:00 PM CDT
CVE-2026-32955
8.8/10 · Worth your timeNVDvuln
Summary
SD-330AC and AMC Manager provided by silex technology, Inc. contain a stack-based buffer overflow vulnerability in processing the redirect URLs. Arbitrary code may be executed on the device.
CVECVE-2026-32955
SeverityHIGH
TypeNEW
PublishedMon, Apr 20 · 04:16 AM CDT
ModifiedMon, Apr 20 · 04:16 AM CDT
CVE-2026-5967
8.8/10 · Worth your timeNVDvuln
Summary
ThreatSonar Anti-Ransomware developed by TeamT5 has an Privilege Escalation vulnerability. Authenticated remote attackers with shell access can inject OS commands and execute them with root privileges.
CVECVE-2026-5967
SeverityHIGH
TypeNEW
PublishedMon, Apr 20 · 09:16 AM CDT
ModifiedMon, Apr 20 · 09:16 AM CDT
CVE-2026-6581
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was detected in H3C Magic B1 up to 100R004. Affected by this vulnerability is the function SetMobileAPInfoById of the file /goform/aspForm. Performing a manipulation of the argument param results in buffer overflow. Remote exploitation of the attack is possible. The exploit is now public and may be used
CVECVE-2026-6581
SeverityHIGH
TypeNEW
PublishedSun, Apr 19 · 11:16 PM CDT
ModifiedSun, Apr 19 · 11:16 PM CDT
CVE-2026-33810
8.2/10 · Worth your timeNVDvuln
Summary
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in th
CVECVE-2026-33810
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 02:16 AM CDT
ModifiedSun, Apr 19 · 11:16 PM CDT
CVE-2024-26009
8.1/10 · Worth your timeNVDvuln
Summary
An authentication bypass using an alternate path or channel [CWE-288] vulnerability in Fortinet FortiOS 6.4.0 through 6.4.15, FortiOS 6.2.0 through 6.2.16, FortiOS 6.0 all versions, FortiPAM 1.2.0, FortiPAM 1.1.0 through 1.1.2, FortiPAM 1.0.0 through 1.0.3, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8
CVECVE-2024-26009
SeverityHIGH
TypeUPDATED
PublishedTue, Aug 12 · 07:15 PM CDT
ModifiedMon, Apr 20 · 09:16 AM CDT
CVE-2025-27363
8.1/10 · Worth your timeNVDvuln
Summary
An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing
CVECVE-2025-27363
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 11 · 02:15 PM CDT
ModifiedSun, Apr 19 · 11:16 PM CDT
CVE-2025-9566
8.1/10 · Worth your timeNVDvuln
Summary
There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritt
CVECVE-2025-9566
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 05 · 08:15 PM CDT
ModifiedSun, Apr 19 · 08:16 PM CDT
CVE-2026-5966
8.1/10 · Worth your timeNVDvuln
Summary
ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion vulnerability. Authenticated remote attackers with web access can exploit Path Traversal to delete arbitrary files on the system.
CVECVE-2026-5966
SeverityHIGH
TypeNEW
PublishedMon, Apr 20 · 08:16 AM CDT
ModifiedMon, Apr 20 · 08:16 AM CDT
CVE-2026-39454
7.8/10 · Worth your timeNVDvuln
Summary
SKYSEA Client View and SKYMEC IT Manager provided by Sky Co.,LTD. configure the installation folder with improper file access permission settings. A non-administrative user may manipulate and/or place arbitrary files within the installation folder of the product. As a result, arbitrary code may be executed with the adm
CVECVE-2026-39454
SeverityHIGH
TypeNEW
PublishedMon, Apr 20 · 09:16 AM CDT
ModifiedMon, Apr 20 · 09:16 AM CDT
CVE-2025-13601
7.7/10 · Worth your timeNVDvuln
Summary
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, l
CVECVE-2025-13601
SeverityHIGH
TypeUPDATED
PublishedWed, Nov 26 · 03:15 PM CST
ModifiedSun, Apr 19 · 08:16 PM CDT
CVE-2025-49795
7.5/10 · Worth your timeNVDvuln
Summary
A NULL pointer dereference vulnerability was found in libxml2 when processing XPath XML expressions. This flaw allows an attacker to craft a malicious XML input to libxml2, leading to a denial of service.
CVECVE-2025-49795
SeverityHIGH
TypeUPDATED
PublishedMon, Jun 16 · 04:15 PM CDT
ModifiedSun, Apr 19 · 08:16 PM CDT
CVE-2025-6021
7.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.
CVECVE-2025-6021
SeverityHIGH
TypeUPDATED
PublishedThu, Jun 12 · 01:15 PM CDT
ModifiedSun, Apr 19 · 08:16 PM CDT
CVE-2026-32965
7.5/10 · Worth your timeNVDvuln
Summary
Initialization of a resource with an insecure default vulnerability exists in SD-330AC and AMC Manager provided by silex technology, Inc. When the affected device is connected to the network with the initial (factory-default) configuration, the device can be configured with the null string password.
CVECVE-2026-32965
SeverityHIGH
TypeNEW
PublishedMon, Apr 20 · 04:16 AM CDT
ModifiedMon, Apr 20 · 04:16 AM CDT
CVE-2026-4111
7.5/10 · Worth your timeNVDvuln
Summary
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in
CVECVE-2026-4111
SeverityHIGH
TypeUPDATED
PublishedFri, Mar 13 · 07:55 PM CDT
ModifiedMon, Apr 20 · 04:16 AM CDT
CVE-2026-4424
7.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the
CVECVE-2026-4424
SeverityHIGH
TypeUPDATED
PublishedThu, Mar 19 · 03:16 PM CDT
ModifiedMon, Apr 20 · 08:16 AM CDT
CVE-2026-5121
7.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can exploit this by providing a specially crafted ISO9660 image, which can lead to a heap buffer overflow. This could potentially allow for arbitrary code execution
CVECVE-2026-5121
SeverityHIGH
TypeUPDATED
PublishedMon, Mar 30 · 08:16 AM CDT
ModifiedMon, Apr 20 · 09:16 AM CDT
CVE-2026-6569
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was identified in kodcloud KodExplorer up to 4.52. This impacts the function fileGet of the file /app/controller/share.class.php of the component fileGet Endpoint. Such manipulation of the argument fileUrl leads to improper authentication. The attack can be launched remotely. The vendor was contacted ea
CVECVE-2026-6569
SeverityHIGH
TypeNEW
PublishedSun, Apr 19 · 11:16 AM CDT
ModifiedSun, Apr 19 · 11:16 AM CDT
CVE-2026-6574
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability has been found in osuuu LightPicture up to 1.2.2. This issue affects some unknown processing of the file /public/install/lp.sql of the component API Upload Endpoint. Such manipulation of the argument key leads to hard-coded credentials. The attack may be performed from remote. The exploit has been discl
CVECVE-2026-6574
SeverityHIGH
TypeNEW
PublishedSun, Apr 19 · 02:16 PM CDT
ModifiedSun, Apr 19 · 02:16 PM CDT
CVE-2026-6577
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was identified in liangliangyy DjangoBlog up to 2.1.0.0. The impacted element is an unknown function of the file owntracks/views.py of the component logtracks Endpoint. The manipulation leads to missing authentication. The attack can be initiated remotely. The exploit is publicly available and might be
CVECVE-2026-6577
SeverityHIGH
TypeNEW
PublishedSun, Apr 19 · 08:16 PM CDT
ModifiedSun, Apr 19 · 08:16 PM CDT
