Wed, Mar 25 · 03:16 PM CDTCVE-2025-59706
9.8/10 · Must read/watchNVDvuln
Summary
In N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables remote code execution.
CVECVE-2025-59706
SeverityCRITICAL
TypeUPDATED
PublishedWed, Mar 25 · 03:16 PM CDT
ModifiedSat, Apr 25 · 06:01 PM CDT
CVE-2025-59707
9.8/10 · Must read/watchNVDvuln
Summary
In N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vulnerability.
CVECVE-2025-59707
SeverityCRITICAL
TypeUPDATED
PublishedWed, Mar 25 · 03:16 PM CDT
ModifiedSat, Apr 25 · 06:01 PM CDT
CVE-2026-6951
9.8/10 · Must read/watchNVDvuln
Summary
Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221) that blocks the -c option but not the equivalent --config form. If untrusted input can reach the options argument passed t
CVECVE-2026-6951
SeverityCRITICAL
TypeUPDATED
PublishedSat, Apr 25 · 06:16 AM CDT
ModifiedSat, Apr 25 · 11:16 AM CDT
CVE-2026-40173
9.4/10 · Must read/watchNVDvuln
Summary
Dgraph is an open source distributed GraphQL database. Versions 25.3.1 and prior contain an unauthenticated credential disclosure vulnerability where the /debug/pprof/cmdline endpoint is registered on the default mux and reachable without authentication, exposing the full process command line including the admin token
CVECVE-2026-40173
SeverityCRITICAL
TypeUPDATED
PublishedWed, Apr 15 · 09:17 PM CDT
ModifiedSat, Apr 25 · 06:27 PM CDT
CVE-2025-54236
9.1/10 · Must read/watchNVDvuln
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue doe
CVECVE-2025-54236
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 02:15 PM CDT
ModifiedWed, Apr 22 · 07:00 PM CDT
CVE-2026-24467
9.0/10 · Must read/watchNVDvuln
Summary
OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Starting in version 1.0.0 and prior to version 2.0.13, OpenAEV's password reset implementation contains multiple security weaknesses that together allow reliable account takeover. The p
CVECVE-2026-24467
SeverityCRITICAL
TypeUPDATED
PublishedMon, Apr 20 · 04:16 PM CDT
ModifiedSat, Apr 25 · 06:00 PM CDT
CVE-2026-1323
8.8/10 · Worth your timeNVDvuln
Summary
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
CVECVE-2026-1323
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 17 · 09:16 AM CDT
ModifiedSat, Apr 25 · 06:37 PM CDT
CVE-2026-40261
8.8/10 · Worth your timeNVDvuln
Summary
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceReference parameter to a shell command without proper escaping, and additionally in the Perforce::generateP4Command() met
CVECVE-2026-40261
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 09:17 PM CDT
ModifiedSat, Apr 25 · 06:12 PM CDT
CVE-2026-4208
8.8/10 · Worth your timeNVDvuln
Summary
The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.
CVECVE-2026-4208
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 17 · 09:16 AM CDT
ModifiedSat, Apr 25 · 06:43 PM CDT
CVE-2026-6988
8.8/10 · Worth your timeNVDvuln
Summary
A flaw has been found in Tenda HG10 HG7_HG9_HG10re_300001138_en_xpon. This issue affects the function formRoute of the file /boaform/formRouting of the component Boa Service. This manipulation of the argument nextHop causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been published
CVECVE-2026-6988
SeverityHIGH
TypeNEW
PublishedSat, Apr 25 · 06:16 PM CDT
ModifiedSat, Apr 25 · 06:16 PM CDT
CVE-2026-7019
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was identified in Tenda F456 1.0.0.5. The impacted element is the function fromP2pListFilter of the file /goform/P2pListFilter. The manipulation of the argument menufacturer/Go leads to buffer overflow. The attack is possible to be carried out remotely. The exploit is publicly available and might be use
CVECVE-2026-7019
SeverityHIGH
TypeNEW
PublishedSun, Apr 26 · 05:16 AM CDT
ModifiedSun, Apr 26 · 05:16 AM CDT
CVE-2026-7029
8.8/10 · Worth your timeNVDvuln
Summary
A weakness has been identified in Tenda F456 1.0.0.5. The impacted element is the function fromaddressNat of the file /goform/addressNat. Executing a manipulation of the argument menufacturer/Go can lead to buffer overflow. The attack may be performed from remote. The exploit has been made available to the public and c
CVECVE-2026-7029
SeverityHIGH
TypeNEW
PublishedSun, Apr 26 · 09:16 AM CDT
ModifiedSun, Apr 26 · 09:16 AM CDT
CVE-2026-7030
8.8/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in Tenda F456 1.0.0.5. This affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVECVE-2026-7030
SeverityHIGH
TypeNEW
PublishedSun, Apr 26 · 10:16 AM CDT
ModifiedSun, Apr 26 · 10:16 AM CDT
CVE-2026-7031
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was detected in Tenda F456 1.0.0.5. This impacts the function fromSafeMacFilter of the file /goform/SafeMacFilter. The manipulation of the argument page results in buffer overflow. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVECVE-2026-7031
SeverityHIGH
TypeNEW
PublishedSun, Apr 26 · 10:16 AM CDT
ModifiedSun, Apr 26 · 10:16 AM CDT
CVE-2026-3605
8.1/10 · Worth your timeNVDvuln
Summary
An authenticated user with access to a kvv2 path through a policy containing a glob may be able to delete secrets they were not authorized to read or write, resulting in denial-of-service. This vulnerability did not allow a malicious user to delete secrets across namespaces, nor read any secret data. Fxed in Vault Comm
CVECVE-2026-3605
SeverityHIGH
TypeUPDATED
PublishedFri, Apr 17 · 04:16 AM CDT
ModifiedSat, Apr 25 · 06:08 PM CDT
CVE-2026-40176
7.8/10 · Worth your timeNVDvuln
Summary
Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shell commands by interpolating user-supplied Perforce connection parameters (port, user, client) without proper escaping. A
CVECVE-2026-40176
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 15 · 09:17 PM CDT
ModifiedSat, Apr 25 · 06:24 PM CDT
CVE-2026-34148
7.5/10 · Worth your timeNVDvuln
Summary
Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Prior to 1.9.6, 1.10.5, 2.0.8, and 2.1.1, @fedify/fedify follows HTTP redirects recursively in its remote document loader and authenticated document loader without enforcing a maximum redirect count or visited-URL loop detection.
CVECVE-2026-34148
SeverityHIGH
TypeUPDATED
PublishedMon, Apr 06 · 04:16 PM CDT
ModifiedSat, Apr 25 · 06:03 PM CDT
CVE-2026-4111
7.5/10 · Worth your timeNVDvuln
Summary
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in
CVECVE-2026-4111
SeverityHIGH
TypeUPDATED
PublishedFri, Mar 13 · 07:55 PM CDT
ModifiedSat, Apr 25 · 05:16 PM CDT
CVE-2026-6977
7.3/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in vanna-ai vanna up to 2.0.2. The affected element is an unknown function of the component Legacy Flask API. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor w
CVECVE-2026-6977
SeverityHIGH
TypeNEW
PublishedSat, Apr 25 · 11:16 AM CDT
ModifiedSat, Apr 25 · 11:16 AM CDT
CVE-2026-6980
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability has been found in Divyanshu-hash GitPilot-MCP up to 9ed9f153ba4158a2ad230ee4871b25130da29ffd. This impacts the function repo_path of the file main.py. Such manipulation of the argument command leads to command injection. The attack can be launched remotely. The exploit has been disclosed to the public a
CVECVE-2026-6980
SeverityHIGH
TypeNEW
PublishedSat, Apr 25 · 02:16 PM CDT
ModifiedSat, Apr 25 · 02:16 PM CDT
CVE-2026-6987
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was detected in PicoClaw up to 0.2.4. Impacted is an unknown function of the file /api/gateway/restart of the component Web Launcher Management Plane. Performing a manipulation results in command injection. It is possible to initiate the attack remotely. The project was informed of the problem early thr
CVECVE-2026-6987
SeverityHIGH
TypeNEW
PublishedSat, Apr 25 · 05:16 PM CDT
ModifiedSat, Apr 25 · 05:16 PM CDT
CVE-2026-7002
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was determined in KLiK SocialMediaWebsite up to 1.0.1. This vulnerability affects unknown code of the file /includes/get_message_ajax.php of the component Private Message Handler. Executing a manipulation of the argument c_id can lead to sql injection. It is possible to launch the attack remotely.
CVECVE-2026-7002
SeverityHIGH
TypeNEW
PublishedSat, Apr 25 · 10:16 PM CDT
ModifiedSat, Apr 25 · 10:16 PM CDT
CVE-2026-7022
7.3/10 · Worth your timeNVDvuln
Summary
A security vulnerability has been detected in SmythOS sre up to 0.0.15. Affected is the function AgentRuntime of the file packages/core/src/subsystems/AgentManager/AgentRuntime.class.ts of the component HTTP Header Handler. Such manipulation of the argument X-DEBUG-RUN/X-DEBUG-INJ leads to improper authentication. It i
CVECVE-2026-7022
SeverityHIGH
TypeNEW
PublishedSun, Apr 26 · 06:16 AM CDT
ModifiedSun, Apr 26 · 06:16 AM CDT
CVE-2026-7025
7.3/10 · Worth your timeNVDvuln
Summary
A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::sendPingHandle of the file var/Widget/Service.php of the component Ping Back Service Endpoint. The manipulation of the argument X-Pingback/link results in server-side request forgery. The attack may be launched remotely.
CVECVE-2026-7025
SeverityHIGH
TypeNEW
PublishedSun, Apr 26 · 08:16 AM CDT
ModifiedSun, Apr 26 · 08:16 AM CDT
CVE-2026-42255
7.2/10 · Worth your timeNVDvuln
Summary
Technitium DNS Server before 15.0 allows DNS traffic amplification via cyclic name server delegation.
CVECVE-2026-42255
SeverityHIGH
TypeNEW
PublishedSun, Apr 26 · 04:16 AM CDT
ModifiedSun, Apr 26 · 04:16 AM CDT
