Thu, Feb 05 · 06:16 PM CSTCVE-2025-68121
10.0/10 · Must read/watchNVDvuln
Summary
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Con
CVECVE-2025-68121
SeverityCRITICAL
TypeUPDATED
PublishedThu, Feb 05 · 06:16 PM CST
ModifiedWed, Apr 29 · 02:16 PM CDT
CVE-2020-9546
9.8/10 · Must read/watchNVDvuln
Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
CVECVE-2020-9546
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 02 · 04:15 AM CST
ModifiedWed, Apr 29 · 08:24 PM CDT
CVE-2025-4524
9.8/10 · Must read/watchNVDvuln
Summary
The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.2 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the e
CVECVE-2025-4524
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 21 · 07:16 AM CDT
ModifiedWed, Apr 29 · 08:16 PM CDT
CVE-2026-31848
9.8/10 · Must read/watchNVDvuln
Summary
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which contains Base64-encoded credential data combined with a static suffix. Because the encoding is reversible and lacks integrity protection, an attacker can reconstruct or forge a valid cookie value without p
CVECVE-2026-31848
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 23 · 01:16 PM CDT
ModifiedWed, Apr 29 · 05:45 PM CDT
CVE-2026-31851
9.8/10 · Must read/watchNVDvuln
Summary
Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout mechanisms on authentication interfaces. An attacker can perform unlimited authentication attempts against endpoints that rely on credential validation, enabling brute-force attacks to guess administrati
CVECVE-2026-31851
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 23 · 01:16 PM CDT
ModifiedWed, Apr 29 · 05:37 PM CDT
CVE-2026-35022
9.8/10 · Must read/watchNVDvuln
Summary
Anthropic Claude Code CLI and Claude Agent SDK contain an OS command injection vulnerability in authentication helper execution where helper configuration values are executed using shell=true without input validation. Attackers who can influence authentication settings can inject shell metacharacters through parameters
CVECVE-2026-35022
SeverityCRITICAL
TypeUPDATED
PublishedMon, Apr 06 · 08:16 PM CDT
ModifiedWed, Apr 29 · 07:00 PM CDT
CVE-2026-3548
9.8/10 · Must read/watchNVDvuln
Summary
Two buffer overflow vulnerabilities existed in the wolfSSL CRL parser when parsing CRL numbers: a heap-based buffer overflow could occur when improperly storing the CRL number as a hexadecimal string, and a stack-based overflow for sufficiently sized CRL numbers. With appropriately crafted CRLs, either of these out of
CVECVE-2026-3548
SeverityCRITICAL
TypeUPDATED
PublishedThu, Mar 19 · 06:16 PM CDT
ModifiedWed, Apr 29 · 06:41 PM CDT
CVE-2026-5264
9.8/10 · Must read/watchNVDvuln
Summary
Heap buffer overflow in DTLS 1.3 ACK message processing. A remote attacker can send a crafted DTLS 1.3 ACK message that triggers a heap buffer overflow.
CVECVE-2026-5264
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 09 · 10:16 PM CDT
ModifiedWed, Apr 29 · 05:18 PM CDT
CVE-2025-54236
9.1/10 · Must read/watchNVDvuln
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue doe
CVECVE-2025-54236
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 02:15 PM CDT
ModifiedWed, Apr 22 · 07:00 PM CDT
CVE-2026-5393
9.1/10 · Must read/watchNVDvuln
Summary
Dual-Algorithm CertificateVerify out-of-bounds read. When processing a dual-algorithm CertificateVerify message, an out-of-bounds read can occur on crafted input. This can only occur when --enable-experimental and --enable-dual-alg-certs is used when building wolfSSL.
CVECVE-2026-5393
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 10 · 12:16 AM CDT
ModifiedWed, Apr 29 · 01:58 PM CDT
CVE-2020-11112
8.8/10 · Worth your timeNVDvuln
Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
CVECVE-2020-11112
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 31 · 05:15 AM CDT
ModifiedWed, Apr 29 · 06:58 PM CDT
CVE-2020-11113
8.8/10 · Worth your timeNVDvuln
Summary
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVECVE-2020-11113
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 31 · 05:15 AM CDT
ModifiedWed, Apr 29 · 08:05 PM CDT
CVE-2026-31847
8.8/10 · Worth your timeNVDvuln
Summary
Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service
CVECVE-2026-31847
SeverityHIGH
TypeUPDATED
PublishedMon, Mar 23 · 01:16 PM CDT
ModifiedWed, Apr 29 · 05:46 PM CDT
CVE-2026-35029
8.8/10 · Worth your timeNVDvuln
Summary
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register
CVECVE-2026-35029
SeverityHIGH
TypeUPDATED
PublishedMon, Apr 06 · 05:17 PM CDT
ModifiedWed, Apr 29 · 08:16 PM CDT
CVE-2026-4566
8.8/10 · Worth your timeNVDvuln
Summary
A flaw has been found in Belkin F9K1122 1.00.33. The affected element is the function formWISP5G of the file /goform/formWISP5G. Executing a manipulation of the argument webpage can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used. The vendor was c
CVECVE-2026-4566
SeverityHIGH
TypeUPDATED
PublishedMon, Mar 23 · 03:16 AM CDT
ModifiedWed, Apr 29 · 10:10 PM CDT
CVE-2026-5550
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was identified in Tenda AC10 16.03.10.10_multi_TDE01. This affects the function fromSysToolChangePwd of the file /bin/httpd. The manipulation leads to stack-based buffer overflow. The attack may be initiated remotely. Multiple endpoints might be affected.
CVECVE-2026-5550
SeverityHIGH
TypeUPDATED
PublishedSun, Apr 05 · 08:16 AM CDT
ModifiedWed, Apr 29 · 11:44 PM CDT
CVE-2026-5685
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was identified in Tenda CX12L 16.03.53.12. This affects the function fromAddressNat of the file /goform/addressNat. The manipulation of the argument page leads to stack-based buffer overflow. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVECVE-2026-5685
SeverityHIGH
TypeUPDATED
PublishedMon, Apr 06 · 10:16 PM CDT
ModifiedWed, Apr 29 · 10:37 PM CDT
CVE-2026-5686
8.8/10 · Worth your timeNVDvuln
Summary
A security flaw has been discovered in Tenda CX12L 16.03.53.12. This vulnerability affects the function fromRouteStatic of the file /goform/RouteStatic. The manipulation of the argument page results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may
CVECVE-2026-5686
SeverityHIGH
TypeUPDATED
PublishedMon, Apr 06 · 10:16 PM CDT
ModifiedWed, Apr 29 · 10:35 PM CDT
CVE-2026-5687
8.8/10 · Worth your timeNVDvuln
Summary
A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. This manipulation of the argument page causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made available to the public and cou
CVECVE-2026-5687
SeverityHIGH
TypeUPDATED
PublishedMon, Apr 06 · 10:16 PM CDT
ModifiedWed, Apr 29 · 10:34 PM CDT
CVE-2026-5908
8.8/10 · Worth your timeNVDvuln
Summary
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
CVECVE-2026-5908
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 10:16 PM CDT
ModifiedWed, Apr 29 · 04:16 PM CDT
CVE-2026-5909
8.8/10 · Worth your timeNVDvuln
Summary
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
CVECVE-2026-5909
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 10:16 PM CDT
ModifiedWed, Apr 29 · 04:16 PM CDT
CVE-2026-5910
8.8/10 · Worth your timeNVDvuln
Summary
Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (Chromium security severity: Low)
CVECVE-2026-5910
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 10:16 PM CDT
ModifiedWed, Apr 29 · 04:16 PM CDT
CVE-2026-5912
8.8/10 · Worth your timeNVDvuln
Summary
Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Low)
CVECVE-2026-5912
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 10:16 PM CDT
ModifiedWed, Apr 29 · 04:16 PM CDT
CVE-2026-5914
8.8/10 · Worth your timeNVDvuln
Summary
Type Confusion in CSS in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)
CVECVE-2026-5914
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 08 · 10:16 PM CDT
ModifiedWed, Apr 29 · 04:16 PM CDT
CVE-2026-5988
8.8/10 · Worth your timeNVDvuln
Summary
A vulnerability was detected in Tenda F451 1.0.0.7. This impacts the function formWrlsafeset of the file /goform/AdvSetWrlsafeset. Performing a manipulation of the argument mit_ssid results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.
CVECVE-2026-5988
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 09 · 11:17 PM CDT
ModifiedWed, Apr 29 · 08:04 PM CDT
