Wed, Apr 29 · 08:16 PM CDTCVE-2018-25316
9.8/10 · Must read/watchNVDvuln
Summary
Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the goform/AdvSetDns endpoint with a crafted admin language cookie to change DNS servers and redirect us
CVECVE-2018-25316
SeverityCRITICAL
TypeUPDATED
PublishedWed, Apr 29 · 08:16 PM CDT
ModifiedMon, May 04 · 06:42 PM CDT
CVE-2018-25317
9.8/10 · Must read/watchNVDvuln
Summary
Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin language cookie
CVECVE-2018-25317
SeverityCRITICAL
TypeUPDATED
PublishedWed, Apr 29 · 08:16 PM CDT
ModifiedTue, May 05 · 02:46 AM CDT
CVE-2018-25318
9.8/10 · Must read/watchNVDvuln
Summary
Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient cookie validation. Attackers can send GET requests to the /goform/AdvSetDns endpoint with a crafted admin cookie to change DNS servers and redirect user
CVECVE-2018-25318
SeverityCRITICAL
TypeUPDATED
PublishedWed, Apr 29 · 08:16 PM CDT
ModifiedMon, May 04 · 06:40 PM CDT
CVE-2026-24178
9.8/10 · Must read/watchNVDvuln
Summary
NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execu
CVECVE-2026-24178
SeverityCRITICAL
TypeUPDATED
PublishedTue, Apr 28 · 07:36 PM CDT
ModifiedMon, May 04 · 02:34 PM CDT
CVE-2026-33446
9.8/10 · Must read/watchNVDvuln
Summary
CVE-2026-33446 is a buffer overflow in the authentication sub-system of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a special packet that can overwrite a small portion of memory conceivably leading to memory corruption or a denial of service.
CVECVE-2026-33446
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 30 · 08:16 PM CDT
ModifiedTue, May 05 · 02:19 AM CDT
CVE-2026-33447
9.8/10 · Must read/watchNVDvuln
Summary
CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50. Attackers with control of a modified server can send a special packet that can overwrite a small portion of memory conceivably leading to memory corruption or denial of service.
CVECVE-2026-33447
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 30 · 08:16 PM CDT
ModifiedTue, May 05 · 02:26 AM CDT
CVE-2026-35546
9.8/10 · Must read/watchNVDvuln
Summary
Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execute code and obtain a reverse shell.
CVECVE-2026-35546
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 17 · 08:16 PM CDT
ModifiedMon, May 04 · 02:31 PM CDT
CVE-2026-41274
9.8/10 · Must read/watchNVDvuln
Summary
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forwards user-provided input directly into the Cypher query execution pipeline without proper sanitization. An attacker can inject arbitrary Cypher commands that are executed on the under
CVECVE-2026-41274
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 23 · 10:16 PM CDT
ModifiedMon, May 04 · 06:33 PM CDT
CVE-2026-41940
9.8/10 · Must read/watchNVDvuln
Summary
cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel.
CVECVE-2026-41940
SeverityCRITICAL
TypeUPDATED
PublishedWed, Apr 29 · 04:16 PM CDT
ModifiedMon, May 04 · 06:09 PM CDT
CVE-2026-4670
9.8/10 · Must read/watchNVDvuln
Summary
Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass. This issue affects MOVEit Automation: from 2025.0.0 before 2025.0.9, from 2024.0.0 before 2024.1.8, versions prior to 2024.0.0.
CVECVE-2026-4670
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 30 · 04:16 PM CDT
ModifiedMon, May 04 · 06:20 PM CDT
CVE-2026-5166
9.6/10 · Must read/watchNVDvuln
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Path Traversal. This issue affects Pardus Software Center: before 0.6.4.
CVECVE-2026-5166
SeverityCRITICAL
TypeUPDATED
PublishedWed, Apr 29 · 04:16 PM CDT
ModifiedMon, May 04 · 02:16 PM CDT
CVE-2025-14543
9.1/10 · Must read/watchNVDvuln
Summary
Improper Restriction of XML External Entity Reference vulnerability in Connext Professional (Core Libraries) allows Serialized Data External Linking.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, fro
CVECVE-2025-14543
SeverityCRITICAL
TypeUPDATED
PublishedThu, Apr 30 · 04:16 PM CDT
ModifiedMon, May 04 · 01:02 PM CDT
CVE-2025-54236
9.1/10 · Must read/watchNVDvuln
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue doe
CVECVE-2025-54236
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 02:15 PM CDT
ModifiedMon, May 04 · 01:00 PM CDT
CVE-2026-24186
8.8/10 · Worth your timeNVDvuln
Summary
NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this vulnerability might lead to code execution.
CVECVE-2026-24186
SeverityHIGH
TypeUPDATED
PublishedTue, Apr 28 · 07:36 PM CDT
ModifiedMon, May 04 · 02:33 PM CDT
CVE-2026-35682
8.8/10 · Worth your timeNVDvuln
Summary
Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd), resulting in root‑level access.
CVECVE-2026-35682
SeverityHIGH
TypeUPDATED
PublishedFri, Apr 17 · 08:16 PM CDT
ModifiedMon, May 04 · 02:31 PM CDT
CVE-2026-36762
8.8/10 · Worth your timeNVDvuln
Summary
An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path traversal and write arbitrary files with whitelisted suffixes to arbitrary filesystem locations.
CVECVE-2026-36762
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 30 · 06:16 PM CDT
ModifiedMon, May 04 · 06:16 PM CDT
CVE-2026-36765
8.8/10 · Worth your timeNVDvuln
Summary
An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via injecting a crafted payload.
CVECVE-2026-36765
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 30 · 06:16 PM CDT
ModifiedMon, May 04 · 06:16 PM CDT
CVE-2026-36956
8.8/10 · Worth your timeNVDvuln
Summary
A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0. The router fails to implement proper CSRF protection mechanisms such as anti-CSRF tokens or strict Origin/Referer validation for administrative API endpoints. An attacker can craft a
CVECVE-2026-36956
SeverityHIGH
TypeUPDATED
PublishedThu, Apr 30 · 03:16 PM CDT
ModifiedTue, May 05 · 12:09 AM CDT
CVE-2026-40066
8.8/10 · Worth your timeNVDvuln
Summary
Anviz CX2 Lite and CX7 are vulnerable to unverified update packages that can be uploaded. The device unpacks and executes a script resulting in unauthenticated remote code execution.
CVECVE-2026-40066
SeverityHIGH
TypeUPDATED
PublishedFri, Apr 17 · 08:16 PM CDT
ModifiedMon, May 04 · 02:31 PM CDT
CVE-2026-5140
8.8/10 · Worth your timeNVDvuln
Summary
Improper neutralization of CRLF sequences ('CRLF injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Authentication Bypass. This issue affects Pardus Update: from 0.6.3 before 0.6.4.
CVECVE-2026-5140
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 29 · 02:16 PM CDT
ModifiedMon, May 04 · 02:16 PM CDT
CVE-2026-5161
8.8/10 · Worth your timeNVDvuln
Summary
Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Symlink Attack. This issue affects Pardus About: before 1.2.2.
CVECVE-2026-5161
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 29 · 03:16 PM CDT
ModifiedMon, May 04 · 02:16 PM CDT
CVE-2026-20082
8.6/10 · Worth your timeNVDvuln
Summary
A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly. This vulnerability is due to improper handling of new, incoming TCP connecti
CVECVE-2026-20082
SeverityHIGH
TypeUPDATED
PublishedWed, Mar 04 · 06:16 PM CST
ModifiedMon, May 04 · 05:03 PM CDT
CVE-2026-24222
8.6/10 · Worth your timeNVDvuln
Summary
NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environment variables not properly restricted during sandbox creation. A successf
CVECVE-2026-24222
SeverityHIGH
TypeUPDATED
PublishedTue, Apr 28 · 07:36 PM CDT
ModifiedMon, May 04 · 02:31 PM CDT
CVE-2026-35091
8.2/10 · Worth your timeNVDvuln
Summary
A flaw was found in Corosync. A remote unauthenticated attacker can exploit a wrong return value vulnerability in the Corosync membership commit token sanity check by sending a specially crafted User Datagram Protocol (UDP) packet. This can lead to an out-of-bounds read, causing a denial of service (DoS) and potentiall
CVECVE-2026-35091
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 01 · 02:16 PM CDT
ModifiedTue, May 05 · 10:16 AM CDT
CVE-2026-40434
8.1/10 · Worth your timeNVDvuln
Summary
Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.
CVECVE-2026-40434
SeverityHIGH
TypeUPDATED
PublishedFri, Apr 17 · 08:16 PM CDT
ModifiedMon, May 04 · 02:38 PM CDT
