Tue, Jun 02 · 02:16 PM CDTCVE-2026-10611
10.0/10 · Must read/watchNVDvuln
Summary
An authentication bypass vulnerability exists in MISP when LDAP mixed authentication is enabled with OTP enforcement. In deployments configured with LdapAuth.mixedAuth=true and Security.require_otp=true, users authenticated through an authentication plugin, such as LDAP, may have their authenticated session established
CVECVE-2026-10611
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jun 02 · 02:16 PM CDT
ModifiedTue, Jun 16 · 01:29 AM CDT
CVE-2026-42364
9.9/10 · Must read/watchNVDvuln
Summary
An os command injection vulnerability exists in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution. An attacker can modify a configuration value to trigger this vulnerability.
CVECVE-2026-42364
SeverityCRITICAL
TypeUPDATED
PublishedMon, May 04 · 01:16 AM CDT
ModifiedMon, Jun 15 · 09:16 PM CDT
CVE-2026-42368
9.9/10 · Must read/watchNVDvuln
Summary
A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute priviledged operation. An attacker can visit a webpage to trigger this vulnerability.
CVECVE-2026-42368
SeverityCRITICAL
TypeUPDATED
PublishedMon, May 04 · 01:16 AM CDT
ModifiedMon, Jun 15 · 09:16 PM CDT
CVE-2018-1273
9.8/10 · Must read/watchNVDvuln
Summary
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions, contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data
CVECVE-2018-1273
SeverityCRITICAL
TypeUPDATED
PublishedWed, Apr 11 · 01:29 PM CDT
ModifiedMon, Jun 15 · 06:57 PM CDT
CVE-2022-32511
9.8/10 · Must read/watchNVDvuln
Summary
jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.
CVECVE-2022-32511
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 06 · 10:15 PM CDT
ModifiedMon, Jun 15 · 03:13 PM CDT
CVE-2024-39011
9.8/10 · Must read/watchNVDvuln
Summary
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other impacts via the function mergeObjects.
CVECVE-2024-39011
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jul 30 · 08:15 PM CDT
ModifiedMon, Jun 15 · 02:06 PM CDT
CVE-2026-27446
9.8/10 · Must read/watchNVDvuln
Summary
Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result
CVECVE-2026-27446
SeverityCRITICAL
TypeUPDATED
PublishedWed, Mar 04 · 09:15 AM CST
ModifiedMon, Jun 15 · 01:03 PM CDT
CVE-2026-45972
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF and double free in smb2_open_file() Zero out @err_iov and @err_buftype before retrying SMB2_open() to prevent an UAF bug if @data != NULL, otherwise a double free.
CVECVE-2026-45972
SeverityCRITICAL
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedTue, Jun 16 · 02:42 AM CDT
CVE-2026-7161
9.3/10 · Must read/watchNVDvuln
Summary
An insufficient encryption vulnerability exists in the Device Authentication functionality of GeoVision GV-IP Device Utility 9.0.5. Listening to broadcast packets can lead to credentials leak. An attacker can listen to broadcast messages to trigger this vulnerability. When interacting with various Geovision devices on
CVECVE-2026-7161
SeverityCRITICAL
TypeUPDATED
PublishedMon, May 04 · 01:16 AM CDT
ModifiedMon, Jun 15 · 09:17 PM CDT
CVE-2026-48188
9.1/10 · Must read/watchNVDvuln
Summary
An improper Input Validation vulnerability in OTRS or ((OTRS)) Community Edition database layer module allows an unauthenticated SQL injection which can lead to an authentication bypass. This issue only affects the system if the MySQL/MariaDB server is configured with the NO_BACKSLASH_ESCAPES SQL mode. This issue affec
CVECVE-2026-48188
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 01 · 04:16 AM CDT
ModifiedMon, Jun 15 · 12:45 PM CDT
CVE-2026-42370
9.0/10 · Must read/watchNVDvuln
Summary
A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
CVECVE-2026-42370
SeverityCRITICAL
TypeUPDATED
PublishedMon, May 04 · 01:16 AM CDT
ModifiedMon, Jun 15 · 09:16 PM CDT
CVE-2026-4408
9.0/10 · Must read/watchNVDvuln
Summary
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper escaping of shell meta-c
CVECVE-2026-4408
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 28 · 09:16 AM CDT
ModifiedMon, Jun 15 · 10:16 PM CDT
CVE-2026-4480
9.0/10 · Must read/watchNVDvuln
Summary
A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the "print command" setting via the "%J" substitution character without escaping shell meta characters. A remote attacker could exploit this vulnerability by sending a specially cra
CVECVE-2026-4480
SeverityCRITICAL
TypeUPDATED
PublishedTue, May 26 · 03:16 PM CDT
ModifiedMon, Jun 15 · 10:16 PM CDT
CVE-2023-50780
8.8/10 · Worth your timeNVDvuln
Summary
Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. Before version 2.29.0, this also included the Log4J2 MBean. This MBean is not meant for exposure to non-administrative users. This could eventually allow an aut
CVECVE-2023-50780
SeverityHIGH
TypeUPDATED
PublishedMon, Oct 14 · 04:15 PM CDT
ModifiedMon, Jun 15 · 01:03 PM CDT
CVE-2025-59249
8.8/10 · Worth your timeNVDvuln
Summary
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVECVE-2025-59249
SeverityHIGH
TypeUPDATED
PublishedTue, Oct 14 · 05:16 PM CDT
ModifiedMon, Jun 15 · 07:16 PM CDT
CVE-2026-31195
8.8/10 · Worth your timeNVDvuln
Summary
OS command injection vulnerability in the ping diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware 3GN8020801R13, 3GN8020802R0A, or 3GN8020803R0A inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary comma
CVECVE-2026-31195
SeverityHIGH
TypeUPDATED
PublishedTue, May 05 · 04:16 PM CDT
ModifiedMon, Jun 15 · 04:16 PM CDT
CVE-2026-31196
8.8/10 · Worth your timeNVDvuln
Summary
OS command injection vulnerability in the traceroute diagnostic handler in /bin/httpd_clientside in ALTICE LABS / SFR France GR140DG Fibre Router with firmware 3GN8020801R13, 3GN8020802R0A, or 3GN8020803R0A inserts unsanitized user input into a system() call, allowing authenticated remote attackers to execute arbitrary
CVECVE-2026-31196
SeverityHIGH
TypeUPDATED
PublishedTue, May 05 · 04:16 PM CDT
ModifiedMon, Jun 15 · 04:16 PM CDT
CVE-2026-45945
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix race condition during PASID entry replacement The Intel VT-d PASID table entry is 512 bits (64 bytes). When replacing an active PASID entry (e.g., during domain replacement), the current implementation calculates a new entry on the stac
CVECVE-2026-45945
SeverityHIGH
TypeUPDATED
PublishedWed, May 27 · 02:17 PM CDT
ModifiedTue, Jun 16 · 02:36 AM CDT
CVE-2026-42365
8.6/10 · Worth your timeNVDvuln
Summary
A guessable session cookie vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted series of HTTP requests can lead to an authentication bypas. An attacker can bruteforce session cookies to trigger this vulnerability.
CVECVE-2026-42365
SeverityHIGH
TypeUPDATED
PublishedMon, May 04 · 01:16 AM CDT
ModifiedMon, Jun 15 · 09:16 PM CDT
CVE-2025-53782
8.4/10 · Worth your timeNVDvuln
Summary
Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.
CVECVE-2025-53782
SeverityHIGH
TypeUPDATED
PublishedTue, Oct 14 · 05:15 PM CDT
ModifiedMon, Jun 15 · 07:17 PM CDT
CVE-2026-42897
8.1/10 · Worth your timeNVDvuln
Summary
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVECVE-2026-42897
SeverityHIGH
TypeUPDATED
PublishedThu, May 14 · 06:16 PM CDT
ModifiedMon, Jun 15 · 07:19 PM CDT
CVE-2025-53786
8.0/10 · Worth your timeNVDvuln
Summary
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security im
CVECVE-2025-53786
SeverityHIGH
TypeUPDATED
PublishedWed, Aug 06 · 04:15 PM CDT
ModifiedMon, Jun 15 · 07:19 PM CDT
CVE-2026-3012
8.0/10 · Worth your timeNVDvuln
Summary
A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verification. An attacker with the ability to intercept or redirect
CVECVE-2026-3012
SeverityHIGH
TypeUPDATED
PublishedWed, May 27 · 11:16 AM CDT
ModifiedMon, Jun 15 · 10:16 PM CDT
CVE-2023-53510
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix handling of lrbp->cmd ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes: - In the functions that submit a command, do not check the old value of lrbp-
CVECVE-2023-53510
SeverityHIGH
TypeUPDATED
PublishedWed, Oct 01 · 12:15 PM CDT
ModifiedMon, Jun 15 · 06:23 PM CDT
CVE-2024-49950
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr ffff8880241e9800 by task kworker/u9:0/54 CPU: 0 UID: 0 PID: 5
CVECVE-2024-49950
SeverityHIGH
TypeUPDATED
PublishedMon, Oct 21 · 06:15 PM CDT
ModifiedMon, Jun 15 · 06:26 PM CDT
