Fri, Apr 25 · 03:15 PM CDTCVE-2025-32432
10.0/10 · Must read/watchNVDvuln
Summary
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Starting from version 3.0.0-RC1 to before 3.9.15, 4.0.0-RC1 to before 4.14.15, and 5.0.0-RC1 to before 5.6.17, Craft is vulnerable to remote code execution. This is a high-impact, low-complexity attack vector. This iss
CVECVE-2025-32432
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 25 · 03:15 PM CDT
ModifiedThu, Sep 24 · 01:10 PM CDT
CVE-2026-5430
10.0/10 · Must read/watchNVDvuln
Summary
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result
CVECVE-2026-5430
SeverityCRITICAL
TypeUPDATED
PublishedThu, Aug 06 · 08:16 AM CDT
ModifiedFri, Sep 25 · 04:17 AM CDT
CVE-2026-70615
9.9/10 · Must read/watchNVDvuln
Summary
boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creatio
CVECVE-2026-70615
SeverityCRITICAL
TypeUPDATED
PublishedWed, Aug 05 · 08:17 PM CDT
ModifiedThu, Sep 24 · 08:43 PM CDT
CVE-2022-50796
9.8/10 · Must read/watchNVDvuln
Summary
SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw. Attackers can exploit the upload.cgi script to write malicious files to the system with www-data permissions, enabling unauthorized access and code execution
CVECVE-2022-50796
SeverityCRITICAL
TypeUPDATED
PublishedTue, Dec 30 · 11:15 PM CST
ModifiedThu, Sep 24 · 11:10 PM CDT
CVE-2023-53983
9.8/10 · Must read/watchNVDvuln
Summary
Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed. Attackers can leverage these hard-coded credentials to gain full remote system control without complex authentication mechanisms.
CVECVE-2023-53983
SeverityCRITICAL
TypeUPDATED
PublishedTue, Dec 30 · 11:15 PM CST
ModifiedThu, Sep 24 · 11:10 PM CDT
CVE-2023-54327
9.8/10 · Must read/watchNVDvuln
Summary
Tinycontrol LAN Controller 1.58a contains an authentication bypass vulnerability that allows unauthenticated attackers to change admin passwords through a crafted API request. Attackers can exploit the /stm.cgi endpoint with a specially crafted authentication parameter to disable access controls and modify administrati
CVECVE-2023-54327
SeverityCRITICAL
TypeUPDATED
PublishedTue, Dec 30 · 11:15 PM CST
ModifiedThu, Sep 24 · 11:10 PM CDT
CVE-2025-23006
9.8/10 · Must read/watchNVDvuln
Summary
Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central Management Console (CMC), which in specific conditions could potentially enable a remote unauthenticated attacker to execute arbitrary OS commands.
CVECVE-2025-23006
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jan 23 · 12:15 PM CST
ModifiedThu, Sep 24 · 01:10 PM CDT
CVE-2025-42599
9.8/10 · Must read/watchNVDvuln
Summary
Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sent by a remote unauthenticated attacker may lead to arbitrary code execution and/or a denial-of-service (DoS) condition.
CVECVE-2025-42599
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 18 · 04:15 AM CDT
ModifiedThu, Sep 24 · 01:10 PM CDT
CVE-2026-10579
9.8/10 · Must read/watchNVDvuln
Summary
A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.
CVECVE-2026-10579
SeverityCRITICAL
TypeUPDATED
PublishedTue, Aug 11 · 09:17 AM CDT
ModifiedThu, Sep 24 · 04:17 PM CDT
CVE-2026-65321
9.8/10 · Must read/watchNVDvuln
Summary
PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes DELETE and CTAS statements to the _escape_hive function that backslash-escapes single quotes rather than
CVECVE-2026-65321
SeverityCRITICAL
TypeUPDATED
PublishedSun, Aug 02 · 03:16 PM CDT
ModifiedThu, Sep 24 · 08:43 PM CDT
CVE-2026-69102
9.8/10 · Must read/watchNVDvuln
Summary
MaxKey contains an unauthorized access vulnerability due to a hard-coded JWT signing secret in application-maxkey.properties that allows unauthenticated attackers to forge valid JWT tokens and authenticate as any user by exploiting the password-skipped login endpoint. Attackers can craft a JWT token signed with the pub
CVECVE-2026-69102
SeverityCRITICAL
TypeUPDATED
PublishedTue, Aug 11 · 06:18 PM CDT
ModifiedThu, Sep 24 · 08:32 PM CDT
CVE-2026-69703
9.8/10 · Must read/watchNVDvuln
Summary
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record dele
CVECVE-2026-69703
SeverityCRITICAL
TypeUPDATED
PublishedTue, Aug 04 · 07:16 PM CDT
ModifiedThu, Sep 24 · 08:43 PM CDT
CVE-2026-17701
9.6/10 · Must read/watchNVDvuln
Summary
Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-17701
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jul 30 · 01:16 AM CDT
ModifiedThu, Sep 24 · 01:13 PM CDT
CVE-2026-17713
9.6/10 · Must read/watchNVDvuln
Summary
Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVECVE-2026-17713
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jul 30 · 01:16 AM CDT
ModifiedThu, Sep 24 · 01:14 PM CDT
CVE-2025-0108
9.1/10 · Must read/watchNVDvuln
Summary
An authentication bypass in the Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to bypass the authentication otherwise required by the PAN-OS management web interface and invoke certain PHP scripts. While invoking these PHP scripts does not enab
CVECVE-2025-0108
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 12 · 09:15 PM CST
ModifiedThu, Sep 24 · 01:10 PM CDT
CVE-2026-71362
9.1/10 · Must read/watchNVDvuln
Summary
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.
CVECVE-2026-71362
SeverityCRITICAL
TypeUPDATED
PublishedTue, Aug 11 · 06:18 PM CDT
ModifiedFri, Sep 25 · 04:17 AM CDT
CVE-2025-6558
8.8/10 · Worth your timeNVDvuln
Summary
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVECVE-2025-6558
SeverityHIGH
TypeUPDATED
PublishedTue, Jul 15 · 06:15 PM CDT
ModifiedThu, Sep 24 · 01:10 PM CDT
CVE-2026-59113
8.8/10 · Worth your timeNVDvuln
Summary
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVECVE-2026-59113
SeverityHIGH
TypeUPDATED
PublishedTue, Aug 11 · 05:18 PM CDT
ModifiedThu, Sep 24 · 02:17 PM CDT
CVE-2026-65660
8.8/10 · Worth your timeNVDvuln
Summary
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVECVE-2026-65660
SeverityHIGH
TypeUPDATED
PublishedTue, Aug 11 · 05:18 PM CDT
ModifiedFri, Sep 25 · 04:17 AM CDT
CVE-2026-67623
8.8/10 · Worth your timeNVDvuln
Summary
Mistral Vibe before 2.23.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands by embedding a malicious core.fsmonitor hook in a repository's .git/config file, which is triggered when vibe invokes git status --porcelain without suppressing hook execution. Attackers can dis
CVECVE-2026-67623
SeverityHIGH
TypeUPDATED
PublishedWed, Aug 05 · 02:17 PM CDT
ModifiedThu, Sep 24 · 08:43 PM CDT
CVE-2026-69118
8.8/10 · Worth your timeNVDvuln
Summary
Cachet through 2.4.1 contains a server-side template injection vulnerability in incident template rendering that allows authenticated users to execute arbitrary PHP code. Attackers can create malicious incident templates with Blade directives or Twig filters that execute system commands when incidents are created, achi
CVECVE-2026-69118
SeverityHIGH
TypeUPDATED
PublishedMon, Aug 10 · 08:17 PM CDT
ModifiedThu, Sep 24 · 08:43 PM CDT
CVE-2024-1753
8.6/10 · Worth your timeNVDvuln
Summary
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host roo
CVECVE-2024-1753
SeverityHIGH
TypeUPDATED
PublishedMon, Mar 18 · 03:15 PM CDT
ModifiedFri, Sep 25 · 12:16 AM CDT
CVE-2024-48248
8.6/10 · Worth your timeNVDvuln
Summary
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
CVECVE-2024-48248
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 04 · 08:15 AM CST
ModifiedThu, Sep 24 · 01:10 PM CDT
CVE-2025-30066
8.6/10 · Worth your timeNVDvuln
Summary
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code.)
CVECVE-2025-30066
SeverityHIGH
TypeUPDATED
PublishedSat, Mar 15 · 06:15 AM CDT
ModifiedThu, Sep 24 · 01:10 PM CDT
CVE-2026-71576
8.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source identity. This allows the at
CVECVE-2026-71576
SeverityHIGH
TypeUPDATED
PublishedMon, Aug 10 · 05:17 PM CDT
ModifiedThu, Sep 24 · 05:17 PM CDT
