Mon, May 18 · 03:59 PM CDTCVE-2015-3306
10.0/10 · Must read/watchNVDvuln
Summary
The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site cpfr and site cpto commands.
CVECVE-2015-3306
SeverityCRITICAL
TypeUPDATED
PublishedMon, May 18 · 03:59 PM CDT
ModifiedFri, Oct 09 · 04:17 PM CDT
CVE-2021-3199
9.8/10 · Must read/watchNVDvuln
Summary
Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.
CVECVE-2021-3199
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 26 · 06:16 PM CST
ModifiedFri, Oct 09 · 02:20 PM CDT
CVE-2026-57967
9.8/10 · Must read/watchNVDvuln
Summary
An unauthenticated remote attacker can craft a CORE protocol SESSION_REATTACH packet to steal an existing session and assume ongoing execution of the previously authenticated session. This issue affects Apache Artemis: from 2.50.0 through 2.56.0; Apache ActiveMQ Artemis: from 1.0.0 through 2.44.0. Users are recommended
CVECVE-2026-57967
SeverityCRITICAL
TypeUPDATED
PublishedThu, Sep 10 · 05:17 AM CDT
ModifiedFri, Oct 09 · 04:17 PM CDT
CVE-2026-73663
9.8/10 · Must read/watchNVDvuln
Summary
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without escaping or bound parameters. An unauthenticated caller can inject SQL when a monito
CVECVE-2026-73663
SeverityCRITICAL
TypeUPDATED
PublishedThu, Aug 13 · 10:17 PM CDT
ModifiedFri, Oct 09 · 07:31 PM CDT
CVE-2026-73665
9.8/10 · Must read/watchNVDvuln
Summary
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth
CVECVE-2026-73665
SeverityCRITICAL
TypeUPDATED
PublishedThu, Aug 13 · 10:17 PM CDT
ModifiedFri, Oct 09 · 07:29 PM CDT
CVE-2026-83462
9.8/10 · Must read/watchNVDvuln
Summary
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server.
CVECVE-2026-83462
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 02:56 PM CDT
CVE-2000-0515
10.0/10 · Must read/watchNVDvuln
Summary
The snmpd.conf configuration file for the SNMP daemon (snmpd) in HP-UX 11.0 is world writable, which allows local users to modify SNMP configuration or gain privileges.
CVECVE-2000-0515
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 07 · 04:00 AM CDT
ModifiedFri, Oct 09 · 08:17 PM CDT
CVE-2012-2524
9.3/10 · Must read/watchNVDvuln
Summary
Microsoft Office 2007 SP2 and SP3 and 2010 SP1 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Computer Graphics Metafile (CGM) file, aka "CGM File Format Memory Corruption Vulnerability."
CVECVE-2012-2524
SeverityHIGH
TypeUPDATED
PublishedWed, Aug 15 · 01:55 AM CDT
ModifiedFri, Oct 09 · 08:17 PM CDT
CVE-2015-2466
9.3/10 · Must read/watchNVDvuln
Summary
Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted template, aka "Microsoft Office Remote Code Execution Vulnerability."
CVECVE-2015-2466
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 15 · 12:59 AM CDT
ModifiedFri, Oct 09 · 07:16 PM CDT
CVE-2015-2467
9.3/10 · Must read/watchNVDvuln
Summary
Microsoft Office 2007 SP3 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
CVECVE-2015-2467
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 15 · 12:59 AM CDT
ModifiedFri, Oct 09 · 07:16 PM CDT
CVE-2026-83456
8.8/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository. S
CVECVE-2026-83456
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 04:23 PM CDT
CVE-2026-83479
8.8/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.14-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contracts. Successful attacks of this vul
CVECVE-2026-83479
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 04:34 PM CDT
CVE-2026-83449
8.5/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. While the vulne
CVECVE-2026-83449
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 03:31 PM CDT
CVE-2026-83451
8.5/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. While the vul
CVECVE-2026-83451
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 04:29 PM CDT
CVE-2026-42013
8.2/10 · Worth your timeNVDvuln
Summary
A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-
CVECVE-2026-42013
SeverityHIGH
TypeUPDATED
PublishedTue, May 26 · 10:16 PM CDT
ModifiedSat, Oct 10 · 12:17 AM CDT
CVE-2026-5260
8.2/10 · Worth your timeNVDvuln
Summary
A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure.
CVECVE-2026-5260
SeverityHIGH
TypeUPDATED
PublishedTue, May 26 · 10:16 PM CDT
ModifiedFri, Oct 09 · 06:17 PM CDT
CVE-2026-83435
8.2/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.13-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material. While the vu
CVECVE-2026-83435
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 04:25 PM CDT
CVE-2026-83438
8.2/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Engineering. While the vulnerability i
CVECVE-2026-83438
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 04:31 PM CDT
CVE-2026-83461
8.2/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobile Application Server.
CVECVE-2026-83461
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 02:47 PM CDT
CVE-2026-83465
8.2/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Application Server
CVECVE-2026-83465
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 03:15 PM CDT
CVE-2026-93569
8.2/10 · Worth your timeNVDvuln
Summary
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, disc
CVECVE-2026-93569
SeverityHIGH
TypeUPDATED
PublishedFri, Sep 18 · 03:17 PM CDT
ModifiedSat, Oct 10 · 12:17 AM CDT
CVE-2016-3081
8.1/10 · Worth your timeNVDvuln
Summary
Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVECVE-2016-3081
SeverityHIGH
TypeUPDATED
PublishedTue, Apr 26 · 02:59 PM CDT
ModifiedFri, Oct 09 · 02:43 PM CDT
CVE-2024-3656
8.1/10 · Worth your timeNVDvuln
Summary
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.
CVECVE-2024-3656
SeverityHIGH
TypeUPDATED
PublishedWed, Oct 09 · 07:15 PM CDT
ModifiedFri, Oct 09 · 04:17 PM CDT
CVE-2026-83428
8.1/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository. S
CVECVE-2026-83428
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 04:35 PM CDT
CVE-2026-83429
8.1/10 · Worth your timeNVDvuln
Summary
Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand Signal Repository. S
CVECVE-2026-83429
SeverityHIGH
TypeUPDATED
PublishedTue, Sep 15 · 08:18 PM CDT
ModifiedFri, Oct 09 · 04:35 PM CDT
