Site Map · 175 pages

Vulnerabilities

Each vulnerability page in the Knowledge Hub explains one CVE: the affected products and versions, whether attackers exploit it, and what to patch or check. This page lists every vulnerability page we keep, with a short summary of each.

Vulnerabilities 175

Vulnerabilities
Adobe ColdFusion Path Traversal Leading to Code Execution (CVE-2026-48282) CVE-2026-48282 lets unauthenticated attackers write files to a ColdFusion server when RDS is on. See fixed updates, CISA KEV status and what to do.
Apache OFBiz externalLoginKey Replay Flaw (CVE-2026-82907) CVE-2026-82907 is an Apache OFBiz authentication bypass where a captured externalLoginKey is reusable. Fixed in 24.09.08. See affected versions.
Apple CoreGraphics out-of-bounds write (CVE-2026-86950) CVE-2026-86950 is an exploited Apple CoreGraphics out-of-bounds write. See the fixed iOS, iPadOS and macOS builds and why four older models waited.
Apple Pointer Authentication Bypass (CVE-2024-27834) CVE-2024-27834 is an Apple WebKit Pointer Authentication bypass fixed in May 2024. CISA added it to KEV on 4 Nov 2026. See the fixed versions.
Arista VeloCloud Orchestrator improper input validation (CVE-2026-93952) CVE-2026-93952 is a CVSS 10.0 input validation flaw in Arista VeloCloud Orchestrator. Exploited, in CISA KEV since 22 Sep 2026. See fixed builds.
Arista VeloCloud Orchestrator OS command injection (CVE-2026-16812) CVE-2026-16812 is a CVSS 10.0 OS command injection in Arista VeloCloud Orchestrator. It is exploited and in CISA KEV. See fixed builds per train.
Babelfish for PostgreSQL TDS Prelogin Heap Overflow (CVE-2026-119923) CVE-2026-119923 is a Babelfish for PostgreSQL TDS prelogin heap overflow, CVSS 9.8. AWS fixed it in versions 4.10, 5.6 and 6.1.
Barracuda Appliance Timezone Field Command Injection (CVE-2026-111560) CVE-2026-111560 is a CVSS 8.6 flaw in six Barracuda appliances. See which products need an update and what a crafted timezone value lets an admin run.
Barracuda Email Security Gateway Authentication Bypass (CVE-2026-116606) CVE-2026-116606 is a CVSS 9.3 flaw letting an unauthenticated attacker restore a crafted backup to Barracuda ESG and change its global configuration.
BeyondTrust Remote Support and PRA command injection (CVE-2026-1731) CVE-2026-1731 lets outsiders run commands on BeyondTrust Remote Support and PRA with no login. In CISA's KEV catalog with ransomware use flagged.
BeyondTrust Remote Support authentication bypass (CVE-2026-102764) BeyondTrust Remote Support 26.2.3 and earlier lets an outsider act on the appliance without a login. CISA lists it as exploited. See fixes and checks.
BTCPay Server LND Macaroon Disclosure (CVE-2026-119757) CVE-2026-119757 lets unauthenticated attackers retrieve LND macaroon files in BTCPay Server before 2.4.2. CVSS 3.1 9.8. See who is affected and the fix.
Canonical LXD Certificate Chain Authentication Bypass (CVE-2026-112816) CVE-2026-112816 lets anyone who reaches the LXD HTTPS API sign in as a trusted client. Check affected tracks, snap channels and the fixed builds.
Check Point VPN login bypass (CVE-2026-50751) CVE-2026-50751 lets outsiders open Check Point VPN sessions without a password via IKEv1. Exploited since May 2026, in CISA KEV with ransomware use.
Cisco Catalyst SD-WAN Peering Authentication Bypass (CVE-2026-20182) CVE-2026-20182 lets an unauthenticated attacker gain admin rights on Cisco Catalyst SD-WAN. See affected releases, fixes and exploitation facts.
Cisco IOS XE web UI flaw (CVE-2023-20198) CVE-2023-20198 let attackers create a top-level account on Cisco IOS XE devices with the web UI on. Cisco confirmed attacks and CISA lists it as exploited.
Cisco SD-WAN authentication bypass (CVE-2026-20127) CVE-2026-20127 lets outsiders bypass login on Cisco Catalyst SD-WAN. Added to CISA KEV on 25 February 2026. Affected releases, fixes and hunting hints.
Cisco Secure Email Gateway arbitrary file write (CVE-2026-76519) CVE-2026-76519 is a critical Cisco Secure Email Gateway file write flaw in CISA KEV. See who is affected, the Content Scanner Tools fix and what to check.
Cisco Secure Firewall Management Center Authentication Bypass (CVE-2026-20079) CVE-2026-20079 lets an unauthenticated attacker reach root on Cisco Secure Firewall Management Center. See affected releases, fixes and KEV status.
Citrix ADC and Gateway code execution (CVE-2023-3519) CVE-2023-3519 lets outsiders run code on NetScaler ADC and Gateway. CISA reported zero-day use in June 2023. Affected builds, fixes and checks.
Citrix Bleed (CVE-2023-4966) CVE-2023-4966, Citrix Bleed, lets outsiders steal NetScaler session cookies and bypass MFA. CISA ties it to LockBit 3.0. Fixed builds and checks.
Citrix Bleed 2 (CVE-2025-5777) CVE-2025-5777, Citrix Bleed 2, lets outsiders read NetScaler memory. It is in CISA's KEV catalog. Affected builds, fixed versions and session reset.
Cleo Harmony, VLTrader and LexiCom file upload flaw (CVE-2024-50623) CVE-2024-50623 affects Cleo Harmony, VLTrader and LexiCom and can lead to remote code execution. CISA lists it as exploited. Affected builds and fixes.
ClickHouse Server Unauthenticated Remote Code Execution (CVE-2026-116366) CVE-2026-116366 can let an unauthenticated user run code on ClickHouse Server under certain conditions. See the fixed builds and what to do.
Collabora Online Built-in CODE Server command injection (CVE-2026-110447) CVE-2026-110447 is an unauthenticated command injection in Collabora's CODE Server app for Nextcloud, on CISA KEV. See versions, fix and checks.
Confluence broken access control (CVE-2023-22515) CVE-2023-22515 let attackers create Confluence administrator accounts without a login and is on CISA's exploited list. Versions, fixes and actions.
Contact Form 7 Unauthenticated File Upload to RCE (CVE-2026-114432) CVE-2026-114432 is an unauthenticated file upload flaw in Contact Form 7, the WordPress plugin with 10M+ installs. CVSS 3.1 9.8. Fixed in 6.2.4.
CPython SSLContext.wrap_bio() Hostname Verification Bypass (CVE-2026-19553) CVE-2026-19553: CPython SSLContext.wrap_bio() can skip TLS hostname checks silently. CVSS 4.0 7.6. Fixed in 3.10.22, 3.11.17, 3.12.15, 3.13.16, 3.14.8.
Craft CMS Unauthenticated SQL Injection in Element Search (CVE-2026-123488) CVE-2026-123488 is an unauthenticated SQL injection in Craft CMS's element search endpoint. CVSS 3.1 9.8 Critical. Fixed in 4.18.9 and 5.11.2.
CrushFTP authentication bypass (CVE-2025-31161) CVE-2025-31161 lets outsiders sign in to CrushFTP as any known user, such as crushadmin. It is in CISA's KEV catalog. Versions, fixes and hunting hints.
CVE-2026-76418 CVE-2026-76418 lets attackers crash affected Cisco ASA and FTD SSL VPN services. Review the configuration conditions, fixes, and exploitation status.
CVE-2026-93857 CVE-2026-93857 is a critical WatchGuard SIP proxy RCE. Check the required policy configuration, affected Fireware tracks and device-specific fixes.
CVE-2026-98432 Understand CVE-2026-98432, the Linux TCP use-after-free behind Anthropic's remote root exploit. Compare fixes, distro status and interim mitigation.
Dell PowerProtect Data Domain hard-coded cryptographic key (CVE-2026-86384) CVE-2026-86384 is a hard-coded cryptographic key flaw in Dell Data Domain that can expose credentials without a login. See affected builds and the fixes.
Dell PowerProtect Data Domain Management Center authentication bypass (CVE-2026-90717) CVE-2026-90717 is a 9.1 authentication bypass in Dell Data Domain Management Center that could impact managed systems. See affected builds and the fixes.
Dell PowerProtect Data Domain Management Center missing authorization (CVE-2026-103799) CVE-2026-103799 is a 9.6 missing authorization flaw in Dell Data Domain Management Center. See the affected DD OS builds, the fixed ones and what to check.
Dell PowerProtect Data Domain Management Center SQL injection (CVE-2026-103792) CVE-2026-103792 is a 9.6 SQL injection in Dell Data Domain Management Center that needs a low-privileged account. See the affected builds and the fixes.
Dell PowerProtect Data Domain stack-based buffer overflow (CVE-2026-103780) CVE-2026-103780 is a 9.8 stack-based buffer overflow in Dell Data Domain that needs no login. See the affected DD OS builds, the fixed ones and what to do.
Dell PowerProtect Data Domain unauthenticated privileged account creation (CVE-2026-86397) CVE-2026-86397 lets an unauthenticated attacker create a privileged account on Dell Data Domain. See the affected DD OS builds, fixes and what to check.
Dell PowerProtect Data Domain unauthenticated root command execution (CVE-2026-86400) CVE-2026-86400 lets an unauthenticated attacker run commands as root on Dell Data Domain. See the affected DD OS builds, the fixed ones and what to check.
Drupal core Field UI remote code execution (CVE-2026-108097) CVE-2026-108097 is a critical Drupal core Field UI code execution flaw. What it needs, which branches get no fix, and how to check and update.
Echo WebSocket Route Access Bypass (CVE-2026-118264) CVE-2026-118264 can bypass Echo route access checks after a rejected WebSocket upgrade. Check exposure and the 4.16.1 and 5.4.1 fixes.
Fastify Express Middleware Bypass (CVE-2026-112362) CVE-2026-112362 bypasses scoped Express checks in Fastify. Check the router option, affected plugin versions, and the 4.0.9 fix before rollout.
FortiManager missing authentication (CVE-2024-47575) CVE-2024-47575 is a critical FortiManager flaw that lets an attacker with no login run code. CISA lists it as exploited. See versions and fixes.
Fortinet CLI path traversal flaw (CVE-2025-61624) CVE-2025-61624 is a Fortinet CLI path traversal flaw that lets an admin write or delete files. CISA lists it as exploited. Versions and fixes.
Fortinet FortiClientEMS SQL Injection (CVE-2026-21643) CVE-2026-21643 is an unauthenticated SQL injection in FortiClientEMS 7.4.4, in CISA KEV since 13 April 2026. Fixed in 7.4.5. See what to check.
Fortinet FortiSandbox authentication bypass (CVE-2026-107656) CVE-2026-107656 is a critical FortiSandbox authentication bypass. See affected versions, the 5.0.7 and 4.4.10 fixes and what to check on the GUI.
Fortinet FortiSIEM path traversal (CVE-2026-106173) CVE-2026-106173 is a critical FortiSIEM path traversal in phQueryMaster. See affected versions, the 7.5.1 fix, the tcp 27918 workaround and checks.
FortiOS and FortiProxy authentication bypass (CVE-2024-55591) CVE-2024-55591 lets a remote attacker gain super-admin on FortiOS and FortiProxy and is on CISA's exploited list. Affected versions, fixes and workaround.
FortiOS SSL VPN out-of-bounds write (CVE-2024-21762) CVE-2024-21762 is a FortiOS SSL VPN flaw that allows remote code execution and is on CISA's exploited list. Affected versions, fixes and workaround.
FortiOS SSL-VPN heap overflow (CVE-2022-42475) CVE-2022-42475 is a FortiOS SSL-VPN heap overflow exploited in the wild, linked to Volt Typhoon and COATHANGER. Affected versions and fixes.
GitLab CI/CD regular expression compiler remote code execution (CVE-2026-97229) CVE-2026-97229 is a CVSS 10.0 GitLab CI/CD regex RCE fixed on 12 October. See who is affected, why 19.4.2 still needs 19.4.3, and what to check.
GitLab regular expression compiler remote code execution (CVE-2026-110264) CVE-2026-110264 is a critical GitLab unauthenticated RCE (CVSS 10.0). See affected versions, fixed releases from 19.5.1 to 18.11.13 and the CWE-190 cause.
GitLab Unauthenticated Arbitrary File Read in the Commits API (CVE-2026-85706) CVE-2026-85706 lets anyone read files from a GitLab server without logging in. See affected versions, fixed builds, CISA KEV status and what to do.
GLPI Two-Factor Authentication Bypass (CVE-2026-52848) CVE-2026-52848 is a GLPI two-factor bypass: a crafted URL skips the one-time password at login. Affects 11.0.0 to 11.0.7; fixed in 11.0.8.
GNU Inetutils telnetd Authentication Bypass (CVE-2026-24061) CVE-2026-24061 lets anyone log in as root on GNU Inetutils telnetd 1.9.3 to 2.7 with no password. See affected versions, KEV status and fixes.
GoAnywhere MFT License Servlet flaw (CVE-2025-10035) CVE-2025-10035 is a critical flaw in Fortra GoAnywhere MFT's License Servlet, listed in CISA's KEV catalog. Fixed releases 7.8.4 and 7.6.3, hunting hints.
GoAnywhere MFT remote code execution (CVE-2023-0669) CVE-2023-0669 lets outsiders run commands on GoAnywhere MFT. CISA and the FBI say Cl0p used it as a zero-day in early 2023. Fixes and checks.
GPUStack Loopback Authentication Bypass (CVE-2026-102895) CVE-2026-102895 lets a remote caller bypass GPUStack admin login with a spoofable loopback signal. CVSS 9.8, in CISA KEV. Fixed in 2.2.0.
HPE ArubaOS Maximum-Severity Authentication Bypass and Code Execution Flaws (CVE-2026-79844) CVE-2026-79844 and seven more CVSS 10 ArubaOS flaws, among 72 fixed by HPE. Affected and fixed AOS-8 and AOS-10 versions, workaround and exploit checks.
IBM API Connect Missing Authorization Tenant Takeover (CVE-2026-17362) CVE-2026-17362 is a missing-authorization flaw in IBM API Connect 12.1.0.0 through 12.1.1.2 that lets a remote attacker control tenants. CVSS 9.8.
IBM API Connect XXE Information Disclosure (CVE-2026-16884) CVE-2026-16884 is an XML external entity flaw in IBM API Connect that discloses data to a remote attacker. CVSS 3.1 9.9, fixed in 12.1.1.3.
IBM Aspera Faspex Authorization Bypass (CVE-2026-123218) CVE-2026-123218 is a missing-authorization flaw in IBM Aspera Faspex 5.0.0 through 5.0.19 that lets an attacker gain full admin rights. CVSS 3.1 9.8.
imgproxy ICO Loader Integer Overflow (CVE-2026-123614) CVE-2026-123614 is an integer overflow in imgproxy's ICO loader that can corrupt heap memory. CVSS 3.1 9.8, CVSS 4.0 9.3. Fixed in 4.0.16.
ISC BIND 9 GSS-TSIG memory corruption (CVE-2026-94300) CVE-2026-94300 is a High-rated BIND 9 GSS-TSIG memory corruption flaw. See affected versions, the fixes in 9.20.30 and 9.21.27, and how to check.
Ivanti authentication bypass (CVE-2023-46805) CVE-2023-46805 is an Ivanti Connect Secure and Policy Secure authentication bypass, chained with CVE-2024-21887. KEV status, CISA ED 24-01 and fixes.
Ivanti command injection (CVE-2024-21887) CVE-2024-21887 is a command injection in Ivanti Connect Secure and Policy Secure, chained with CVE-2023-46805. KEV status, CISA ED 24-01 and actions.
Ivanti Connect Secure buffer overflow (CVE-2025-22457) CVE-2025-22457 is a buffer overflow in Ivanti Connect Secure exploited since 2025 and in CISA's KEV catalog. Affected versions, fixes and hunting steps.
Ivanti Connect Secure bypass (CVE-2026-104935) CVE-2026-104935 lets an attacker with no login run commands on Ivanti Connect Secure. See affected versions, fixed builds, the KEV date and what to check.
Ivanti Connect Secure stack overflow (CVE-2025-0282) CVE-2025-0282 is a stack overflow in Ivanti Connect Secure that allows remote code execution. What it does, who is affected, and what CISA says to do.
Ivanti EPMM Code Injection Remote Code Execution (CVE-2026-1281) CVE-2026-1281 is an unauthenticated code injection in Ivanti EPMM, listed in CISA KEV since 29 January 2026. See the NVD version list and what to check.
Ivanti EPMM Second Code Injection Flaw (CVE-2026-1340) CVE-2026-1340 is a second unauthenticated Ivanti EPMM code injection, added to CISA KEV on 8 April 2026. See affected versions, signals and actions.
Jackson Type Validation Bypass (CVE-2026-110879) CVE-2026-110879 bypasses Jackson type checks in affected apps. Review the conditions for command execution and five patched jackson-databind releases.
Jenkins HTTP Proxy Configuration Disclosure (CVE-2026-117625) CVE-2026-117625 is a Jenkins missing permission check that lets Overall/Read users see HTTP proxy settings. Fixed in 2.588 and LTS 2.580.2. See versions.
JetBrains CLion Safe Mode Code Execution via JSON Compilation Database (CVE-2026-123832) CVE-2026-123832 lets a JSON compilation database project run code in CLion in Safe Mode. CVSS 3.1 9.6. JetBrains fixed it in CLion 2026.2.
JetBrains CLion Safe Mode Code Execution via Meson Settings (CVE-2026-123831) CVE-2026-123831 let JetBrains CLion run code from a project's Meson settings even in Safe Mode. CVSS 3.1 9.6. Fixed in CLion 2026.2 and 2026.1.4.
JetBrains IntelliJ IDEA Command Injection in Untrusted Projects (CVE-2026-123837) CVE-2026-123837 is a command injection flaw in IntelliJ IDEA's Tomcat run configurations on WSL. CVSS 3.1 7.8 High. Fixed in 2026.3 and 2026.2.1.
Joomla JCE Extension Unauthenticated Remote Code Execution (CVE-2026-48907) CVE-2026-48907 is an unauthenticated RCE in the Joomla JCE extension before 2.9.99.5. Check versions, rogue editor profiles and what to clean up.
Juniper Session Smart Conductor Command Injection (CVE-2026-103406) CVE-2026-103406 is a CVSS 9.8 command injection flaw in Juniper Session Smart Conductor, fixed in 7.0.5, 7.1.7 and 7.2.3. See the affected versions.
Juniper Session Smart Router Missing Authentication (CVE-2026-103409) CVE-2026-103409 is a CVSS 9.8 missing-authentication flaw in Juniper Session Smart Router, fixed in 7.0.5, 7.1.7 and 7.2.3. See the affected versions.
JupyterLab Desktop Local Server Token Exposure Leading to Code Execution (CVE-2026-86044) CVE-2026-86044 let an outside site read a local Jupyter server's token from JupyterLab Desktop after one click. CVSS 3.1 9.6. Fixed in 4.6.2-1.
Keycloak Client Management Code Injection (CVE-2026-120984) CVE-2026-120984 is a Keycloak client management flaw that lets an authenticated admin inject a JavaScript policy for code execution. CVSS 3.1 9.1.
Keycloak SAML Redirect Binding Signature Bypass (CVE-2026-117691) CVE-2026-117691 is a Keycloak SAML HTTP-Redirect signature bypass that Red Hat says can take over federated accounts. CVSS 3.1 9.1. See what is affected.
Kubeflow Pipelines Shared Upload Authorization Bypass (CVE-2026-77596) CVE-2026-77596 is a Kubeflow Pipelines authorization flaw that lets low-privilege tenants add shared pipeline versions. CVSS 3.1 9.6. Fixed in 2.18.0.
Langflow code execution flaw (CVE-2025-3248) CVE-2025-3248 lets anyone run code on Langflow servers before 1.3.0 with no login. It is in CISA's KEV catalog. Affected versions, fix and hunting hints.
Laravel TokenGuard Authentication Bypass (CVE-2026-114509) CVE-2026-114509 is an authentication bypass in Laravel's TokenGuard on MySQL and MariaDB. See affected versions, fixes 12.68.0 and 13.29.0, and checks.
Linux Kernel Copy Fail Privilege Escalation (CVE-2026-31431) CVE-2026-31431 is an exploited Linux kernel privilege escalation flaw. Check affected versions, remediation priorities, and defensive actions.
Log4Shell Log4Shell (CVE-2021-44228) is a critical remote code execution flaw in Apache Log4j 2. See who is affected, how attackers use it and what to do.
Metabase Unauthenticated SQL Injection via Password Reset (CVE-2026-72898) CVE-2026-72898 is an unauthenticated SQL injection in Metabase that gives admin access. Check fixed releases, the log pattern and what to rotate.
Microsoft Entra Device Registration Authorization Bypass (CVE-2026-109469) CVE-2026-109469 is a CVSS 3.1 10.0 authorization bypass in Microsoft Entra Device Registration. Microsoft already fixed it; no customer action is needed.
ModSecurity Multipart Filename Bypass (CVE-2026-104269) CVE-2026-104269 is a ModSecurity multipart filename bypass that defeats WAF upload rules. CVSS 3.1 8.6. The CVE record lists the fix as version 3.0.17.
Mongoose sanitizeFilter Bypass on countDocuments (CVE-2026-125120) CVE-2026-125120: Mongoose sanitizeFilter skips countDocuments(), a CVSS 9.8 query-operator injection fixed in 6.13.11, 7.8.12, 8.24.3 and 9.9.2.
MOVEit Transfer SQL injection CVE-2023-34362 is the MOVEit Transfer SQL injection zero-day that CISA and the FBI link to CL0P. See affected versions, KEV status and what to do.
N-able N-central Pre-Authentication Remote Code Execution (CVE-2026-86218) CVE-2026-86218 lets an unauthenticated attacker run code on N-able N-central servers. Check affected builds, the 2026.3.1.14 fix and KEV status.
NEC WebSAM WinShare: Three Flaws in One Advisory (CVE-2026-113363) CVE-2026-113363 is an unauthenticated command execution flaw in NEC WebSAM WinShare, CVSS 9.3. One JVN advisory bundles two more CVEs.
NetScaler SAML memory overread (CVE-2026-3055) CVE-2026-3055 lets outsiders read NetScaler memory when it acts as a SAML IDP. CISA KEV 30 March 2026. Affected builds and fixed versions from the vendor.
Next.js Image Optimization remote code execution (CVE-2026-96889) CVE-2026-96889 can lead to remote code execution through the Next.js Image Optimization API with SVG files on glibc-based Linux. See versions, fixes and steps.
Next.js use cache remote code execution (GHSA-673q-mjm6-r5xr) GHSA-673q-mjm6-r5xr: critical unauthenticated RCE in Next.js 16.0.0 to 16.4.0 use cache functions that return typed arrays. Fixed in 16.4.1, no workaround.
Node.js Brotli decoder remote code execution (CVE-2026-111497) CVE-2026-111497 is an out-of-bounds write in the Brotli decoder in Node.js and Python, called Node2Shell or HTTP2Shell. See fixed versions and what to do.
Nx Console poisoned release (CVE-2026-48027) CVE-2026-48027 covers Nx Console 18.95.0, a poisoned VS Code extension release that stole credentials in May 2026. In KEV. Fix: 18.100.0, rotate secrets.
OpenAM Notification WebSocket Session Disclosure (CVE-2026-123551) CVE-2026-123551 lets an unauthenticated attacker read live OpenAM session tokens from a notification WebSocket. CVSS 3.1 10.0, fixed in OpenAM 16.1.4.
OpenAM SAML Unsigned Assertion Bypass (CVE-2026-123550) CVE-2026-123550 lets an attacker send OpenAM an unsigned SAML assertion to get a session as any mapped user. CVSS 3.1 9.8, fixed in OpenAM 16.1.4.
OpenAM Self-Registration Attribute Bypass (CVE-2026-123549) CVE-2026-123549 lets an anonymous OpenAM self-registration bypass the attribute allow-list and join an administrative group. CVSS 3.1 9.8, fixed in 16.1.4.
openapi-typescript-codegen Code Injection (CVE-2026-108551) CVE-2026-108551 is a critical code injection in openapi-typescript-codegen up to 0.31.0. See who is at risk, the missing fix and safe CI steps.
OpenEMR Fax/SMS Module Access Control Bypass (CVE-2026-124450) CVE-2026-124450 lets a low-privilege OpenEMR user read and write arbitrary server files via the fax/sms module. CVSS 3.1 9.9, fixed in 8.3.0.
OpenEMR RingCentral Fax Client Path Traversal (CVE-2026-124490) CVE-2026-124490 lets an authenticated OpenEMR user read and write server files via the RingCentral fax client. CVSS 3.1 9.1, fixed in 8.3.0.
OPNsense os-acme-client Command Injection (CVE-2026-123025) CVE-2026-123025 is a command injection in the OPNsense os-acme-client Google Cloud DNS module that gives root. See affected versions and the 4.18 fix.
Oracle E-Business Suite Application Object Library Flaw (CVE-2026-101767) CVE-2026-101767 is an unauthenticated CVSS 9.8 flaw in Oracle E-Business Suite 12.2.3 to 12.2.15, fixed in October 2026. See the fix and what to check.
Oracle E-Business Suite remote code execution (CVE-2025-61882) CVE-2025-61882 lets outsiders run code on Oracle E-Business Suite 12.2.3 to 12.2.14. It is in CISA's KEV catalog. Affected versions, update, hunting hints.
Oracle Java SE JSSE Vulnerability (CVE-2026-91403) CVE-2026-91403 is a critical Oracle Java SE and GraalVM flaw in JSSE (CVSS 9.1). See affected versions, how it is reached and what to patch.
Oracle PeopleSoft PeopleTools Remote Code Execution Vulnerability (CVE-2026-35273) CVE-2026-35273 lets attackers take over Oracle PeopleSoft PeopleTools without a login. See the ShinyHunters WAF bypass, the three ZDI bugs and what to do.
PAN-OS CVE-2026-0322: management RCE and fixes CVE-2026-0322 lets a logged-in attacker run code as root through the PAN-OS management interface. In CISA KEV since 14 Oct 2026. Fixed versions and steps.
PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) CVE-2026-0257 lets attackers bypass GlobalProtect login on PAN-OS and open a VPN. In CISA KEV since 29 May 2026, ransomware use flagged. Fixes.
PAN-OS GlobalProtect command injection (CVE-2024-3400) CVE-2024-3400 lets an unauthenticated attacker run root commands on PAN-OS firewalls with GlobalProtect. Affected versions, KEV status and what to do.
PaperCut NG and MF authentication bypass (CVE-2023-27350) CVE-2023-27350 lets outsiders bypass login on PaperCut NG and MF and run code. FBI and CISA report ransomware use. Affected versions, fixes and checks.
pgAdmin 4 Import/Export Data Command Injection (CVE-2026-116241) CVE-2026-116241 lets a pgAdmin 4 user with the default Import/Export Data permission run OS commands on the pgAdmin host. Fixed in 9.19.
PHP core remote code execution (CVE-2026-109618) CVE-2026-109618 is a critical PHP RCE flaw rated 9.2 ("RCE via OOM corruption"). See the cause, affected versions, fixed releases and what to do.
PHP core remote code execution (CVE-2026-109619) CVE-2026-109619 is a critical PHP RCE flaw rated 9.2 ("RCE via stale global state"). See the cause, affected versions, fixed releases and what to do.
PHP session upload progress remote code execution (CVE-2026-115560) CVE-2026-115560 is an unpatched PHP session upload progress RCE path. See PHP's conditions, the setting to turn off and how it differs from PHP2Shell.
Pillow EPS Ghostscript Argument Injection (CVE-2026-112900) CVE-2026-112900 lets a crafted file name inject Ghostscript options in Pillow before 13.0.0. Who is at risk, how to check your version and what to do.
Pillow FlashPix Heap Buffer Overflow (CVE-2026-112398) CVE-2026-112398 is a heap overflow in Pillow's FlashPix reader, fixed in 13.0.0. It needs olefile installed. See who is at risk and how to check.
Plesk Site Import Path Traversal to Root RCE (CVE-2026-107246) CVE-2026-107246 is a critical Plesk Site Import path traversal flaw that may lead to root code execution. Review versions and actions.
Plex Media Server arbitrary file write (CVE-2026-96656) CVE-2026-96656 lets an admin write files that Plex Media Server runs on load. CISA lists it as exploited. See affected builds, the fix and what to check.
Plex Media Server searchOne URL injection (CVE-2026-96654) CVE-2026-96654 lets an attacker call other plugin functions in Plex Media Server. It is step two of Plex2Shell and CISA lists it as exploited. See the fix.
Plex Media Server timeline SSRF (CVE-2026-96652) CVE-2026-96652 is a request forgery in Plex Media Server and the first step of Plex2Shell. CISA lists it as exploited. See the fix and what to check.
Plex Media Server transcode SSRF (CVE-2026-96655) CVE-2026-96655 is a request forgery in the Plex Media Server transcoder and a link in the Plex2Shell chain. CISA lists it as exploited. See the fix.
Pocket ID Verified-Email Spoofing Flaw (CVE-2026-115770) CVE-2026-115770 lets a Pocket ID user get any unused email marked verified, enabling account linking in apps. Affects 2.2.0 to 2.12.0; fixed in 2.12.0.
PowerSYSTEM Center Authorization and SQL Injection Flaws (CVE-2026-63017) CVE-2026-63017 and CVE-2026-63774 affect PowerSYSTEM Center: incorrect authorization and SQL injection, both CVSS 4.0 9.4. See affected versions and fixes.
Progress WS_FTP Server Before 2025.0.5: Three CVEs Fixed (CVE-2026-115338, CVE-2026-115341, CVE-2026-115339) CVE-2026-115338, CVE-2026-115341 and CVE-2026-115339 hit Progress WS_FTP Server before 2025.0.5. CVSS up to 8.1. Fixed in version 2025.0.5.
ProxyLogon Exchange flaw (CVE-2021-26855) CVE-2021-26855 (ProxyLogon) lets attackers act as an on-premises Exchange server. CISA lists it as exploited, with known ransomware use, since 2021.
Quest Foglight for Databases Deserialization of Untrusted Data Remote Code Execution (CVE-2026-92190) CVE-2026-92190 is a deserialization flaw in the baseRmiServiceExporter bean of Quest Foglight for Databases 8.2.0. ZDI says Foglight 8.3 fixes it.
Quest Foglight for Databases External File Path Control Remote Code Execution (CVE-2026-92189) CVE-2026-92189 is an unvalidated file path in Quest Foglight for Databases that ZDI says gives code execution as SYSTEM. See version 8.2.0 and the 8.3 fix.
Quest Foglight for Databases Missing Authentication Remote Code Execution (CVE-2026-92188) CVE-2026-92188 lets unauthenticated attackers run code as SYSTEM on Quest Foglight for Databases 8.2.0. See the affected version and ZDI's fixed release.
React Server Components unauthenticated remote code execution (GHSA-xqc2-xf4c-x3h3) GHSA-xqc2-xf4c-x3h3 is a critical, CVSS 4.0 9.5 unauthenticated RCE in React Server Components, no CVE id. Fixed in 19.0.9, 19.1.10, 19.2.9 and 19.3.1.
React2Shell (CVE-2025-55182) in React Server Components CVE-2025-55182, React2Shell, lets outsiders run code on servers using React Server Components. In CISA's KEV catalog. Affected versions and fixes.
Redpanda Connect Streams Mode Unauthenticated RCE (CVE-2026-123270) CVE-2026-123270 lets anyone reach Redpanda Connect's management API with no login and run commands. CVSS 9.8. Default-off from v4.111.
SAP NetWeaver Visual Composer upload flaw (CVE-2025-31324) CVE-2025-31324 lets anyone upload files to SAP NetWeaver Visual Composer. Exploited since March 2025 and in CISA's KEV. Affected version and fixes.
ScreenConnect authentication bypass (CVE-2024-1709) CVE-2024-1709 lets an attacker add an admin account on ConnectWise ScreenConnect. CISA lists it as exploited and links it to Black Basta ransomware.
Security For WooCommerce Admin Account Creation Flaw (CVE-2026-100109) CVE-2026-100109 lets unauthenticated attackers create administrator accounts in Security For WooCommerce 1.0.10 to 1.0.16. WPScan lists no known fix.
SharePoint ToolShell remote code execution (CVE-2025-53770) CVE-2025-53770 (ToolShell) lets attackers run code on on-premises SharePoint and is on CISA's exploited list. Affected versions, fixed builds and actions.
Siemens Software Center DLL side-loading (CVE-2026-110936) CVE-2026-110936 is an exploited DLL side-loading flaw in Siemens Software Center, fixed in 4.0.9.8 and in CISA's KEV catalog. See the signs and what to do.
SimpleHelp OIDC JWT Authentication Bypass (CVE-2026-48558) CVE-2026-48558 is a CVSS 10 SimpleHelp OIDC authentication bypass in 5.5.15 and earlier, listed in CISA KEV. Check versions, fixes and signs of abuse.
SimpleHelp path traversal (CVE-2024-57727) CVE-2024-57727 lets outsiders download files from SimpleHelp servers. CISA links it to ransomware attacks. Affected versions, patches and hunting tips.
SmarterMail ConnectToHub flaw (CVE-2026-24423) CVE-2026-24423 lets outsiders run commands on SmarterMail servers via the ConnectToHub API. In CISA KEV, ransomware flagged. Fix: build 9511.
SonicWall SMA1000 Work Place Pre-Auth SSRF (CVE-2026-83548) CVE-2026-83548 is a pre-authentication SSRF in SonicWall SMA1000 that SonicWall says is exploited. See affected builds, fixed hotfixes and CISA KEV status.
SonicWall SMA1000 Work Place SSRF (CVE-2026-15409) CVE-2026-15409 is a critical SSRF in SonicWall SMA1000, in CISA KEV since 14 July 2026. See affected builds, fixes and the log indicators.
SonicWall SonicOS access control flaw (CVE-2024-40766) CVE-2024-40766 is an access control flaw in SonicWall SonicOS firewalls. CISA lists it as exploited and names Akira ransomware actors as users of it.
SonicWall SonicOS SSLVPN authentication bypass (CVE-2024-53704) CVE-2024-53704 lets attackers bypass SonicOS SSLVPN login. It is in CISA's KEV catalog with ransomware use flagged. Affected builds, fixes and log hints.
Sophos UTM Email Proxy Remote Code Execution (CVE-2026-118633) CVE-2026-118633 is a Critical Sophos UTM flaw that lets an attacker run commands as root through the email proxy. See who is affected and the manual patch.
Supermicro BMC Unprotected IPMI Commands (CVE-2026-18450) CVE-2026-18450 lets crafted packets run IPMI commands on an active Supermicro BMC session. Scores, preconditions and fixed BMC firmware by board.
SuperTokens Core Multi-Tenant Authorization Bypass (CVE-2026-123800) CVE-2026-123800 is a SuperTokens Core multi-tenant authorization bypass that lets one app rewrite a sibling app's API key. CVSS 9.9, fixed 16 Oct 2026.
Synology DSM SCGI and Login Logic Vulnerabilities (CVE-2026-13684, CVE-2026-13639) CVE-2026-13684 and CVE-2026-13639 are 9.8 Critical, no-login DSM flaws Synology fixed 18 September 2026. Scores, fixed builds and the ransomware dispute.
TanStack npm packages compromise (CVE-2026-45321) CVE-2026-45321 covers 84 malicious versions of 42 TanStack npm packages published 11 May 2026. In CISA's KEV catalog. Affected versions, fixes, hunting.
TeamCity agent protocol flaw (CVE-2026-63077) CVE-2026-63077 lets outsiders run commands on JetBrains TeamCity servers. CISA lists it as exploited with ransomware use. Fixed versions and log checks.
TeamCity authentication bypass (CVE-2024-27198) CVE-2024-27198 lets an outsider skip login on JetBrains TeamCity On-Premises and gain admin control. See affected versions, the fix and CISA KEV status.
TeamViewer Screen Decompression Integer Overflow (CVE-2026-111585) CVE-2026-111585 lets a malicious TeamViewer host crash the viewer that connects to it and possibly run code there. Fixed in 15.83; see every build.
Thales Sentinel Keys Server Unauthenticated Stack Buffer Overflow (CVE-2026-78403) CVE-2026-78403 may let an unauthenticated attacker run code as SYSTEM on Thales Sentinel Keys Server for Windows. See affected versions and steps.
TianoCore EDK II PXE Pre-Boot RCE (CVE-2026-97631) CVE-2026-97631 lets an attacker run code before the OS loads on PXE-booting EDK II machines. See fix status, Project Mu backports and what to do now.
Trivy supply chain compromise (CVE-2026-33634) CVE-2026-33634 is the March 2026 Trivy supply chain compromise: bad v0.69.4, moved Action tags, stolen CI secrets. In CISA KEV. Safe versions and rotation.
UniFi OS Command Injection (CVE-2026-34910) CVE-2026-34910 is a CVSS 10 command injection in UniFi OS, listed in CISA KEV. See affected devices, fixed versions and what to do.
UniFi OS Improper Access Control (CVE-2026-34908) CVE-2026-34908 is a CVSS 10 improper access control flaw in UniFi OS, listed in CISA KEV. See affected devices, fixed versions and what to update.
Veeam Backup & Replication authorization bypass (CVE-2026-108142) CVE-2026-108142 is a critical Veeam Backup & Replication authorization bypass. See affected 13.x builds, the fixed builds and what to check on CDP ports.
Veeam Backup for Microsoft 365 SQL Injection (CVE-2026-106076) CVE-2026-106076 is a critical SQL injection flaw in Veeam Backup for Microsoft 365. See affected builds, the 8.6 fix and the other KB4957 flaws.
Veeam ONE MFA bypass (CVE-2026-107671) CVE-2026-107671 lets an attacker with Administrator credentials switch off MFA in Veeam ONE 13.1. See affected builds, the 13.1 P1 fix and what to check.
VeloCloud Orchestrator SQL injection (CVE-2026-114625) CVE-2026-114625 lets any logged-in user act as superuser operator on Arista VeloCloud Orchestrator On-Prem. Arista says it is exploited. See fixed builds.
VMware ESX Insufficient Logging Vulnerability (CVE-2026-41709) CVE-2026-41709 lets a VMware ESX admin hide some actions from the logs. CISA lists it as exploited. See fixed builds, CrowdStrike's report and what to do.
VMware ESXi sandbox escape (CVE-2025-22225) CVE-2025-22225 is an ESXi sandbox escape used in attacks, with two sibling flaws. It is in CISA's KEV catalog. See affected builds and fixes.
VMware vCenter Syslog flaw (CVE-2026-59310) CVE-2026-59310 is a Critical vCenter Syslog flaw that allows remote code execution. CISA flags it as exploited with ransomware use. Fixed versions inside.
WatchGuard Firebox iked out-of-bounds write (CVE-2025-14733) CVE-2025-14733 is an IKEv2 out-of-bounds write in WatchGuard Fireware OS, exploited and in CISA's KEV catalog. Affected versions, fixes and hunting signs.
WinRAR CVE-2025-8088: path traversal flaw and fix WinRAR CVE-2025-8088 is a path traversal flaw that attackers used in real attacks. See who used it, which versions are hit and how to fix it.
WordPress Core Upgrade-Window Race Flaw (CVE-2026-119977) CVE-2026-119977 is a WordPress core upgrade-window race that lets unauthenticated attackers run code. In CISA KEV since 3 Nov 2026. See fixed versions.
WordPress Frontend Admin by DynamiApps Privilege Escalation (CVE-2026-119506) CVE-2026-119506 lets an unauthenticated visitor escalate privileges in WordPress Frontend Admin by DynamiApps. CVSS 9.1. Fixed in version 3.30.2.
WSO2 System REST API Broken Access Control (CVE-2025-11969) CVE-2025-11969 is a CVSS 9.4 flaw in WSO2 System REST APIs letting lower-privilege users run admin actions. See affected products and fixed update levels.
Zyxel AX7501-B1 Syslog Command Injection (CVE-2026-6952) CVE-2026-6952 is a post-auth command injection in Zyxel AX7501-B1 firmware via syslog LogServer, CVSS 7.2. Fixed in 5.17(ABPC.8)C0.