https://www.cisa.gov/known-exploited-vulnerabilities-catalog Events collected by UnlimitedPipe 0.3.2 UnlimitedPipe 0.3.2 Fri, 25 Sep 2026 20:48:24 +0000 https://nvd.nist.gov/vuln/detail/CVE-2026-87902 ab84438e1bfdea8fe0e6 Fri, 25 Sep 2026 00:00:00 +0000 WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. https://nvd.nist.gov/vuln/detail/CVE-2026-67279 88d6a11b751670d47fe1 Fri, 25 Sep 2026 00:00:00 +0000 Mikrotik RouterOS contains an improper enforcement of behavioral workflow vulnerability that could allow an unauthenticated client to open a session channel and send an exec request. This vulnerability can be chained to achieve unauthenticated exploitation of CVE-2026-86060. https://nvd.nist.gov/vuln/detail/CVE-2026-65660 25d0d26e63e1b3f5bf4d Fri, 25 Sep 2026 00:00:00 +0000 Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. https://nvd.nist.gov/vuln/detail/CVE-2026-5430 29fac671bf9d04b86696 Thu, 24 Sep 2026 00:00:00 +0000 WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution. https://nvd.nist.gov/vuln/detail/CVE-2026-71362 2817ce0e3a8ba9dceab1 Thu, 24 Sep 2026 00:00:00 +0000 Adobe Commerce and Magento contains an incorrect authorization vulnerability that could allow an attacker to leverage this vulnerability to gain elevated access to sensitive resources without any user interaction. https://nvd.nist.gov/vuln/detail/CVE-2026-93952 67be48e65c645218aebe Tue, 22 Sep 2026 00:00:00 +0000 Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. https://nvd.nist.gov/vuln/detail/CVE-2026-94127 465f321a3ceb9c5a2af4 Tue, 22 Sep 2026 00:00:00 +0000 F5 BIG-IP APM contains a heap-based buffer overflow vulnerability when access policy and an OAuth profile are configured on a virtual server. This vulnerability could allow an unauthenticated attacker to perform remote code execution. https://nvd.nist.gov/vuln/detail/CVE-2026-93616 79106ba108418ee88520 Tue, 22 Sep 2026 00:00:00 +0000 Check Point Security Management Server, Multi-Domain Security Management Server, Log Server, Multi-Domain Log Server, and SmartEvent contain a path traversal vulnerability that allows an unauthenticated attacker to upload and execute arbitrary scripts. https://nvd.nist.gov/vuln/detail/CVE-2026-85102 7e99dea5d53586554bc9 Tue, 22 Sep 2026 00:00:00 +0000 Check Point Security Gateway and Check Point Spark Firewall using Site to Site VPN or Remote Access VPN contain an improper certificate validation vulnerability which could allow an unauthenticated remote attacker to execute arbitrary code on the Gateway. https://nvd.nist.gov/vuln/detail/CVE-2026-7273 5eccbd14a8c34d3dcf65 Mon, 21 Sep 2026 00:00:00 +0000 Zyxel GS1900 series switches contain a stack-based buffer overflow vulnerability in the CGI program which could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request. https://nvd.nist.gov/vuln/detail/CVE-2025-39964 76e99d93f317a3b9490a Fri, 18 Sep 2026 00:00:00 +0000 Linux Kernel contains a race condition vulnerability which allows concurrent writes to the same AF_ALG socket causing data to be unpredictably interleaved and creating inconsistencies in the socket's internal state. https://nvd.nist.gov/vuln/detail/CVE-2026-53266 e7f74b4fc396b51abc36 Fri, 18 Sep 2026 00:00:00 +0000 Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. https://nvd.nist.gov/vuln/detail/CVE-2025-39682 e55753219c57d8795f00 Fri, 18 Sep 2026 00:00:00 +0000 Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. https://nvd.nist.gov/vuln/detail/CVE-2026-58704 f7b40af07642577e7a85 Wed, 16 Sep 2026 00:00:00 +0000 Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. https://nvd.nist.gov/vuln/detail/CVE-2026-76460 e8e2c45ccc616e917acf Wed, 16 Sep 2026 00:00:00 +0000 Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) contain an incorrect use of privileged APIs vulnerability that could allow an unauthenticated, remote attacker to gain unauthorized access to the affected device by bypassing the web-based management interface. https://nvd.nist.gov/vuln/detail/CVE-2026-87886 d4f5db2c30263a6461df Wed, 16 Sep 2026 00:00:00 +0000 Acronis Backup plugin for cPanel & WHM and extension for Plesk contains an incorrect default permissions vulnerability that could allow for privilege escalation. https://nvd.nist.gov/vuln/detail/CVE-2026-76461 1bc9d683cee318714cee Mon, 14 Sep 2026 00:00:00 +0000 Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system. https://nvd.nist.gov/vuln/detail/CVE-2026-84869 ba3711696d036f8e5fb7 Fri, 11 Sep 2026 00:00:00 +0000 ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. https://nvd.nist.gov/vuln/detail/CVE-2026-42016 e0175e18460c7f2e6874 Fri, 11 Sep 2026 00:00:00 +0000 JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope. https://nvd.nist.gov/vuln/detail/CVE-2026-42018 84c78f22409a45622156 Fri, 11 Sep 2026 00:00:00 +0000 JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. https://nvd.nist.gov/vuln/detail/CVE-2026-85706 a6f445e75f71edc286e7 Fri, 11 Sep 2026 00:00:00 +0000 GitLab Community Edition and Enterprise Edition contains a path traversal vulnerability that allows an unauthenticated user to read arbitrary files due to an improper path confinement and missing authentication enforcement in the repository commits API. https://nvd.nist.gov/vuln/detail/CVE-2026-86060 bc734e2b8f4189b2f9e5 Thu, 10 Sep 2026 00:00:00 +0000 MikroTik RouterOS contains an improper neutralization of argument delimiters in a command vulnerability which allows an attacker to change the trusted RouterOS policy mask, leading to privilege escalation. https://nvd.nist.gov/vuln/detail/CVE-2026-67277 debd169f76d115203d03 Thu, 10 Sep 2026 00:00:00 +0000 MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service. https://nvd.nist.gov/vuln/detail/CVE-2026-19490 73a0fde528722e40367b Wed, 09 Sep 2026 00:00:00 +0000 Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication. https://nvd.nist.gov/vuln/detail/CVE-2025-25249 fc5c2ef20d6e11d37cba Wed, 09 Sep 2026 00:00:00 +0000 Fortinet FortiOS, FortiSwitchManager, and FortiSASE contain a heap-based buffer overflow vulnerability that allows an attacker to execute unauthorized code or commands via specially crafted packets. https://nvd.nist.gov/vuln/detail/CVE-2026-87491 bc98da9544afe6cfbc7c Wed, 09 Sep 2026 00:00:00 +0000 Google Chromium V8 contains an out of bounds write vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. https://nvd.nist.gov/vuln/detail/CVE-2026-20079 409c79fc4377083a2d84 Wed, 09 Sep 2026 00:00:00 +0000 Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. https://nvd.nist.gov/vuln/detail/CVE-2026-75650 5447bfc0c9cb9525ac83 Tue, 08 Sep 2026 00:00:00 +0000 Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code. https://nvd.nist.gov/vuln/detail/CVE-2026-81963 0dacc5bb7a25e4e05c2f Tue, 08 Sep 2026 00:00:00 +0000 Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. https://nvd.nist.gov/vuln/detail/CVE-2026-86218 3931e07531b683ba7cdd Tue, 08 Sep 2026 00:00:00 +0000 N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution. https://nvd.nist.gov/vuln/detail/CVE-2026-85880 1f51eef10b6c49a692cb Tue, 08 Sep 2026 00:00:00 +0000 Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally. https://nvd.nist.gov/vuln/detail/CVE-2026-85046 0c9c564f5e1643ec03e2 Fri, 04 Sep 2026 00:00:00 +0000 Google Chromium V8 contains a type confusion vulnerability that allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera. https://nvd.nist.gov/vuln/detail/CVE-2026-59822 18f6afe59232747f0237 Wed, 02 Sep 2026 00:00:00 +0000 BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could allow an unauthenticated attacker to establish an authenticated MCP session using an arbitrary Bearer token. https://nvd.nist.gov/vuln/detail/CVE-2026-48710 0affc3b9a4c7f7831643 Wed, 02 Sep 2026 00:00:00 +0000 Kludex Starlette contains a HTTP request/response smuggling vulnerability that could allow attackers to inject paths into the host part, prepending the actual path leading to issues such as authentication bypass when the authentication depends on the reconstructed URL’s path. This vulnerability could be chaned with CVE-2026-42271. https://nvd.nist.gov/vuln/detail/CVE-2026-49869 baa6270a10fc8ff7c06a Wed, 02 Sep 2026 00:00:00 +0000 Kestra OSS contains an OS command injection vulnerability that could allow an unauthenticated remote attacker to create and execute arbitrary workflows without credentials. https://nvd.nist.gov/vuln/detail/CVE-2026-82329 0d71a36568716a2c2ce2 Wed, 02 Sep 2026 00:00:00 +0000 JFrog Artifactory contains an improper authentication vulnerability that under default configuration can allow an unauthenticated attacker with network access to obtain administrative privileges. https://nvd.nist.gov/vuln/detail/CVE-2026-9586 ad226663d6c1b1382e3c Wed, 02 Sep 2026 00:00:00 +0000 Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. https://nvd.nist.gov/vuln/detail/CVE-2026-83548 3b84859d813b63b7c9c6 Wed, 02 Sep 2026 00:00:00 +0000 SonicWall SMA1000 Appliances contains a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to gain unauthorized access to sensitive functionality and perform unauthorized operations. https://nvd.nist.gov/vuln/detail/CVE-2026-83549 5e7b5467b30448ecafea Wed, 02 Sep 2026 00:00:00 +0000 SonicWall SMA1000 Appliances contains an OS command injection vulnerability that could enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution. https://nvd.nist.gov/vuln/detail/CVE-2026-82078 4811f7ff3db36f564626 Mon, 31 Aug 2026 00:00:00 +0000 PaperCut NG/MF contains an unsafe reflection vulnerability that allows an attacker to manipulate system configuration parameters and execute arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process. This vulnerability can be chained with CVE-2026-81578. https://nvd.nist.gov/vuln/detail/CVE-2026-81578 96a7c7f9e92745bea881 Mon, 31 Aug 2026 00:00:00 +0000 PaperCut NG/MF contains a missing authentication for critical function vulnerability which allows an unauthenticated remote attacker to modify certain system configurations. This vulnerability can be chained with CVE-2026-82078. https://nvd.nist.gov/vuln/detail/CVE-2023-49105 25ad37b2092d8e66da6a Thu, 27 Aug 2026 00:00:00 +0000 ownCloud contains an improper authentication vulnerability that allows an attacker to access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. https://nvd.nist.gov/vuln/detail/CVE-2026-53362 aac4148b09736816e51a Thu, 27 Aug 2026 00:00:00 +0000 Linux Kernel contains an unspecified vulnerability that can allow for privilege escalation via IPv6 networking subsystem. This vulnerability can impact multiple products, including but not limited to Suse, Red Hat, and other products using Linux. https://nvd.nist.gov/vuln/detail/CVE-2026-66384 b72c313a8c7cc07842fb Thu, 27 Aug 2026 00:00:00 +0000 JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerability. This can allow an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. https://nvd.nist.gov/vuln/detail/CVE-2021-23758 ad517523a6ceed513873 Wed, 26 Aug 2026 00:00:00 +0000 Ajax.NET Professional (AjaxPro) contains a deserialization of untrusted data vulnerability that could allow for remote code execution via arbitrary .NET classes. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. https://nvd.nist.gov/vuln/detail/CVE-2015-3246 a7776a7cc80cc0b03f9d Wed, 26 Aug 2026 00:00:00 +0000 Red Hat libuser contains a race condition vulnerability that allows authenticated local users to corrupt the /etc/passwd file to cause a denial of service or privilege escalation. https://nvd.nist.gov/vuln/detail/CVE-2015-5287 7dd63ff795ff27f95b49 Wed, 26 Aug 2026 00:00:00 +0000 Red Hat Automatic Bug Reporting Tool (ABRT) contains a privilege escalation vulnerability that could allow local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. https://nvd.nist.gov/vuln/detail/CVE-2022-0995 11fd2ade6ca9906d44f4 Wed, 26 Aug 2026 00:00:00 +0000 Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system. https://nvd.nist.gov/vuln/detail/CVE-2026-8452 758e69a2df55ae9c26a0 Wed, 26 Aug 2026 00:00:00 +0000 Citrix NetScaler ADC and NetScaler Gateway contain an improper restriction of operations within the bounds of a memory buffer vulnerability which could lead to denial of service. https://nvd.nist.gov/vuln/detail/CVE-2019-1068 4654bc2c95e885366729 Wed, 26 Aug 2026 00:00:00 +0000 Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account. https://nvd.nist.gov/vuln/detail/CVE-2026-60004 d3b75e81924acc4da610 Tue, 25 Aug 2026 00:00:00 +0000 Gitea contains a code injection vulnerability that allows an attacker with repository write access to send a malicious patch to the diffpatch API endpoint to plant an executable Git hook and run shell commands as the Gitea service account. https://nvd.nist.gov/vuln/detail/CVE-2026-21962 609705ee76e19a6d2d61 Mon, 24 Aug 2026 00:00:00 +0000 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in contain an improper access control vulnerability that can result in unauthorized creation, deletion or modification access to critical data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in accessible data. https://nvd.nist.gov/vuln/detail/CVE-2026-73570 5bac0d09be916b700b12 Fri, 21 Aug 2026 00:00:00 +0000 Zimbra Collaboration Suite (ZCS) contains an OS command injection vulnerability which could allow an unauthenticated attacker to send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. https://nvd.nist.gov/vuln/detail/CVE-2026-72530 55d4230645d932150061 Thu, 20 Aug 2026 00:00:00 +0000 TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system. https://nvd.nist.gov/vuln/detail/CVE-2026-72529 7f4f06eafea1383d4e33 Thu, 20 Aug 2026 00:00:00 +0000 TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script. https://nvd.nist.gov/vuln/detail/CVE-2026-64849 8e3a4d4e4a8b144bf5f3 Wed, 19 Aug 2026 00:00:00 +0000 MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body. https://nvd.nist.gov/vuln/detail/CVE-2026-33824 1aae49cf692a79cfee65 Tue, 18 Aug 2026 00:00:00 +0000 Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. https://nvd.nist.gov/vuln/detail/CVE-2026-59310 737f46936d45c908036c Tue, 18 Aug 2026 00:00:00 +0000 Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code. https://nvd.nist.gov/vuln/detail/CVE-2026-55040 8706bd01b522d10c0300 Tue, 18 Aug 2026 00:00:00 +0000 Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. https://nvd.nist.gov/vuln/detail/CVE-2026-65400 3c7b7ed3089e1f99330e Tue, 18 Aug 2026 00:00:00 +0000 Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials. https://nvd.nist.gov/vuln/detail/CVE-2025-62593 b59b22fd14f643c6154d Mon, 17 Aug 2026 00:00:00 +0000 Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari. https://nvd.nist.gov/vuln/detail/CVE-2026-20349 bed4be340e364dfe4c7a Tue, 11 Aug 2026 00:00:00 +0000 Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. https://nvd.nist.gov/vuln/detail/CVE-2026-68820 b53bab6e6169aeaeea1d Tue, 11 Aug 2026 00:00:00 +0000 Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. https://nvd.nist.gov/vuln/detail/CVE-2026-72898 1f10897b138f624f3a85 Tue, 11 Aug 2026 00:00:00 +0000 Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. https://nvd.nist.gov/vuln/detail/CVE-2026-8037 a1dabee790fd211529d8 Fri, 07 Aug 2026 00:00:00 +0000 Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints. https://nvd.nist.gov/vuln/detail/CVE-2026-63077 d473e150f634f1ef19e3 Wed, 05 Aug 2026 00:00:00 +0000 JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. https://nvd.nist.gov/vuln/detail/CVE-2026-18556 264daddcb62bbb8445f5 Tue, 04 Aug 2026 00:00:00 +0000 N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass. https://nvd.nist.gov/vuln/detail/CVE-2026-34486 207986f4dd22a0c40349 Tue, 04 Aug 2026 00:00:00 +0000 Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor. This vulnerability can be chained with CVE‑2025‑24813. https://nvd.nist.gov/vuln/detail/CVE-2026-9198 c56652201b3d91297fb5 Tue, 04 Aug 2026 00:00:00 +0000 Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments. https://nvd.nist.gov/vuln/detail/CVE-2026-18577 e591dfdcb1c7781dd253 Mon, 03 Aug 2026 00:00:00 +0000 N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556. https://nvd.nist.gov/vuln/detail/CVE-2026-20316 a2957252dfa9eb40f1fd Wed, 29 Jul 2026 00:00:00 +0000 Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. https://nvd.nist.gov/vuln/detail/CVE-2025-68686 93772f64fccc06261472 Mon, 27 Jul 2026 00:00:00 +0000 Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. https://nvd.nist.gov/vuln/detail/CVE-2026-16812 d66fd8be9530825e3d0a Mon, 27 Jul 2026 00:00:00 +0000 Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. https://nvd.nist.gov/vuln/detail/CVE-2026-16232 5de3e826d8a3853eb46f Wed, 22 Jul 2026 00:00:00 +0000 Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges. https://nvd.nist.gov/vuln/detail/CVE-2026-50522 0cc17a93cac376040213 Wed, 22 Jul 2026 00:00:00 +0000 Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. https://nvd.nist.gov/vuln/detail/CVE-2026-60137 a2d87589e0043f3b128d Tue, 21 Jul 2026 00:00:00 +0000 WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. https://nvd.nist.gov/vuln/detail/CVE-2026-63030 f21ef40ea44af267a86c Tue, 21 Jul 2026 00:00:00 +0000 WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. https://nvd.nist.gov/vuln/detail/CVE-2026-0770 cfac8e80dfce14103bde Tue, 21 Jul 2026 00:00:00 +0000 Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations. https://nvd.nist.gov/vuln/detail/CVE-2021-27137 c3c4a8417b33f4b7c39b Tue, 21 Jul 2026 00:00:00 +0000 DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability. https://nvd.nist.gov/vuln/detail/CVE-2026-58644 41abc44144427e9ae492 Thu, 16 Jul 2026 00:00:00 +0000 Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. https://nvd.nist.gov/vuln/detail/CVE-2026-25089 55e258917843570ff47d Thu, 16 Jul 2026 00:00:00 +0000 Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests. https://nvd.nist.gov/vuln/detail/CVE-2026-39808 5c2f3fb8aeb96d611556 Thu, 16 Jul 2026 00:00:00 +0000 Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests. https://nvd.nist.gov/vuln/detail/CVE-2026-46817 256d282444cf4004a982 Wed, 15 Jul 2026 00:00:00 +0000 Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. https://nvd.nist.gov/vuln/detail/CVE-2023-4346 8728ae2b3a28fd07ee6f Wed, 15 Jul 2026 00:00:00 +0000 KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device. https://nvd.nist.gov/vuln/detail/CVE-2026-56155 c0b6909a1bee18522201 Tue, 14 Jul 2026 00:00:00 +0000 Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. https://nvd.nist.gov/vuln/detail/CVE-2026-56164 cba7f9f9ff4a3f928406 Tue, 14 Jul 2026 00:00:00 +0000 Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. https://nvd.nist.gov/vuln/detail/CVE-2026-15409 e773397d1b592aa224f3 Tue, 14 Jul 2026 00:00:00 +0000 SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location. https://nvd.nist.gov/vuln/detail/CVE-2026-15410 db4bd05b2937c76295a6 Tue, 14 Jul 2026 00:00:00 +0000 SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. https://nvd.nist.gov/vuln/detail/CVE-2008-4128 b4f817ee5c457f42697d Mon, 13 Jul 2026 00:00:00 +0000 Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. https://nvd.nist.gov/vuln/detail/CVE-2026-56291 95793c11ba1a59f05fe9 Fri, 10 Jul 2026 00:00:00 +0000 Balbooa Forms contains an unrestricted upload of file with dangerous type vulnerability that allows an unauthenticated arbitrary file upload which could allow uploading of executable files leading to full RCE. https://nvd.nist.gov/vuln/detail/CVE-2026-48939 ca10d9055c490253753a Fri, 10 Jul 2026 00:00:00 +0000 iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution. https://nvd.nist.gov/vuln/detail/CVE-2026-48908 0a477e24816c73ae6599 Tue, 07 Jul 2026 00:00:00 +0000 JoomShaper SP Page Builder contains an unrestricted upload of file with dangerous type vulnerability that allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code. https://nvd.nist.gov/vuln/detail/CVE-2026-55255 82d207223085e94aa2ce Tue, 07 Jul 2026 00:00:00 +0000 Langflow contains an authorization bypass through user-controlled key vulnerability which allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request. https://nvd.nist.gov/vuln/detail/CVE-2026-56290 117ac2205847c803a64a Tue, 07 Jul 2026 00:00:00 +0000 Joomlack Page Builder contains an improper access control vulnerability that could allow for remote code execution via unauthenticated arbitrary file upload. https://nvd.nist.gov/vuln/detail/CVE-2026-48282 3121fdcac2b613df30b2 Tue, 07 Jul 2026 00:00:00 +0000 Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user. https://nvd.nist.gov/vuln/detail/CVE-2026-45659 6fe9ec8fd637ef6cc89d Wed, 01 Jul 2026 00:00:00 +0000 Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. https://nvd.nist.gov/vuln/detail/CVE-2026-48558 52eac36f372d280ca007 Mon, 29 Jun 2026 00:00:00 +0000 SimpleHelp contains an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity tokens submitted during login are accepted without verifying their cryptographic signature. In a vulnerable configuration, a remote, unauthenticated attacker can submit a forged token containing arbitrary identity claims to obtain a fully authenticated technician session. In some configurations, this may also allow bypass of multi-factor authentication. https://nvd.nist.gov/vuln/detail/CVE-2026-12569 d647262b48437bb0b2f5 Thu, 25 Jun 2026 00:00:00 +0000 PTC Windchill and FlexPLM contains an improper input validation vulnerability allowing an unauthenticated, remote attacker to execute arbitrary code by sending a malicious request to the network. https://nvd.nist.gov/vuln/detail/CVE-2026-20230 d57960d3767e3a37a2dd Thu, 25 Jun 2026 00:00:00 +0000 Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root. https://nvd.nist.gov/vuln/detail/CVE-2025-67038 378b38230de247f06535 Tue, 23 Jun 2026 00:00:00 +0000 Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges.