Fri, Dec 19 · 09:15 PM CSTCVE-2023-53959
9.8/10 · Must read/watchNVDvuln
Summary
FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and replace the missing DLL to achieve remote code execution when the applicatio
CVECVE-2023-53959
SeverityCRITICAL
TypeUPDATED
PublishedFri, Dec 19 · 09:15 PM CST
ModifiedThu, Apr 09 · 09:19 PM CDT
CVE-2026-1340
9.8/10 · Must read/watchNVDvuln
Summary
A code injection in Ivanti Endpoint Manager Mobile allowing attackers to achieve unauthenticated remote code execution.
CVECVE-2026-1340
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jan 29 · 10:15 PM CST
ModifiedThu, Apr 09 · 02:03 PM CDT
CVE-2026-22886
9.8/10 · Must read/watchNVDvuln
Summary
OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default
CVECVE-2026-22886
SeverityCRITICAL
TypeUPDATED
PublishedTue, Mar 03 · 10:16 AM CST
ModifiedThu, Apr 09 · 07:47 PM CDT
CVE-2026-27634
9.8/10 · Must read/watchNVDvuln
Summary
Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concatenated directly into SQL without any escaping or type validation. This coul
CVECVE-2026-27634
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 03 · 10:16 PM CDT
ModifiedThu, Apr 09 · 09:14 PM CDT
CVE-2026-34400
9.8/10 · Must read/watchNVDvuln
Summary
Alerta is a monitoring tool. Prior to version 9.1.0, the Query string search API (q=) was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0.
CVECVE-2026-34400
SeverityCRITICAL
TypeUPDATED
PublishedTue, Mar 31 · 10:16 PM CDT
ModifiedFri, Apr 10 · 01:41 AM CDT
CVE-2026-21876
9.3/10 · Must read/watchNVDvuln
Summary
The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 4.22.0 and 3.3.8, the current rule 922110 has a bug when processing multipart requests with multiple parts. When the first rule in a chain iterates over a collection (like `MULTI
CVECVE-2026-21876
SeverityCRITICAL
TypeUPDATED
PublishedThu, Jan 08 · 02:15 PM CST
ModifiedThu, Apr 09 · 04:16 PM CDT
CVE-2025-54236
9.1/10 · Must read/watchNVDvuln
Summary
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, increasing the confidentiality, and integrity impact to high. Exploitation of this issue doe
CVECVE-2025-54236
SeverityCRITICAL
TypeUPDATED
PublishedTue, Sep 09 · 02:15 PM CDT
ModifiedThu, Apr 09 · 01:00 AM CDT
CVE-2026-34952
9.1/10 · Must read/watchNVDvuln
Summary
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, the PraisonAI Gateway server accepts WebSocket connections at /ws and serves agent topology at /info with no authentication. Any network client can connect, enumerate registered agents, and send arbitrary messages to agents and their tool sets. This issu
CVECVE-2026-34952
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 03 · 11:17 PM CDT
ModifiedThu, Apr 09 · 04:55 PM CDT
CVE-2026-34953
9.1/10 · Must read/watchNVDvuln
Summary
PraisonAI is a multi-agent teams system. Prior to version 4.5.97, OAuthManager.validate_token() returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered too
CVECVE-2026-34953
SeverityCRITICAL
TypeUPDATED
PublishedFri, Apr 03 · 11:17 PM CDT
ModifiedThu, Apr 09 · 04:52 PM CDT
CVE-2019-25685
8.8/10 · Worth your timeNVDvuln
Summary
phpBB contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by exploiting the plupload functionality and phar:// stream wrapper. Attackers can upload a crafted zip file containing serialized PHP objects that execute arbitrary code when deserialized through the ima
CVECVE-2019-25685
SeverityHIGH
TypeUPDATED
PublishedSun, Apr 05 · 09:16 PM CDT
ModifiedThu, Apr 09 · 07:07 PM CDT
CVE-2025-59710
8.8/10 · Worth your timeNVDvuln
Summary
An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. During the loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution on the server.
CVECVE-2025-59710
SeverityHIGH
TypeUPDATED
PublishedFri, Apr 03 · 03:16 PM CDT
ModifiedThu, Apr 09 · 09:16 PM CDT
CVE-2026-21630
8.8/10 · Worth your timeNVDvuln
Summary
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
CVECVE-2026-21630
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 01 · 10:16 AM CDT
ModifiedThu, Apr 09 · 07:59 PM CDT
CVE-2026-22627
8.8/10 · Worth your timeNVDvuln
Summary
A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP packet.
CVECVE-2026-22627
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 10 · 06:18 PM CDT
ModifiedThu, Apr 09 · 08:54 PM CDT
CVE-2026-23899
8.8/10 · Worth your timeNVDvuln
Summary
An improper access check allows unauthorized access to webservice endpoints.
CVECVE-2026-23899
SeverityHIGH
TypeUPDATED
PublishedWed, Apr 01 · 10:16 AM CDT
ModifiedThu, Apr 09 · 07:59 PM CDT
CVE-2012-5562
8.6/10 · Worth your timeNVDvuln
Summary
A flaw was found in rhn-proxy. This vulnerability may allow the rhn-proxy to transmit user credentials in clear-text when it accesses RHN Satellite. This could lead to information disclosure, where sensitive authentication details are exposed to unauthorized parties.
CVECVE-2012-5562
SeverityHIGH
TypeUPDATED
PublishedMon, Dec 02 · 07:15 PM CST
ModifiedThu, Apr 09 · 06:16 PM CDT
CVE-2025-62599
8.6/10 · Worth your timeNVDvuln
Summary
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condi
CVECVE-2025-62599
SeverityHIGH
TypeUPDATED
PublishedTue, Feb 03 · 06:16 PM CST
ModifiedThu, Apr 09 · 06:16 PM CDT
CVE-2025-62600
8.6/10 · Worth your timeNVDvuln
Summary
eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4, 3.3.1, and 3.4.1, when the security mode is enabled, modifying the DATA Submessage within an SPDP packet sent by a publisher causes an Out-Of-Memory (OOM) condi
CVECVE-2025-62600
SeverityHIGH
TypeUPDATED
PublishedTue, Feb 03 · 07:16 PM CST
ModifiedThu, Apr 09 · 06:16 PM CDT
CVE-2026-30976
8.6/10 · Worth your timeNVDvuln
Summary
Sonarr is a PVR for Usenet and BitTorrent users. In versions on the 4.x branch prior to 4.0.17.2950, an unauthenticated remote attacker can potentially read any file readable by the Sonarr process. These include application configuration files (containing API keys and database credentials), Windows system files, and an
CVECVE-2026-30976
SeverityHIGH
TypeUPDATED
PublishedWed, Mar 25 · 09:16 PM CDT
ModifiedThu, Apr 09 · 07:44 PM CDT
CVE-2026-34954
8.6/10 · Worth your timeNVDvuln
Summary
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.download_file() in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream() with follow_redirects=True. An attacker who controls the URL can reach any host accessible
CVECVE-2026-34954
SeverityHIGH
TypeUPDATED
PublishedFri, Apr 03 · 11:17 PM CDT
ModifiedThu, Apr 09 · 04:51 PM CDT
CVE-2019-25681
8.4/10 · Worth your timeNVDvuln
Summary
Xlight FTP Server 3.9.1 contains a structured exception handler (SEH) overwrite vulnerability that allows local attackers to crash the application and overwrite SEH pointers by supplying a crafted buffer string. Attackers can inject a 428-byte payload through the program execution field in virtual server configuration
CVECVE-2019-25681
SeverityHIGH
TypeUPDATED
PublishedSun, Apr 05 · 09:16 PM CDT
ModifiedThu, Apr 09 · 07:33 PM CDT
CVE-2025-70798
8.4/10 · Worth your timeNVDvuln
Summary
Tenda i24V3.0si V3.0.0.5 Firmware V3.0.0.5 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.
CVECVE-2025-70798
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 10 · 09:16 PM CDT
ModifiedThu, Apr 09 · 08:27 PM CDT
CVE-2025-70802
8.4/10 · Worth your timeNVDvuln
Summary
Tenda G1V3.1si V16.01.7.8 Firmware V16.01.7.8 was discovered to contain a hardcoded password vulnerability in /etc_ro/shadow, which allows attackers to log in as root.
CVECVE-2025-70802
SeverityHIGH
TypeUPDATED
PublishedTue, Mar 10 · 09:16 PM CDT
ModifiedThu, Apr 09 · 08:27 PM CDT
CVE-2019-25669
8.2/10 · Worth your timeNVDvuln
Summary
qdPM 9.1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the search_by_extrafields[] parameter. Attackers can send POST requests to the users endpoint with malicious search_by_extrafields[] values to trigger SQL syntax errors and extract databas
CVECVE-2019-25669
SeverityHIGH
TypeUPDATED
PublishedSun, Apr 05 · 09:16 PM CDT
ModifiedThu, Apr 09 · 07:38 PM CDT
CVE-2019-25672
8.2/10 · Worth your timeNVDvuln
Summary
PilusCart 1.4.1 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'send' parameter. Attackers can submit POST requests to the comment submission endpoint with RLIKE-based boolean SQL injection payloads to extract sensitive datab
CVECVE-2019-25672
SeverityHIGH
TypeUPDATED
PublishedSun, Apr 05 · 09:16 PM CDT
ModifiedThu, Apr 09 · 07:37 PM CDT
CVE-2019-25674
8.2/10 · Worth your timeNVDvuln
Summary
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'post' parameter. Attackers can send GET requests to post.php with malicious 'post' values to extract sensitive database information or perform time-based blind SQL
CVECVE-2019-25674
SeverityHIGH
TypeUPDATED
PublishedSun, Apr 05 · 09:16 PM CDT
ModifiedThu, Apr 09 · 07:36 PM CDT
