Mon, Jan 19 · 06:16 PM CSTCVE-2026-22797
9.9/10 · Must read/watchNVDvuln
Summary
An issue was discovered in OpenStack keystonemiddleware 10.5 through 10.7 before 10.7.2, 10.8 and 10.9 before 10.9.1, and 10.10 through 10.12 before 10.12.1. The external_oauth2_token middleware fails to sanitize incoming authentication headers before processing OAuth 2.0 tokens. By sending forged identity headers such
CVECVE-2026-22797
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 19 · 06:16 PM CST
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2024-1015
9.8/10 · Must read/watchNVDvuln
Summary
Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker could send different commands from the operating system to the system via the web configuration functionality of the device.
CVECVE-2024-1015
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jan 29 · 02:15 PM CST
ModifiedMon, Jul 20 · 02:16 PM CDT
CVE-2024-30080
9.8/10 · Must read/watchNVDvuln
Summary
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
CVECVE-2024-30080
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jun 11 · 05:15 PM CDT
ModifiedMon, Jul 20 · 04:16 PM CDT
CVE-2025-56005
9.8/10 · Must read/watchNVDvuln
Summary
An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. This parameter accepts a `.pkl` file that is deserialized with `pickle.load()` without validation. Because `pickle` allows execution of embedded code v
CVECVE-2025-56005
SeverityCRITICAL
TypeUPDATED
PublishedTue, Jan 20 · 07:15 PM CST
ModifiedMon, Jul 20 · 12:17 PM CDT
CVE-2026-27459
9.8/10 · Must read/watchNVDvuln
Summary
pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL provided buffer. Starting in version 26.0.0, cookie values t
CVECVE-2026-27459
SeverityCRITICAL
TypeUPDATED
PublishedWed, Mar 18 · 12:16 AM CDT
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2026-27606
9.8/10 · Must read/watchNVDvuln
Summary
Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization in the core engine allows an attacker to control output file
CVECVE-2026-27606
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 25 · 03:16 AM CST
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2026-28802
9.8/10 · Must read/watchNVDvuln
Summary
Authlib is a Python library which builds OAuth and OpenID Connect servers. From version 1.6.5 to before version 1.6.7, previous tests involving passing a malicious JWT containing alg: none and an empty signature was passing the signature verification step without any changes to the application code when a failure was e
CVECVE-2026-28802
SeverityCRITICAL
TypeUPDATED
PublishedFri, Mar 06 · 07:16 AM CST
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2026-29063
9.8/10 · Must read/watchNVDvuln
Summary
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been patched in versions 3.8.3, 4.3.7, and 5.1.5.
CVECVE-2026-29063
SeverityCRITICAL
TypeUPDATED
PublishedFri, Mar 06 · 07:16 PM CST
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2026-31938
9.6/10 · Must read/watchNVDvuln
Summary
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the
CVECVE-2026-31938
SeverityCRITICAL
TypeUPDATED
PublishedWed, Mar 18 · 04:17 AM CDT
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2026-33211
9.6/10 · Must read/watchNVDvuln
Summary
Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.1, 1.3.3, 1.6.1, 1.9.2, and 1.10.2, the Tekton Pipelines git resolver is vulnerable to path traversal via the `pathInRepo` parameter. A tenant with permission to create `Resolut
CVECVE-2026-33211
SeverityCRITICAL
TypeUPDATED
PublishedTue, Mar 24 · 12:16 AM CDT
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2026-25896
9.3/10 · Must read/watchNVDvuln
Summary
fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. From 4.1.3to before 5.3.5, a dot (.) in a DOCTYPE entity name is treated as a regex wildcard during entity replacement, allowing an attacker to shadow built-in XML entities (&
CVECVE-2026-25896
SeverityCRITICAL
TypeUPDATED
PublishedFri, Feb 20 · 09:19 PM CST
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2026-27962
9.1/10 · Must read/watchNVDvuln
Summary
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that pass signature verification. When key=None is passed to any JWS deserialization fu
CVECVE-2026-27962
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 16 · 06:16 PM CDT
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2026-33186
9.1/10 · Must read/watchNVDvuln
Summary
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g.,
CVECVE-2026-33186
SeverityCRITICAL
TypeUPDATED
PublishedFri, Mar 20 · 11:16 PM CDT
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2026-4599
9.1/10 · Must read/watchNVDvuln
Summary
Versions of the package jsrsasign from 7.0.0 and before 11.1.1 are vulnerable to Incomplete Comparison with Missing Factors via the getRandomBigIntegerZeroToMax and getRandomBigIntegerMinToMax functions in src/crypto-1.1.js; an attacker can recover the private key by exploiting the incorrect compareTo checks that accep
CVECVE-2026-4599
SeverityCRITICAL
TypeUPDATED
PublishedMon, Mar 23 · 06:16 AM CDT
ModifiedMon, Jul 20 · 12:19 PM CDT
CVE-2024-30068
8.8/10 · Worth your timeNVDvuln
Summary
Windows Kernel Elevation of Privilege Vulnerability
CVECVE-2024-30068
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 11 · 05:15 PM CDT
ModifiedMon, Jul 20 · 04:16 PM CDT
CVE-2024-30078
8.8/10 · Worth your timeNVDvuln
Summary
Windows Wi-Fi Driver Remote Code Execution Vulnerability
CVECVE-2024-30078
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 11 · 05:15 PM CDT
ModifiedMon, Jul 20 · 04:16 PM CDT
CVE-2024-30097
8.8/10 · Worth your timeNVDvuln
Summary
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
CVECVE-2024-30097
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 11 · 05:15 PM CDT
ModifiedMon, Jul 20 · 04:16 PM CDT
CVE-2024-30103
8.8/10 · Worth your timeNVDvuln
Summary
Microsoft Outlook Remote Code Execution Vulnerability
CVECVE-2024-30103
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 11 · 05:15 PM CDT
ModifiedMon, Jul 20 · 04:16 PM CDT
CVE-2024-35249
8.8/10 · Worth your timeNVDvuln
Summary
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
CVECVE-2024-35249
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 11 · 05:16 PM CDT
ModifiedMon, Jul 20 · 04:16 PM CDT
CVE-2025-15467
8.8/10 · Worth your timeNVDvuln
Summary
Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structure
CVECVE-2025-15467
SeverityHIGH
TypeUPDATED
PublishedTue, Jan 27 · 04:16 PM CST
ModifiedMon, Jul 20 · 12:16 PM CDT
CVE-2026-4601
8.7/10 · Worth your timeNVDvuln
Summary
Versions of the package jsrsasign before 11.1.1 are vulnerable to Missing Cryptographic Step via the KJUR.crypto.DSA.signWithMessageHash process in the DSA signing implementation. An attacker can recover the private key by forcing r or s to be zero, so the library emits an invalid signature without retrying, and then s
CVECVE-2026-4601
SeverityHIGH
TypeUPDATED
PublishedMon, Mar 23 · 06:16 AM CDT
ModifiedMon, Jul 20 · 12:19 PM CDT
CVE-2024-21626
8.6/10 · Worth your timeNVDvuln
Summary
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a
CVECVE-2024-21626
SeverityHIGH
TypeUPDATED
PublishedWed, Jan 31 · 10:15 PM CST
ModifiedMon, Jul 20 · 12:16 PM CDT
CVE-2025-61732
8.6/10 · Worth your timeNVDvuln
Summary
A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
CVECVE-2025-61732
SeverityHIGH
TypeUPDATED
PublishedThu, Feb 05 · 04:15 AM CST
ModifiedMon, Jul 20 · 12:17 PM CDT
CVE-2026-33216
8.6/10 · Worth your timeNVDvuln
Summary
NATS-Server is a High-Performance server for NATS.io, a cloud and edge native messaging system. Prior to versions 2.11.15 and 2.12.6, for MQTT deployments using usercodes/passwords: MQTT passwords are incorrectly classified as a non-authenticating identity statement (JWT) and exposed via monitoring endpoints. Versions
CVECVE-2026-33216
SeverityHIGH
TypeUPDATED
PublishedWed, Mar 25 · 08:16 PM CDT
ModifiedMon, Jul 20 · 12:18 PM CDT
CVE-2024-37325
8.1/10 · Worth your timeNVDvuln
Summary
Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability
CVECVE-2024-37325
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 11 · 05:16 PM CDT
ModifiedMon, Jul 20 · 04:16 PM CDT
