● Live advisory feed
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it (backslash backslash, forward slash backslash, or backslash forward slash) is parsed with no authorit…
The Zephyr Bluetooth GATT client CCC-write response handler gatt_write_ccc_rsp() in subsys/bluetooth/host/gatt.c invoked the application's params->subscribe() callback after it had already called params->notify(conn, params, NULL, 0). Per the public GATT API, a notify callback w…
Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated…
Serial number: AV26-768 Date: July 31, 2026 As of July 30, 2026, Google is affected by vulnerabilities in the following product: Chrome - Prior to 151.0.7922.72 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as…
Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr (Elixir.Ymlr module) allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output…
Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39.
Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6.
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.
Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.
Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.
Rejected reason: Reserved via standalone CLI outside the OSIM flaw workflow; releasing so the CVE ID can be properly reserved and linked through OSIM when the flaw is worked.
A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-au…
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.
Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6.4.108.
Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users.
Serial Number: AV26-767 Date: July 31, 2026 As of July 30, 2026, Rails is affected by a vulnerability in the following product: Rails Prior to 8.0.5.1 Prior to 8.1.3.1 Prior to 7.2.3.2 The Cyber Centre encourages users and administrators to review the provided web links and apply…
Serial number: AV26-766 Date: July 30, 2026 As of July 30, 2026, SolarWinds is affected by a vulnerability in the following product: Web Help Desk (WHD) Prior to 2026.2.1 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary…
A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in vers…
A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1…
A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized admi…
An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue w…
A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in…
SolarWinds heeft een kwetsbaarheid verholpen in SolarWinds Web Help Desk. De kwetsbaarheid betreft een authenticatiebypass in de SAML 2.0 authenticatie van SolarWinds Web Help Desk. Deze kwetsbaarheid treedt op in systemen waarbij SAML-authenticatie is ingeschakeld. Een aanvaller…
A local attacker can exploit multiple vulnerabilities in the Linux Kernel to create a denial of service state and launch further unspecified attacks.
A local attacker can exploit multiple vulnerabilities in Linux Kernel to conduct a Denial of Service attack and achieve unspecified effects.
An attacker can exploit multiple vulnerabilities in Linux Kernel to conduct a denial of service attack or achieve other unspecified impacts.
A local attacker can exploit multiple vulnerabilities in Linux Kernel to conduct a denial of service attack or carry out an unspecified attack.
An attacker can exploit multiple vulnerabilities in the Linux Kernel to carry out an unspecified attack.
A local attacker can exploit a vulnerability in the Linux Kernel to disclose information.
A local attacker can exploit multiple vulnerabilities in the Linux Kernel to create a Denial of Service state or conduct a nonspecific attack.
A local attacker can exploit multiple vulnerabilities in the Linux Kernel to create a denial-of-service condition or conduct unspecified attacks.
A local attacker can exploit multiple vulnerabilities in Linux Kernel to conduct a denial of service attack.
A local attacker can exploit multiple vulnerabilities in Linux Kernel to conduct a Denial of Service attack or cause other impacts.
Ein Angreifer kann mehrere Schwachstellen in IBM WebSphere Application Server ausnutzen, um einen Denial of Service Angriff durchzuführen.
Ein Angreifer kann mehrere Schwachstellen in Gladinet CentreStack ausnutzen, um beliebigen Programmcode auszuführen,SQL-Injection durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.
Ein Angreifer kann mehrere Schwachstellen in Apache Tika ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in docker ausnutzen, um Dateien zu manipulieren.
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.
Ein Angreifer kann mehrere Schwachstellen in SQLite ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand herbeizuführen.
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in OpenVPN ausnutzen, um einen Denial of Service Angriff durchzuführen oder vertrauliche Informationen offenzulegen.
A remote, anonymous attacker can exploit a vulnerability in GIMP to conduct a denial of service attack or disclose information.
A local attacker can exploit a vulnerability in PackageKit to escalate their privileges.
Ein lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erhöhen oder einen Denial of Service zu verursachen.
Ein entfernter, anonymer Angreifer kann mehrere Schwachstelle in GIMP ausnutzen, um beliebigen Programmcode auszuführen.
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GIMP ausnutzen, um beliebigen Programmcode auszuführen.
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GIMP ausnutzen, um beliebigen Programmcode auszuführen.
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in GIMP ausnutzen, um beliebigen Programmcode auszuführen.
Ein Angreifer kann mehrere Schwachstellen in GIMP ausnutzen, um beliebigen Programmcode auszuführen.
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Redis ausnutzen, um beliebigen Programmcode auszuführen.