● Live advisory feed
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
A remote, anonymous attacker can exploit multiple vulnerabilities in Red Hat Enterprise Linux to conduct a Denial of Service attack.
A remote, anonymous attacker can exploit a vulnerability in ffmpeg to trigger a Denial of Service or potentially execute arbitrary code.
A remote anonymous attacker can exploit these vulnerabilities to create a Denial of Service condition or conduct an unspecified attack.
An attacker can exploit a vulnerability in ffmpeg to conduct a Denial of Service attack and cause unspecified effects.
A remote, anonymous attacker can exploit vulnerabilities in various http/2 implementations to conduct a Denial of Service attack.
A remote, authenticated attacker can exploit a vulnerability in Microsoft Exchange Online to elevate their privileges.
TeamViewer has fixed an unspecified vulnerability in its cloud service. This affects the 'out-of-session chat' functionality of the Full Client.
A remote, anonymous attacker can exploit a vulnerability in Cisco Catalyst Center to disclose information.
An attacker can exploit multiple vulnerabilities in CUPS to conduct a denial of service attack.
A remote, anonymous attacker can exploit a vulnerability in Microsoft 365 Copilot to escalate their privileges.
A remote, authenticated attacker can exploit multiple vulnerabilities in Microsoft Azure and Microsoft Entra to escalate their privileges.
A remote, anonymous attacker can exploit a vulnerability in IGEL OS to manipulate files.
Rancher Labs has fixed vulnerabilities in Rancher versions 2.13.0 to 2.13.7 and 2.14.0 to 2.14.3. The first vulnerability concerns a SAML authentication replay issue in the Assertion Consumer Service (ACS) handler in Rancher versions 2.14.0 to, but not including, 2.14.3. The ACS …
GitHub has fixed multiple vulnerabilities in GitHub Enterprise Server, specifically in versions prior to 3.21 and 3.22. The first vulnerability concerns a stored cross-site scripting (XSS) where authenticated attackers can inject malicious JavaScript payloads into Discussion titl…
A remote, anonymous attacker can exploit a vulnerability in vim to conduct a denial of service attack.
A remote, anonymous attacker can exploit multiple vulnerabilities in Red Hat Software Collections to compromise the confidentiality, availability, and integrity of the applications.
An attacker can exploit multiple vulnerabilities in Mozilla Thunderbird to conduct a denial of service attack and to present false information.
An attacker can exploit multiple vulnerabilities in Ubiquiti UniFi to execute arbitrary code, conduct an SQL injection attack, escalate privileges, bypass security measures, conduct a denial of service attack, manipulate data, and disclose information.
Multiple vulnerabilities have been discovered in the Ubuntu Linux kernel. Some of them allow an attacker to cause arbitrary code execution, privilege escalation, and a remote denial of service.
Multiple vulnerabilities have been discovered in the Red Hat Linux kernel. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and a remote denial of service.
A vulnerability has been discovered in FreeBSD. It allows an attacker to cause a breach of data confidentiality.
Multiple vulnerabilities have been discovered in the SUSE Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality, and a breach of data integrity.
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and a remote denial of service.
Multiple security vulnerabilities were discovered in OpenVPN, which could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6376-1
Impact Recce OSS server deployments that expose the server to an untrusted network without authentication are vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primi…
Summary The fix for CVE-2026-46339 (unauthenticated RCE via unprotected MCP plugin routes) introduced a local-only access gate in src/dashboardGuard.js that restricts spawn-capable routes (/api/mcp/*, /api/tunnel/*, /api/cli-tools/*) to loopback requests. The gate determines "lo…
The TIFF decoder does not place a limit on the size of PackBits-compressed data. A maliciously-crafted image can exploit this to cause a small image (both in terms of pixel width/height and encoded size) to make the decoder decode large amounts of compressed data.
Summary 9router uses a publicly known hardcoded string "9router-default-secret-change-me" as the fallback of JWT secret for all Dashboard session JWTs when the JWT_SECRET environment variable is not set. Because this secret is committed in the public repository and unchanged acro…
Kiwi TCMS provides the /init-db/ page as part of its setup mechanism for administrators who prefer a browser instead of the command line. In previous versions of Kiwi TCMS this page still renders and responds to requests even after first use. Impact The /init-db/ page does not …
Multiple vulnerabilities in ClamAV could allow a remote attacker to cause a denial of service (DoS) condition, interrupting scanning operations. For more information about these vulnerabilities, see the Details section of this advisory. For additional information on these vulnera…
Summary An unauthenticated path traversal in the LaunchServer HTTP file server (FileServerHandler) lets any remote actor read any file readable by the LaunchServer process (e.g. ../../../../etc/passwd). This is a generic arbitrary-file-read primitive, so the fix must address the …
Summary SimpleSAMLphp's SAML SP ACS path does not enforce the IdP selected for an SP-initiated login. If a saved SP state contains ExpectedIssuer = IdP A, but the ACS receives a valid response from IdP B, the code logs a warning and continues processing instead of rejecting the …
Summary Algernon selects its file handler from filepath.Ext() (engine/handlers.go:134), which does not treat the NTFS-equivalent names x.lua::$DATA, x.lua., or x.lua as .lua. On Windows, an unauthenticated client appends one of these suffixes to any server-side script on a publi…
Summary On 32-bit platforms, decoding a crafted image may lead to out-of-bounds writes due to integer overflow in length calculation. Details & PoC The test listed below fail under miri with command cargo +nightly miri test --release -p jxl-grid Or you can use Address Sanitiz…
Summary jxl-oxide exposes a public safe API that can construct an undersized FrameBuffer due to unchecked usize multiplication, which immediately trigger panic while initializing the buffer in normal decoding path. Additionally, calling the safe grouped buffer accessors afterwar…
Summary Logic bug in decode_simple_table_slow may cause integer arithmetic overflow when decoding Modular image with certain kind of MA tree, which may panic with overflow-checks enabled. Impact Denial of service: any application passing untrusted JXL data to JxlImage::render_fr…
Summary Kimai 2.56.0 contains an authenticated improper authorization / IDOR vulnerability in the favorite timesheet add and remove endpoints. A low-privileged user who knows another user's timesheet.id can add that record to, or remove it from, the victim's favorite/recent book…
Keycloak's SAML broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response, injecting an encrypted assertion for an arbitrary p…
Summary fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators or normalize the path before checking whether the session file exists. …
Summary Configuring encrypt:rsa:algorithm=OAEP does not enable OAEP encryption. Due to an incorrect BouncyCastle transformation string, the OAEP setting selects PKCS#1 v1.5, which is the same algorithm as the DEFAULT setting. Impact Operators who configure encrypt:rsa:algorith…
Summary When MySQL or PostgreSQL service bindings from VCAP_SERVICES include TLS client credentials, the Connectors library writes those credentials to temporary files in Path.GetTempPath() using File.CreateText. On Linux, File.CreateText creates files with mode 0644 (world-read…
Summary The JWT signing key cache in TokenKeyResolver uses kid as the sole cache key without namespacing by authority. In applications with multiple JwtBearer schemes pointing to different identity providers, a key fetched for one scheme can satisfy token validation for another.…
Summary All Steeltoe actuator endpoints default to EndpointPermissions.Restricted, which is mapped to Cloud Foundry's read_basic_data permission (granted to Space Auditors and similar low-trust roles). Sensitive actuators including heap dump, environment, and thread dump do not …
Summary The Sanitizer component in the Environment actuator redacts configuration values by matching the configuration key name against a suffix list. The default list (password, secret, key, token, .*credentials.*, vcap_services) does not cover the standard .NET pattern Connect…
Summary DataCenterInfo.FromJson throws ArgumentException for any name value other than "MyOwn" or "Amazon", despite the Java Eureka specification defining a third valid value: "Netflix". The exception propagates through the entire registry deserialization chain and is swallowed …
Summary When Steeltoe management endpoints are configured to listen on an alternate port (Management:Endpoints:Port is configured), the middleware responsible for restricting access to the endpoints uses the Host HTTP header rather than the actual network socket port. Impact A…
Summary This library turned out to be vulnerable to Denial-of-Service attacks using XPath transforms. A mitigation has been put in place to restrict the number of transforms and to restrict transforms to only the transform-algorithms mentioned in the SAML 2.0 Core Specifications…
Am I affected You are affected if: 1. You run zebrad up to and including v4.4.1. 2. Your node listens on the default [::] address on a Linux host (the standard deployment configuration — net.ipv6.bindv6only=0 is the default on all common Linux distributions). 3. Your node is sy…
Summary SimpleSAMLphp's HTTP-Artifact receive path can treat an unsigned embedded SAML Response as cryptographically valid for the wrong IdP. In the HTTPArtifact::receive() flow, the SOAP ArtifactResponse receives a TLS-based validator from SOAPClient::addSSLValidator(). The em…