[UPDATE] [medium] Aqua Security Trivy: Vulnerability allows denial of service
A remote, anonymous attacker can exploit a vulnerability in Aqua Security Trivy to conduct a denial of service attack.
Advisories tracked
20,853
● Live advisory feed
Security Advisory Fusion for CSIRTs, SOCs & Defenders
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
Known exploited
1,782
Sources online
24
Last sync
2H AGO
[UPDATE] [high] Aqua Security Trivy: Vulnerability allows file manipulation
A remote, anonymous attacker can exploit a vulnerability in Aqua Security Trivy to manipulate files.
[NEW] [critical] Microsoft Windows products: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Microsoft Windows products to escalate privileges, execute arbitrary code, conduct a Denial of Service attack, disclose information, present false information, manipulate data, and bypass security measures.
[NEW] [medium] Unbound: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Unbound to perform a denial of service attack, disclose information, manipulate data, and bypass security measures.
[UPDATE] [medium] LibreOffice: Vulnerability allows unspecified attack
A remote, anonymous attacker can exploit a vulnerability in LibreOffice to conduct an unspecified attack.
[UPDATE] [high] Linux Kernel: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in the Linux Kernel to trigger a Denial of Service and achieve unspecified effects.
[NEW] [medium] FreeRDP: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in FreeRDP to conduct a denial of service attack and bypass security measures.
[NEW] [high] ffmpeg: Multiple vulnerabilities
A remote, anonymous attacker can exploit multiple vulnerabilities in ffmpeg to cause memory corruption, execute arbitrary code, trigger a denial-of-service condition, or disclose confidential information.
[NEW] [medium] Microsoft Edge: Multiple vulnerabilities allow information disclosure and spoofing attacks
A remote, anonymous attacker can exploit multiple vulnerabilities in Microsoft Edge to disclose information or conduct spoofing attacks.
[NEW] [medium] vim: Multiple vulnerabilities
A local attacker can exploit multiple vulnerabilities in vim to execute arbitrary program code with user privileges, trigger a denial-of-service condition, or disclose confidential information.
[UPDATE] [medium] LibreOffice: Multiple vulnerabilities allow unspecified attack
A local attacker can exploit multiple vulnerabilities in LibreOffice to conduct an unspecified attack.
[UPDATE] [high] GnuTLS: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in GnuTLS to bypass security measures, disclose confidential information, cause a denial-of-service condition, or perform other unspecified attacks.
[UPDATE] [high] ProFTPD: Vulnerability allows SQL injection
A remote, anonymous attacker can exploit a vulnerability in ProFTPD to conduct an SQL injection attack.
[UPDATE] [medium] Golang Go: Vulnerability allows Denial of Service
A remote, anonymous attacker can exploit a vulnerability in Golang Go to conduct a Denial of Service attack.
[UPDATE] [medium] X.Org X11 and Xwayland: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in X.Org X11 and Xwayland to disclose information, escalate privileges, conduct a denial of service attack, and perform an unspecified attack.
NCSC-2026-0265 [1.00] [M/H] Vulnerabilities fixed in SolarWinds Serv-U
SolarWinds has fixed multiple vulnerabilities in Serv-U. The vulnerabilities in SolarWinds Serv-U mainly involve insecure direct object reference (IDOR) and broken access control. These allow attackers with certain privileges, such as domain administrator or group administrator a…
[UPDATE] [high] Apache Tomcat and Tomcat Native: Multiple vulnerabilities
A remote, anonymous attacker can exploit multiple vulnerabilities in Apache Tomcat and Tomcat Native to disclose information and bypass security measures.
[UPDATE] [medium] Linux Kernel: Vulnerability allows Denial of Service
A local attacker can exploit a vulnerability in the Linux Kernel to conduct a Denial of Service attack.
[UPDATE] [high] Evince: Vulnerability allows code execution
A remote, anonymous attacker can exploit a vulnerability in Evince to execute arbitrary code.
[UPDATE] [medium] Cpython: Multiple vulnerabilities
A remote, authenticated attacker can exploit multiple vulnerabilities in Cpython to manipulate files or execute arbitrary code.
[UPDATE] [medium] Linux Kernel: Vulnerability allows denial of service
A local attacker can exploit a vulnerability in the Linux Kernel to carry out a denial of service attack.
[UPDATE] [medium] Linux Kernel: Vulnerability allows denial of service
A remote, anonymous attacker can exploit a vulnerability in the Linux Kernel to carry out a denial of service attack.
[UPDATE] [medium] Red Hat OpenShift (github.com/sirupsen/logrus): Vulnerability allows Denial of Service
A remote, anonymous attacker can exploit a vulnerability in Red Hat OpenShift to conduct a Denial of Service attack.
[UPDATE] [medium] Golang Go: Multiple vulnerabilities allow denial of service
A remote, anonymous attacker can exploit multiple vulnerabilities in Golang Go to conduct a denial of service attack.
[UPDATE] [medium] Redis: Multiple vulnerabilities allow execution of arbitrary program code
A remote, authenticated attacker can exploit multiple vulnerabilities in Redis to execute arbitrary program code.
[NEW] [low] Checkmk: Vulnerability allows bypassing security measures and manipulating files
A remote, authenticated attacker can exploit a vulnerability in Checkmk to bypass security measures and manipulate files.
[NEW] [medium] Webmin: Vulnerability allows bypassing security measures
An attacker can exploit a vulnerability in Webmin to bypass security measures.
[NEW] [UNPATCHED] [medium] Keycloak: Multiple vulnerabilities allow information disclosure
A remote, authenticated attacker can exploit multiple vulnerabilities in Keycloak to disclose information.
[NEW] [medium] OpenCTI: Vulnerability allows bypassing security measures and information disclosure
A remote, anonymous attacker can exploit a vulnerability in OpenCTI to bypass security measures and disclose information.
[NEW] [medium] Linux Kernel: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in the Linux Kernel to conduct an unspecified attack, potentially to manipulate or disclose data, bypass security measures, or cause a denial-of-service condition.
[UPDATE] [medium] Apache Tomcat and Tomcat Native: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Apache Tomcat to bypass security measures, manipulate data, disclose confidential information, conduct open redirect attacks, and carry out other unspecified attacks.
[NEW] [medium] Octopus Deploy: Vulnerability allows bypassing security measures
A remote, authenticated attacker can exploit a vulnerability in Octopus Deploy to bypass security precautions.
[NEW] [high] Google Chrome: Multiple vulnerabilities
A remote, anonymous attacker can exploit multiple vulnerabilities in Google Chrome to execute arbitrary program code, bypass security mechanisms, or achieve other unspecified impacts.
[UPDATE] [medium] ffmpeg: Vulnerability allows Denial of Service
A remote, anonymous attacker can exploit a vulnerability in ffmpeg to conduct a Denial of Service attack.
[UPDATE] [medium] Red Hat Enterprise Linux (Poppler): Vulnerability allows code execution
A local attacker can exploit a vulnerability in Red Hat Enterprise Linux to execute arbitrary code, disclose confidential information, or cause a Denial-of-Service condition.
[NEW] [high] Microsoft Azure, Copilot, Exchange, Surface: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Microsoft Azure, Microsoft 365 Copilot, Microsoft Exchange, and Microsoft Apps Surface to escalate privileges, execute arbitrary code, manipulate data, or disclose confidential information.
[NEW] [medium] Exim: Multiple vulnerabilities
A local attacker can exploit multiple vulnerabilities in Exim to execute arbitrary commands and escalate privileges.
[NEW] [high] Google Cloud Platform: Vulnerability Allows Cross-Site Scripting
An attacker can exploit a vulnerability in Google Cloud Platform to conduct a cross-site scripting attack.
Microsoft Edge Multiple Vulnerabilities
Multiple vulnerabilities in Atlassian products (July 27, 2026)
Multiple vulnerabilities have been discovered in Atlassian products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
Multiple vulnerabilities in GLPI (July 27, 2026)
Multiple vulnerabilities have been discovered in GLPI. Some of them allow an attacker to cause privilege escalation, data integrity issues, and SQL injection (SQLi).
CVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP …
CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability
Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of th…
Vulnerability in Traefik (July 27, 2026)
A vulnerability has been discovered in Traefik. It allows an attacker to bypass the security policy.
Multiple vulnerabilities in Microsoft Edge (July 27, 2026)
Multiple vulnerabilities have been discovered in Microsoft Edge. They allow an attacker to cause data privacy issues, bypass the security policy, and an unspecified security issue by the vendor.
GHSA-6vch-q96h-7gc3: etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline
Impact _What kind of vulnerability is it? Who is impacted?_ A network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. Each connection spawns a goroutine in the etcd server process that blocks indefinitely inside tls.Conn.Ha…
GHSA-8q49-2h5h-434x: FrontMCP: Server-Side Request Forgery (SSRF) in the OpenAPI adapter spec-change poller
Summary The OpenAPI adapter's spec-change poller (OpenApiSpecPoller) re-fetched the configured spec url on a timer using a raw global fetch(), bypassing the SSRF guard (safeFetch / assertUrlSafe) that OpenAPIToolGenerator.fromURL() applies to the initial spec load. As a result, …
GHSA-jpcw-4wr7-c3vq: kin-openapi openapi3filter: unauthenticated nil-pointer panic when validating a request against a `content` parameter whose media type has no schema
| Field | Value | |---|---| | Ecosystem | Go | | Package | github.com/getkin/kin-openapi | | Affected versions | <= 0.143.0 (introduced in v0.2.0, PR #90, 2019-05-07; reproduced on HEAD 30e2923) | | Patched versions | 0.144.0 | Summary openapi3filter.ValidateRequest contains a …
GHSA-j6g5-3hh3-pgw8: AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()
Summary The AWS Bedrock AgentCore Python SDK (bedrock-agentcore) provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argume…
GHSA-xg4h-6gfc-h4m8: etcd: Watch API authorization bypass via open-ended range requests
Impact _What kind of vulnerability is it? Who is impacted?_ A user granted READ permission on a single, exact key can use the Watch gRPC API with clientv3.WithFromKey() (an open-ended, "from this key to the end of the keyspace" watch) to receive watch events for every key lexico…