[NEW] [high] ProFTPD: Multiple vulnerabilities
A remote, authenticated attacker can exploit multiple vulnerabilities in ProFTPD to execute arbitrary code and disclose confidential information.
Advisories tracked
20,890
● Live advisory feed
Security Advisory Fusion for CSIRTs, SOCs & Defenders
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
Known exploited
1,782
Sources online
24
Last sync
1H AGO
[NEW] [UNPATCHED] [medium] CUPS (libcupsfilters, cups-filters): Vulnerability allows denial of service
A remote, anonymous attacker can exploit a vulnerability in CUPS to conduct a denial-of-service attack.
[UPDATE] [high] VMware Tanzu Spring Framework: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in VMware Tanzu Spring Framework to escalate privileges, execute arbitrary code, disclose sensitive information, bypass security measures, manipulate data, conduct cross-site scripting and open redirect attacks, or cause a denial-o…
[NEW] [medium] PostgreSQL JDBC Driver: Vulnerability allows bypassing security measures
A remote, anonymous attacker can exploit a vulnerability in PostgreSQL JDBC Driver to bypass security measures.
[NEW] [high] Snipe-IT: Vulnerability allows bypassing of security measures
A remote, authenticated attacker can exploit a vulnerability in Snipe-IT to bypass security measures.
[UPDATE] [medium] MailPit: Vulnerability allows Denial of Service
A remote, anonymous attacker can exploit a vulnerability in MailPit to conduct a Denial of Service attack.
[UPDATE] [medium] Red Hat OpenShift Data Foundation: Vulnerability allows bypassing security measures
A remote, anonymous attacker can exploit a vulnerability in Red Hat OpenShift Data Foundation to bypass security measures.
[UPDATE] [high] Mozilla Firefox and Thunderbird: Multiple vulnerabilities
A remote, anonymous attacker can exploit multiple vulnerabilities in Mozilla Firefox, Mozilla Firefox ESR, and Mozilla Thunderbird to execute arbitrary code, disclose information, bypass security restrictions (e.g., sandbox escape), deceive the user, escalate permissions, or caus…
[UPDATE] [high] Webmin: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Webmin to bypass security measures and execute arbitrary program code with administrator rights.
[UPDATE] [medium] MailPit: Multiple vulnerabilities
A remote, anonymous attacker can exploit multiple vulnerabilities in MailPit to manipulate files, disclose confidential information, or cause a Denial-of-Service condition.
[UPDATE] [high] Mozilla Firefox: Multiple vulnerabilities
A remote, anonymous attacker can exploit multiple vulnerabilities in Mozilla Firefox to conduct unspecified attacks, potentially including code execution, bypassing security measures, disclosing or manipulating data, or causing Denial-of-Service conditions.
[UPDATE] [high] Intel Processor: Multiple Vulnerabilities
A local attacker can exploit multiple vulnerabilities in Intel Processor to gain elevated privileges or disclose confidential information.
[UPDATE] [medium] Mozilla Firefox and Firefox ESR: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Mozilla Firefox and Mozilla Firefox ESR to conduct an unspecified attack and execute arbitrary program code.
[UPDATE] [medium] ImageMagick: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in ImageMagick to carry out a denial-of-service attack or achieve other unspecified impacts.
[UPDATE] [medium] Various Red Hat products: Multiple vulnerabilities allow gaining administrator rights
A local attacker can exploit multiple vulnerabilities in several Red Hat products to gain administrator rights.
[UPDATE] [high] IBM App Connect Enterprise: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in IBM App Connect Enterprise to bypass security measures, conduct a Denial of Service attack, disclose information, manipulate files, conduct a Cross-Site Scripting attack, conduct an SQL injection attack, and execute arbitrary pr…
[UPDATE] [medium] ImageMagick: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in ImageMagick to potentially execute arbitrary code, manipulate data or memory, cause a Denial-of-Service condition, or conduct other unspecified attacks.
[UPDATE] [medium] GNU libc: Vulnerability Allows Denial of Service
A remote, anonymous attacker can exploit a vulnerability in GNU libc to conduct a denial of service attack.
[UPDATE] [medium] ImageMagick: Multiple vulnerabilities allow Denial of Service
An attacker can exploit multiple vulnerabilities in ImageMagick to conduct a Denial of Service attack.
[UPDATE] [medium] Golang Go: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Golang Go to bypass security measures and conduct a denial of service attack.
[UPDATE] [medium] Unbound: Vulnerability allows file manipulation
An attacker from an adjacent network can exploit a vulnerability in Unbound to manipulate the cache, potentially leading to domain hijacking.
[UPDATE] [high] WSO2 API Manager: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in WSO2 API Manager to bypass security measures, conduct a Denial of Service attack, escalate privileges, execute arbitrary code, perform an SQL injection attack, conduct a Cross-Site Scripting attack, disclose information, and man…
[UPDATE] [medium] Red Hat Enterprise Linux (unbound and mpg123): Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Red Hat Enterprise Linux to execute arbitrary code or create a Denial-of-Service condition.
[UPDATE] [high] HAProxy: Multiple vulnerabilities
A remote, anonymous attacker can exploit multiple vulnerabilities in HAProxy to manipulate files or cause a Denial of Service.
[NEW] [UNPATCHED] [medium] BusyBox: Multiple vulnerabilities allow Denial of Service
A remote, anonymous attacker can exploit multiple vulnerabilities in BusyBox to carry out a Denial of Service attack.
[NEW] [high] Wazuh: Multiple vulnerabilities
An attacker can exploit multiple vulnerabilities in Wazuh to escalate their privileges, carry out a Denial of Service attack, disclose information, and bypass security precautions.
[NEW] [high] GraphicsMagick (PCD decoder): Vulnerability allows code execution
A remote, anonymous attacker can exploit a vulnerability in GraphicsMagick to potentially execute arbitrary code, corrupt memory, or cause a Denial-of-Service condition.
[NEW] [medium] QEMU: Vulnerability allows privilege escalation
A local attacker can exploit a vulnerability in QEMU to elevate their privileges.
[NEW] [high] Extreme Networks ExtremeXOS: Multiple vulnerabilities
A remote, authenticated attacker can exploit multiple vulnerabilities in Extreme Networks ExtremeXOS to gain administrative privileges, bypass security measures, or manipulate data.
[NEW] [high] ServiceNow AI Platform: Vulnerability allows code execution
A remote, anonymous attacker can exploit a vulnerability in ServiceNow AI Platform to execute arbitrary code.
Drupal plugin "AI Agents" vulnerable to incorrect authorization
AI Agents provided by Drupal contains an incorrect authorization vulnerability.
Vulnerability in certain IC chips of contactless IC card "FeliCa"
For certain FeliCa IC chips shipped by Sony Corporation in or before 2017, a certain operation during cryptographic processing may compromise the intended security strength.
Multiple vulnerabilities in Tenable Security Center (July 21, 2026)
Multiple vulnerabilities have been discovered in Tenable Security Center. Some of them allow an attacker to cause remote arbitrary code execution, SQL injection (SQLi), and security policy bypass.
CVE-2021-27137: DD-WRT Stack-Based Buffer Overflow Vulnerability
DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.
CVE-2026-0770: Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.
CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
CVE-2026-60137: WordPress Core SQL Injection Vulnerability
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
DSA-6393-1 linux - security update
Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. https://security-tracker.debian.org/tracker/DSA-6393-1
GHSA-h95v-h523-3mw8: Guzzle: URI fragments disclosed in redirect Referer headers
Impact When the optional referer redirect setting is enabled, affected versions of RedirectMiddleware can copy the fragment from the referring request URI into a generated Referer header. A URI fragment is the part after #. It is handled locally by the client and is not part of …
GHSA-wm3w-8rrp-j577: Guzzle: Host-only cookie scope is not preserved
Impact In affected versions, CookieJar does not preserve whether a response cookie was set without a Domain attribute or with an empty one. A cookie without Domain is host-only and must be returned only to the exact host that set it. Under current cookie processing rules, an emp…
GHSA-f283-ghqc-fg79: Guzzle: Unbounded response cookies risk denial of service
Impact In affected versions, Guzzle's built-in CookieJar accepts any number of Set-Cookie header fields from one response, with no limit on the size of each field. When a later request matches the stored cookies, Guzzle places every match into one generated Cookie header without…
GHSA-8mv7-9c27-98vc: Astro: composable `astro/hono` pipeline bypasses `security.checkOrigin` when `middleware()` is absent or misordered
Summary In the composable astro/hono pipeline, the security.checkOrigin protection is only installed by the middleware() primitive. The actions() and pages() primitives each dispatch to user code independently, so a pipeline that mounts either primitive before (or without) middl…
GHSA-hp3v-mfqw-h74c: @astrojs/netlify generates an overly-broad Netlify Image CDN allowlist because remotePatterns.pathname metacharacters are not escaped
Summary The @astrojs/netlify adapter converts each image.remotePatterns entry into a regular expression that is written to .netlify/v1/config.json under images.remote_images. Netlify's Image CDN uses these regexes as the allowlist that decides which remote image URLs it will opt…
GHSA-v422-hmwv-36x6: body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement
Impact When body-parser is configured with an invalid limit option value, such as an unparseable string or NaN, bytes.parse() returns null and the request body size check is silently skipped. Applications that rely on limit as their primary safeguard against oversized request bo…
GHSA-r557-wffq-wvrc: @astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirect
Impact With trailingSlash: 'always' configured, the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths beginning with /\ (slash-backslash) were not recognized as internal paths, so the handler would ec…
GHSA-f48w-9m4c-m7f5: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)
Summary The fix for CVE-2026-54298 (GHSA-jrpj-wcv7-9fh9) added an INVALID_ATTR_NAME_CHAR guard to addAttribute() so that spread-prop attribute names containing "' >/= or whitespace are dropped. A second attribute-rendering path, renderHTMLElement() in packages/astro/src/runtime/…
GHSA-8j5q-mfj2-5q9q: @astrojs/rss: XML Injection via Unescaped RSS Feed Fields
Summary In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into …
GHSA-7pw4-f3q4-r2p2: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
Summary When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-c…
GHSA-9hw9-ch79-4vh6: Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch
Summary Pillow's public ImageCms.ImageCmsTransform.apply(im, imOut) API can trigger controlled native heap corruption when the caller supplies an output image whose mode does not match the transform's declared output mode. For example, a transform built as RGBA -> RGBA can be a…
GHSA-vjc4-5qp5-m44j: Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service
Summary src/libImaging/Jpeg2KDecode.c:853 accumulates total_component_width across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the tile_bytes calculation at src/libImaging/Jpeg2KDecode.c:868, which can make the decoder…