● Live advisory feed
Security advisories from 24 sources — CISA, CERT-EU, NCSC-UK, BSI, CERT-FR, NCSC-NL, JPCERT/CC, JVN, HKCERT, the Canadian Cyber Centre, NVD, GitHub, Microsoft, Cisco, Fortinet, Palo Alto Networks and more — normalized, translated to English and flagged against the CISA KEV catalog. One global feed for CSIRTs, SOCs and defenders.
An authenticated attacker can exploit multiple vulnerabilities in the Flatpak package of Red Hat Enterprise Linux to execute arbitrary code and delete files.
A remote, anonymous attacker can exploit multiple vulnerabilities in memcached to disclose confidential information and bypass authentication, potentially enabling further attacks.
A remote, anonymous attacker can exploit multiple vulnerabilities in Internet Systems Consortium BIND to trigger a memory corruption or cause a Denial-of-Service condition.
A remote, authenticated attacker can exploit multiple vulnerabilities in BigBlueButton to bypass security measures and disclose confidential information.
A remote, anonymous attacker can exploit multiple vulnerabilities in ImageMagick to conduct a Denial of Service attack or disclose information.
A remote, anonymous attacker can exploit a vulnerability in Samba to conduct a Denial of Service attack.
A remote, anonymous attacker can exploit a vulnerability in Red Hat Enterprise Linux (libsoup) to disclose information.
An attacker can exploit multiple vulnerabilities in FRRouting Project FRRouting to conduct a Denial of Service attack.
A remote, anonymous attacker can exploit a vulnerability in Postfix to conduct a denial of service attack.
An attacker can exploit multiple vulnerabilities in FRRouting Project FRRouting to conduct a Denial of Service attack.
A remote, anonymous attacker can exploit a vulnerability in libsndfile to conduct a Denial of Service attack.
An attacker can exploit multiple vulnerabilities in Wireshark to execute arbitrary code, cause a denial-of-service condition, disclose confidential information, or conduct other unspecified attacks.
An attacker from an adjacent network can exploit a vulnerability in libxml2 to conduct a Denial of Service attack.
A local attacker can exploit multiple vulnerabilities in libexif to carry out a denial-of-service attack or disclose confidential information.
A remote, anonymous attacker can exploit a vulnerability in libTIFF to potentially execute arbitrary code or trigger a Denial-of-Service condition.
A remote, anonymous attacker can exploit a vulnerability in gdk-pixbuf to conduct a Denial of Service attack and potentially execute arbitrary code.
An attacker can exploit multiple vulnerabilities in Dovecot to perform SQL injection attacks, bypass authentication, disclose confidential information, or cause a Denial-of-Service condition.
A local attacker can exploit a vulnerability in Ruby to conduct a Denial of Service attack.
A local attacker can exploit a vulnerability in IBM WebSphere Application Server Liberty to bypass security measures.
A local attacker can exploit multiple vulnerabilities in Wireshark to conduct a Denial of Service attack.
A remote, anonymous attacker can exploit multiple vulnerabilities in Red Hat Enterprise Linux to execute arbitrary code or cause a Denial-of-Service condition.
A local attacker can exploit a vulnerability in ImageMagick to carry out a Denial of Service attack.
A remote, anonymous attacker can exploit a vulnerability in Red Hat Enterprise Linux to bypass security measures or manipulate data.
An attacker can exploit multiple vulnerabilities in Rockwell Automation CompactLogix and Rockwell Automation ControlLogix to conduct a Denial of Service attack or disclose confidential information.
A remote, anonymous attacker can exploit a vulnerability in Red Hat Enterprise Linux (libsoup) to conduct a Denial of Service attack.
A local attacker can exploit a vulnerability in Red Hat Enterprise Linux (keylime) to bypass security precautions.
A remote, anonymous attacker can exploit a vulnerability in Wireshark to conduct a Denial of Service attack.
A remote, anonymous attacker can exploit a vulnerability in PostgreSQL JDBC Driver to conduct a Denial of Service attack.
An attacker can exploit multiple vulnerabilities in OpenClaw to gain elevated privileges, execute arbitrary code, bypass security measures, disclose or manipulate data, or conduct other unspecified attacks.
A local attacker can exploit a vulnerability in ESET Server Security to carry out a Denial of Service attack.
An attacker can exploit multiple vulnerabilities in Zoom Video Communications Rooms and Zoom Video Communications Workplace to escalate privileges and take control of an account.
A local attacker can exploit multiple vulnerabilities in the BIOS of various Lenovo computer models to execute code, manipulate data, disclose information, cause a Denial of Service, and escalate privileges.
An attacker can exploit multiple vulnerabilities in IBM Security Verify Access to execute arbitrary code, bypass security measures, cause a Denial-of-Service condition, disclose confidential information, escalate privileges, or perform complex attacks such as cache poisoning, cro…
A remote, anonymous attacker can exploit multiple vulnerabilities in CoreDNS to conduct a Denial of Service attack.
Multiple vulnerabilities have been discovered in Microsoft products. They allow an attacker to cause data confidentiality breaches and security policy bypass.
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
Multiple vulnerabilities have been discovered in the Ubuntu Linux kernel. Some of them allow an attacker to cause privilege escalation, remote denial of service, and data confidentiality breaches.
Multiple vulnerabilities have been discovered in Google Chrome. They allow an attacker to cause an unspecified security issue by the vendor.
Multiple vulnerabilities have been discovered in the Red Hat Linux kernel. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and remote denial of service.
Multiple vulnerabilities have been discovered in the SUSE Linux kernel. Some of them allow an attacker to cause privilege escalation, remote denial of service, and data confidentiality breaches.
Multiple vulnerabilities have been discovered in Microsoft Windows. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation, and data confidentiality breaches.
About 14 HTTP handlers resolve the {database} path param and call getDatabase(...) WITHOUT user.canAccessToDatabase(...) and without setting the engine principal, because they extend AbstractServerHttpHandler directly instead of DatabaseAbstractHandler (which holds the only per-d…
The GHSA-48qw-824m-86pr hardening added a checkPermissionsOnDatabase(UPDATE_SECURITY) gate on the polyglot engine (PolyglotQueryEngine.java:112-114,126,176,199), but only there. The SQL route to JavaScript never touches it: DefineFunctionStatement.executeSimple (DefineFunctionSta…
ScriptTriggerExecutor sets allowedPackages to java.lang.*, java.util.*, java.time.*, java.math.* (ScriptTriggerExecutor.java:56); trigger creation is gated only at UPDATE_SCHEMA (LocalSchema.createTrigger:636). Permitting java.lang.* host-class lookup lets a trigger script do Jav…
Summary In affected versions, the deprecated WebSocket server transport (mcp.server.websocket.websocket_server) accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transpo…
Impact A user holding only reader (read-only) privileges on a single database could execute arbitrary JVM code by sending a "language": "js" command to the POST /api/v1/command/{database} HTTP endpoint, and use it to read arbitrary files on the host filesystem (e.g. /etc/passwd,…
Summary Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.php:11). There is no mechanism to force a password change on first login. Any deployment using the default credentials grants an attacker full access to the file editor, file upload, …
Summary The terminal feature in Pheditor uses an incomplete character blocklist to sanitize user-supplied commands before passing them to shell_exec(). After the fix for GHSA-9643-6xjp-vx57 (which added $ to the blocklist), the characters | (single pipe), (backtick), and the new…