Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,054 alerts · page 15 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-109469 Entra Device Registration Elevation of Privilege Vulnerability

    CriticalCVSS 10.0 EPSS 0.67%

    Exploit status: No public exploit known

    Affects: Microsoft entra device registration

    Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-59104 UgCS server HCI authentication bypass with empty credentials

    CriticalCVSS 9.3 EPSS 0.66%

    Exploit status: No public exploit known

    Affects: SPH Engineering UgCS

    UgCS server before 6.2 contains an authentication bypass in the HCI protocol login handler (LoginHandler) exposed on TCP port 3334. When the user database contains exactly one user (the default single-operator installation), a LoginRequest with empty userLogin and userPassword fi...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-68935 Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections

    CriticalCVSS 9.1 EPSS 0.55%

    Exploit status: No public exploit known

    Affects: chartbrew

    Chartbrew is an open-source web application for creating charts from databases and APIs. In versions 4.8.5 through 5.2.2, API connection creation and update operations accept the internal allowPrivateHost field from user input. An authenticated user with permission to manage API...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-86005 Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew

    CriticalCVSS 9.3 EPSS 0.47%

    Exploit status: No public exploit known

    Affects: chartbrew

    Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, the administrative BullMQ dashboard was mounted without an authentication check. The vulnerable surface is the Bull Board/BullMQ administ...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-85295 Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET

    CriticalCVSS 9.8 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: chartbrew

    Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.3, four authentication helpers accepted session tokens signed with CB_SECRET, including known, weak, or shipped-default values. The vulnerab...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution

    CriticalCVSS 9.8 EPSS 0.43%

    Exploit status: No public exploit known

    Affects: chartbrew

    Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-102530 JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL

    CriticalCVSS 9.4 EPSS 0.42%

    Exploit status: No public exploit known

    Affects: jupyterlab-desktop

    JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, remote-server URLs were inserted into the server-selection dialog and Welcome view without safe encoding. An attacker who convinces a user to submit a crafted URL can execute JavaScript...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-86044 JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution

    CriticalCVSS 9.6 EPSS 0.31%

    Exploit status: No public exploit known

    Affects: jupyterlab-desktop

    JupyterLab Desktop is the cross-platform desktop application for JupyterLab. Prior to 4.6.2-1, JupyterLab Desktop exposed getServerInfo to the renderer without confirming that the current page still had the local Jupyter server origin. In a local managed session using JupyterLab...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification

    CriticalCVSS 9.8 EPSS 0.41%

    Exploit status: No public exploit known

    Affects: Bubka 2FAuth

    2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard is enabled, ReverseProxyGuard::user() reads the default REMOTE_USER identity header, or a custom identity header...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-63438 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value

    CriticalCVSS 9.8 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: Bubka 2FAuth

    2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Prior to 8.0.0, when AUTHENTICATION_GUARD=reverse-proxy-guard accepts authentication headers from a client that did not pass through a trusted proxy, RemoteUserProvider::retr...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-58490 Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults

    CriticalCVSS 9.8 EPSS 0.34%

    Exploit status: No public exploit known

    Affects: TracecatHQ tracecat

    Tracecat is an open-source security automation platform for teams and AI agents. From version 0.37.0 until 1.0.0-beta.49, Docker Compose deployments with SAML enabled can render SAML_SIGNED_ASSERTIONS and SAML_SIGNED_RESPONSES as empty values, overriding secure application defaul...

  12. Critical (CVSS 9+) Published

    GHSA-47w9-6r3f-938g LXD has restricted project bypass leading to arbitrary command execution

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Canonical LXD

    Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary Instance snapshots ignore the restricted.containers.lowlevel=block setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel hooks such as raw.lxc and raw.qe...

  13. Critical (CVSS 9+) Published

    GHSA-pjff-c2wc-f6jm LXD has arbitrary file write on client due to trusted image hash

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Canonical LXD

    Reported from https://github.com/lxc/incus/security/advisories/GHSA-f6m5-xw2g-xc4x Summary An arbitrary file write exists in the Incus client when a malicious image server returns a crafted Incus-Image-Hash header. This can lead to arbitrary command execution as root on the serve...

  14. Critical (CVSS 9+) Published

    GHSA-fmc8-p6q7-75cc LXD has argument injection in backup compression algorithm leading to AFW and ACE

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Canonical LXD

    Reported from https://github.com/lxc/incus/security/advisories/GHSA-v6mj-8pf4-hhw4 Summary Improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly le...

  15. Critical (CVSS 9+) Published

    GHSA-vghh-5rfx-xhq8 LXD has arbitrary file read+write on host via rootfs/ symlink in malicious image

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Canonical LXD

    Reported from https://github.com/lxc/incus/security/advisories/GHSA-2q3f-q5pq-g8wv Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details Incus validates an image as soon as it se...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State

    CriticalCVSS 9.2 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: azure linux ceph, debian/civetweb, civetweb and 1 more

    CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseudo-headers to influenc...

  17. CISA KEV addition Published · updated

    CVE-2026-19868 An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful....

    HighCVSS 7.5 EPSS 0.53% CISA KEV added 2026-11-06 · due 2026-11-20 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: SonicWall SonicOS

    An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

  18. Critical (CVSS 9+) Published

    GHSA-jpf8-86f3-wp38 LXD has arbitrary file read+write on host via templates/ symlink in malicious image

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Canonical LXD

    Reported from https://github.com/lxc/incus/security/advisories/GHSA-vxp5-584q-c479 Summary A specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Details For container images, internal/server/sto...

  19. Critical (CVSS 9+) Published

    GHSA-9j25-mm2h-2f76 LXD has arbitrary file write on host via `exec-output` symlink in crafted image

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: Canonical LXD

    Reported from https://github.com/lxc/incus/security/advisories/GHSA-48q5-w887-33wv Summary The record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named exec...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-119923 Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser

    CriticalCVSS 9.3 EPSS 0.62%

    Exploit status: No public exploit known

    Affects: AWS babelfish-for-postgresql, Amazon Aurora PostgreSQL with Babelfish

    A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS commands as the database pr...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).