Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,055 alerts · page 38 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-61564 AVideo-Encoder: unauthenticated installer PHP code injection

    CriticalCVSS 10.0 EPSS 0.54%

    Exploit status: No public exploit known

    Affects: WWBN AVideo-Encoder

    AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint install/checkConfiguration.php assembles videos/configuration.php by interpolating request parameters, including webSiteRootURL, into single-quoted PHP string literals without escaping. An...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-118690 Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs

    CriticalCVSS 9.3 EPSS 0.69%

    Exploit status: No public exploit known

    Affects: npm signalk-server

    Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log archives via the /skServer/ziplogs endpoint. Attackers can extract the JWT secretKey from security.json in the ZIP, forge administrator token...

  3. CISA KEV addition Published · updated

    CVE-2026-76418 Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Tunnel Denial of Service Vulnerability

    HighCVSS 8.6 EPSS 0.82% CISA KEV added 2026-10-29 · due 2026-11-01 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: Cisco Secure Firewall Threat Defense (FTD) Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, cisco adaptive security appliance software and 1 more

    A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting i...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-117574 Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization

    CriticalCVSS 9.1 EPSS 0.24%

    Exploit status: No public exploit known

    Affects: redhat openshift ai, redhat/rhoai/odh-ai-gateway-payload-processing-e2e-rhel9, redhat/rhoai/odh-ai-gateway-payload-processing-rhel9

    A flaw was found in ai-gateway-payload-processing. An authenticated remote attacker can exploit this vulnerability by submitting a request specifying another tenant's model identifier in the request body or header. Because the service does not verify authorization before retrievi...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-63190 FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

    CriticalCVSS 9.4 EPSS 0.54%

    Exploit status: No public exploit known

    Affects: fearlessgeekmedia FearlessCMS

    FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn() authentication checks, CSRF protection or adequate path validation. On...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-118264 Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls

    CriticalCVSS 9.1 EPSS 0.43%

    Exploit status: No public exploit known

    Affects: redhat/ansible-automation-platform/automation-orchestrator-temporal-rhel9, redhat/costmanagement/costmanagement-ros-ocp-backend-rhel9, redhat/multicluster-globalhub/multicluster-globalhub-grafana-rhel9 and 12 more

    Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's Proxy middleware selects a raw tunnel from a client WebSocket upgrade request before verifying that the configured upstream accepted the upgrade. If the upstream rejects the upgrade with an ordinary keep-alive...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-118633 A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for...

    CriticalCVSS 9.2 EPSS 0.60%

    Exploit status: No public exploit known

    Affects: sophos SG UTM

    A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is...

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-116531 HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk

    CriticalCVSS 9.1 EPSS 0.40%

    Exploit status: No public exploit known

    Affects: cpan HTTP-Body, debian/libhttp-body-perl, ubuntu/libhttp-body-perl

    HTTP::Body versions before 1.23_01 for Perl lose track of chunk boundaries in chunked request bodies when a read ends inside a chunk. In chunked mode, used when no content length is given, add() treats a chunk as complete once the buffer is as long as the chunk's declared size, b...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-116135 HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them

    CriticalCVSS 9.8 EPSS 0.60%

    Exploit status: No public exploit known

    Affects: cpan HTTP-Body, debian/libhttp-body-perl, ubuntu/libhttp-body-perl

    HTTP::Body versions before 1.23_01 for Perl drop mixed-case percent escapes from urlencoded form fields instead of decoding them. The decode table holds only the all-lowercase and all-uppercase spelling of each hex pair, while the escape pattern matches either case. An escape suc...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-111496 Apache Kafka: Kafka Streams StreamThread hang from integer overflow in stream-time punctuation

    CriticalCVSS 9.1 EPSS 0.51%

    Exploit status: No public exploit known

    Affects: redhat/kafka-streams, org.apache.kafka/kafka-streams

    Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timestamp + (intervalsMissed + 1) * interval with no overflow check. A record with a timestamp at or near Long.MAX_VALUE advances stream time to th...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-111115 Apache Kafka: Broker OutOfMemoryError via tagged-field allocation amplification in flexible protocol request parsing

    CriticalCVSS 9.1 EPSS 0.56%

    Exploit status: No public exploit known

    Affects: redhat/openshift-serverless-1/kn-ekb-dispatcher-rhel9, redhat/openshift-serverless-1/kn-ekb-receiver-rhel9, redhat/kafka-clients and 1 more

    Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender and retain a RawTaggedField object for each unknown field. That count was bounded only by the outer request frame size (socket.request.max.bytes); it was not chec...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-111108 Apache Kafka: Broker OutOfMemoryError via array allocation amplification in code-generated protocol readers

    CriticalCVSS 9.1 EPSS 0.59%

    Exploit status: No public exploit known

    Affects: redhat/openshift-serverless-1/kn-ekb-dispatcher-rhel9, redhat/openshift-serverless-1/kn-ekb-receiver-rhel9, redhat/kafka-clients and 1 more

    Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the sender. That count is checked only against the bytes remaining in the request buffer, which assumes about one byte per element; because most elements need several...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-110985 Apache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured

    CriticalCVSS 9.1 EPSS 0.18%

    Exploit status: No public exploit known

    Affects: org.apache.kafka/kafka, redhat/openshift-serverless-1/kn-ekb-dispatcher-rhel9, redhat/openshift-serverless-1/kn-ekb-receiver-rhel9 and 1 more

    A Kafka broker using SASL/OAUTHBEARER with the default validator (sasl.oauthbearer.jwt.validator.class=DefaultJwtValidator) selects its implementation from configuration. When sasl.oauthbearer.jwks.endpoint.url is set, the validator verifies the JWT signature. When that URL is un...

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-103409 Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed

    CriticalCVSS 9.8 EPSS 0.35%

    Exploit status: No public exploit known

    Affects: juniper Session Smart Router

    A Missing authentication for critical function vulnerability in Juniper Networks Session Smart Router allows an unauthenticated network-based attacker to obtain administrative privileges by passing crafted URL parameters to an insecure endpoint running as root. Note that this vul...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-103406 Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management.

    CriticalCVSS 9.8 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: juniper Session Smart Conductor

    An Improper Neutralization of Special Elements used in an OS Command vulnerability in the AutomatedProvisioner in Juniper Networks Session Smart Conductor allows a remote attacker to execute arbitrary commands as root via a specially crafted salt minion ID.

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-44179 XWiki Pro Macros: excerpt-include title and content injection executes code

    CriticalCVSS 9.9 EPSS 0.69%

    Exploit status: No public exploit known

    Affects: com.xwiki.pro/xwiki-pro-macros, xwikisas xwiki-pro-macros

    XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the excerpt-include macro does not properly escape the included page's title and executes excerpt content with the macro's rights. The title handlin...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-105420 Path Traversal in Wing WFTP Server leading to Remote Code Execution

    CriticalCVSS 9.4 EPSS 0.52%

    Exploit status: No public exploit known

    Affects: Wing Soft Technology Wing FTP Server

    Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base folder. This allows the attacker to write files on the system and can lead to remote code execution with p...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-111411 WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability

    CriticalCVSS 9.3 EPSS 0.34%

    Exploit status: No public exploit known

    Affects: Aman FunnelKit Automations, wordpress wp-marketing-automations

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-115607 WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability

    CriticalCVSS 9.3 EPSS 0.24%

    Exploit status: No public exploit known

    Affects: Crowd Favorite DXP ToolKit, wordpress dxp-toolkit

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit allows SQL Injection.This issue affects DXP ToolKit: from n/a through 2.0.1.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).