Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

1,052 alerts · page 50 of 53

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-115915 vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE

    CriticalCVSS 9.8 EPSS 0.66%

    Exploit status: No public exploit known

    Affects: pypi vllm, redhat/rhaii/vllm-cpu-rhel9:1793444554, redhat/rhaii/vllm-rocm-rhel9:1793444456 and 31 more

    vLLM is an inference and serving engine for large language models. Prior to 0.32.0, ImageMediaIO passes attacker-controlled image bytes to Pillow through Image.open(BytesIO(data)) without restricting decoder selection, and the MIME label does not constrain the selected format. Im...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-102649 Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset

    CriticalCVSS 9.9 EPSS 0.46%

    Exploit status: No public exploit known

    Affects: padok-team burrito

    Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, POST /api/webhook accepts unsigned GitHub and GitLab events when a TerraformRepository's credentials omit webhookSecret or set it to an empty value, including credentials config...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-115905 zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE

    CriticalCVSS 10.0 EPSS 0.32%

    Exploit status: No public exploit known

    Affects: azure linux rust, redhat/ansible-automation-platform/automation-orchestrator-backend-rhel9, redhat/agent-sandbox/agent-sandbox-router and 65 more

    zip is a zip library for Rust that supports reading and writing simple ZIP files. Through 9.0.4, ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata...

  4. Critical (CVSS 9+) Published · updated

    CVE-2026-112346 OpenHands Software Agent SDK < 1.52.0 Unauthenticated Sandbox Agent Server RCE

    CriticalCVSS 9.3 EPSS 1.0%

    Exploit status: No public exploit known

    Affects: openhands/software-agent-sdk

    OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with an empty session_api_keys list, disabling...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-77055 Improper Privilege Assignment in boneIO

    CriticalCVSS 9.3 EPSS 0.09%

    Exploit status: No public exploit known

    Affects: boneIO black_debian_images

    boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo access and membership in the docker group. A local attacker who compromises the boneio user can use these privileges to escalate to root. This issue was fixed in ver...

  6. Critical (CVSS 9+) Published

    CVE-2026-93328 Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write

    CriticalCVSS 9.3 EPSS 0.53%

    Exploit status: No public exploit known

    Affects: Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox)

    Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to external Google Cloud Storage buckets and overwri...

  7. Critical (CVSS 9+) Published

    CVE-2026-65184 Avocent ACS8000 wsserver command injection

    CriticalCVSS 9.8 EPSS 0.42%

    Exploit status: No public exploit known

    Affects: Vertiv Avocent ACS8000

    The root-privileged wsserver terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to system() and popen() without quoting, escaping, or character-set validation. The daemon's public-key session path performs no appliance-session check.

  8. Critical (CVSS 9+) Published · updated

    CVE-2026-115693 Custom cacerts or cacertfile do not restrict trust to the pinned CA in hackney

    CriticalCVSS 9.1 EPSS 0.27%

    Exploit status: No public exploit known

    Affects: benoitc hackney

    Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to impersonate a server pinned to a private certificate authority via a certificate chain that ends in a publicly trusted root. hackney adds {partial_chain, fun hackney_ssl:...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-107656 An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox Pa...

    CriticalCVSS 9.6 EPSS 0.85%

    Exploit status: No public exploit known

    Affects: fortinet fortisandbox, fortinet fortisandboxpaas

    An authentication bypass using an alternate path or channel vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions, FortiSandbox PaaS 5.0.0 through 5.0.6, FortiSandbox PaaS 4.4 all versions, FortiSandbox PaaS 4....

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-59107 Shared SSH Authentication Key in vSolution Matrix File Sharing

    CriticalCVSS 9.2 EPSS 0.36%

    Exploit status: No public exploit known

    Affects: WolfVision Cynap Pro, Cynap Core Pro, WolfVision Cynap, Cynap Core

    A security vulnerability has been identified in the vSolution Matrix file sharing feature. A shared cryptographic trust configuration could allow an attacker who obtains the matching private key to authenticate to an affected device via SSH as root. This vulnerability affects onl...

  11. Critical (CVSS 9+) Published

    CVE-2026-59106 Unauthenticated RCE Vulnerability in WolfProt interface implementation

    CriticalCVSS 9.3 EPSS 0.55%

    Exploit status: No public exploit known

    Affects: WolfVision Cynap Pure (Next Gen), Cynap Bridge, WolfVision Cynap Pro, Cynap Core Pro, Cynap Receiver, Cynap Pure, Cynap Pure Mini, Cynap Pure Pro, WolfVision Cynap Videobar, Firmware Version and 1 more

    A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-116485 danmu_api before 1.21.7 Authentication Bypass via Default Token in Env Endpoints

    CriticalCVSS 9.3 EPSS 2.3%

    Exploit status: No public exploit known

    Affects: huangxd- danmu_api

    danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMIN_TOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /ap...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-116214 MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code

    CriticalCVSS 9.3 EPSS 0.46%

    Exploit status: No public exploit known

    Affects: maccmspro maccms10, magicblack maccms10

    MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then...

  14. Critical (CVSS 9+) Published

    CVE-2026-115188 An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicl...

    CriticalCVSS 9.9 EPSS 0.73%

    Exploit status: No public exploit known

    Affects: mautic/core

    An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An a...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-110475 Improper Authentication Vulnerability in CreditNirvana Collections Platform

    CriticalCVSS 9.3 EPSS 0.48%

    Exploit status: No public exploit known

    Affects: CreditNirvana Collections Platform (CollectionWorkz)

    This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization controls at the platform login service. An unauthenticated remote attacker could exploit this vulnerability by manipulating authentication requests and accessing A...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-116237 Oray Pugongying X5 Pro Dnsmasq crlf injection

    CriticalCVSS 9.3 EPSS 0.35%

    Exploit status: No public exploit known

    Affects: oray pugongying x5 pro

    A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was...

  17. Critical (CVSS 9+) Published

    CVE-2026-116235 Oray Pugongying X5 Pro L2TP Authentication crlf injection

    CriticalCVSS 9.4 EPSS 0.61%

    Exploit status: No public exploit known

    Affects: oray pugongying x5 pro

    A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Authentication. This manipulation of the argument Username causes crlf injection. The attack may be initiated remotely. The exploit has been pub...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-116234 Oray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection

    CriticalCVSS 9.4 EPSS 0.46%

    Exploit status: No public exploit known

    Affects: oray pugongying x5 pro

    A vulnerability was detected in Oray Pugongying X5 Pro 7.6.1. Affected is an unknown function of the file /etc/ipsec.conf of the component IPsec Policy Handler. The manipulation of the argument secproto results in crlf injection. The attack can be launched remotely. The exploit i...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-116233 Oray Pugongying X5 Pro Dnsmasq crlf injection

    CriticalCVSS 9.4 EPSS 0.46%

    Exploit status: No public exploit known

    Affects: oray pugongying x5 pro

    A security vulnerability has been detected in Oray Pugongying X5 Pro 7.6.1. This impacts an unknown function of the component Dnsmasq. The manipulation of the argument rent_time leads to crlf injection. The attack can be initiated remotely. The exploit has been disclosed publicly...

  20. Critical (CVSS 9+) Published

    CVE-2026-116232 Oray Pugongying X5 Pro SNMP snmp_set crlf injection

    CriticalCVSS 9.4 EPSS 0.44%

    Exploit status: No public exploit known

    Affects: oray pugongying x5 pro

    A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing a manipulation of the argument info.community can lead to crlf injection. It is possible to launch the attack remotely. The exploit has been...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).