Vulnerabilities
Critical OAuth2 SSRF in SAP Cloud SDK for Python Exposes Client Credentials
A vulnerability in the SAP Cloud SDK for Python allows attackers to redirect token requests, leading to credential theft in multi-tenant BTP applications.
Threat Times Exposure Desk
Vulnerabilities
Metasploit Framework Web Service Has Unauthenticated Credential Access Flaw
A critical vulnerability in the Metasploit Framework Web Service allows unauthenticated users to read, modify, or delete stored credentials without any authentication checks.
Vulnerabilities
AnyDesk Linux Patch Fixes Remote Root Code Execution Flaw
AnyDesk released version 8.0.3 to address a heap buffer overflow in Linux builds that allowed attackers to gain root access before user approval.
Vulnerabilities
IBM DataStage on Cloud Pak for Data Has Critical Path Traversal Flaw
A critical severity vulnerability in IBM DataStage allows remote authenticated attackers to trigger denial of service via path traversal.
Vulnerabilities
IBM DataStage on Cloud Pak for Data suffers critical remote code execution flaw
A newly disclosed vulnerability in IBM DataStage allows authenticated attackers to execute arbitrary code via path traversal, rated 9.6 by the NVD.
Vulnerabilities
IBM DataStage on Cloud Pak for Data Has Critical Remote Info Leak
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a critical flaw allowing remote authenticated attackers to access sensitive information.
Vulnerabilities
IBM i HTTP Server Admin Flaw Rated Critical, Allows Remote Code Execution
A critical vulnerability in IBM i versions 7.3 through 7.6 enables authenticated attackers to execute arbitrary code via improper data sanitization.
Vulnerabilities
Flock Security Gains CVE Numbering Authority for Surveillance Products
The surveillance vendor joined the CVE Program as a CNA, allowing it to assign IDs and grade vulnerabilities in its own cameras and license plate readers.
Vulnerabilities
phpMyFAQ SQL Injection Flaw Rated Critical in National Vulnerability Database Record
An unauthenticated SQL injection in phpMyFAQ versions before 4.1.9 allows attackers to steal credentials and drop database tables.
Vulnerabilities
Qexo vulnerability allows unauthenticated users to reset blog configuration and expose credentials
A critical flaw in Qexo versions prior to 4.2.0 enables attackers to bypass authentication and potentially steal stored service credentials via the setup API.
Vulnerabilities
IBM Maximo AI Service 9.1 and 9.2 Face Critical Remote Code Execution Risk
A critical flaw in IBM Maximo AI Service 9.1.0 and 9.2.0 allows remote attackers to run arbitrary code via improper control of code generation.
Vulnerabilities
easy-pdf-merge 0.2.6 and Earlier Suffer Critical Command Injection Flaw
National Vulnerability Database records CVE-2020-37279 as a critical risk in the Node.js library, enabling arbitrary OS command execution through manipulated file paths.
Vulnerabilities
Critical OS Command Injection Found in GPT-SoVITS Voice Cloning Tool
Unauthenticated attackers can execute arbitrary system commands via manipulated output folder paths in versions of GPT-SoVITS through 20250606v2pro.
Vulnerabilities
Rapyd Admin 9.20.0 Fixes Critical Hardcoded Credential Flaw Exposing Super-Admin Access
A critical vulnerability in Rapyd Admin allowed unauthenticated attackers to bypass security controls using default credentials seeded by the installer.
Vulnerabilities
Critical Container Escape Flaw Found in sandboxed.sh Versions Up to 1.3.0
A critical vulnerability in sandboxed.sh allows container workspaces to access host filesystems, posing severe risks to isolated environments.
Vulnerabilities
Netherman Portal del Hermano Flaw Allows Unauthenticated Account Takeovers
A critical broken authentication flaw in Netherman Portal del Hermano lets attackers hijack accounts by exploiting error messages and missing rate limits.
Vulnerabilities
Netcore NR268 Router Has Critical Remote Argument Injection Flaw
A critical vulnerability in Netcore NR268 firmware allows remote argument injection via the DDNS hostname field, rated CVSS 9.4.
Vulnerabilities
NetEase Cloud Music Windows Client Has Critical Remote Code Execution Flaw
A high-severity vulnerability in the Windows client allows attackers to run local binaries via manipulated IPC bridges and unvalidated connections.
Vulnerabilities
NetEase Cloud Music Windows Client Has Critical TLS Validation Flaw
A critical vulnerability in NetEase Cloud Music for Windows allows attackers to intercept traffic and steal session credentials through man-in-the-middle attacks.
Vulnerabilities
HAProxy Data Plane API Critical Auth Bypass CVE-2026-109575 Fixed
A critical flaw in HAProxy Data Plane API allows unauthenticated access to administrative controls when specific TLS settings are active.
Vulnerabilities
IBM Db2 Mirror for i Faces Critical Privilege Escalation Flaw
A critical vulnerability in IBM Db2 Mirror for i allows authenticated attackers to bypass checks and execute code with elevated privileges.
Vulnerabilities
Privasys ra-tls-clients Fixes Critical TLS Attestation Bypass in Version 0.11.0
A critical flaw in Privasys remote attestation clients allowed attackers to impersonate TLS endpoints by forging evidence, a issue resolved in the latest release.
Vulnerabilities
Quarkus REST Data Panache Flaw Drops Security Roles for Unauthenticated Access
A critical vulnerability in Quarkus REST Data Panache allows attackers to bypass security controls on generated endpoints due to silent role dropping.
Vulnerabilities
PraisonAI Fixes Critical Auth Bypass in Agent Teams Before 1.6.59
Unauthenticated users could exploit missing access controls in PraisonAI to enumerate agents and trigger workflows remotely.