vulnseeker

🔍 VulnSeeker Smart CVE search with exploitability context a...

Zoneminder

ADVISORY SUMMARY Successful exploitation of this vulnerability could result in full Remote Code Execution RCE as the web server user. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for...

Rently Smart Home

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to access sensitive information and override user permissions. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize...

CVE-2025-10164

creationtimestamp| type| source ---|---|--- 2026-08-23 11:00:35+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5775be7d-1a29-41ee-bdff-b6026e93023f 2026-08-24 01:11:00+00:00| exploited|...

CVE-2021-27691

creationtimestamp| type| source ---|---|--- 2026-08-23 10:15:05+00:00| exploited| The Shadowserver honeypot/exploited-vulnerabilities - 2026-08-22 2026-08-23 11:00:35+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/39ee7ca1-fe23-494e-8a9e-ae5f349620a0...

MINI-M4QR-79X8-XHXX

Bulletin has no description...

CVE-2026-19671

creationtimestamp| type| source ---|---|--- 2026-08-21 20:15:16+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/control-systems-cisa-security-advisory-av26-841...

CVE-2026-19670

creationtimestamp| type| source ---|---|--- 2026-08-21 20:15:14+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/control-systems-cisa-security-advisory-av26-841 2026-08-24 16:02:03+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mttohpmzm52x...

AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure

The U.S. government on Wednesday warned of an "active threat" targeting critical infrastructure organizations in the country using artificial intelligence AI-generated exploit scripts. The activity is targeting Siemens S7 SeriesProgrammable Logic Controllers PLCs to conduct reconnaissance and...

Johnson Controls Simplex Incident Manager

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials passwords and authentication tokens from system memory, potentially leading to unauthorized access to the application and connected systems. 2. RECOMMENDED...

CVE-2026-17414

IBM PowerVM Hypervisor firmware (FW1120.00, FW1110.00–.30, FW1060.00–.80, FW950.00–.H2) has a CWE-20 improper input validation flaw in partition firmware during network boot. An unauthenticated adjacent attacker can block boot or substitute the boot image on partitions without OS secure boot (the...

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added four critical vulnerabilities to its Known Exploited Vulnerabilities KEV catalog, stating they are being exploited in the wild. The shortcomings added to the KEV catalog are listed below - CVE-2026-65400 CVSS score: 9...

CVE-2026-70888

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Access and security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracl...

CVE-2026-62454

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Cloud Applications...

CVE-2026-19671 Improper handling of highly compressed data (data amplification) in CISA Malcolm

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

CVE-2026-19671 Improper handling of highly compressed data (data amplification) in CISA Malcolm

Malcolm's upload-processing pipeline scripts/safe-extract.py enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives zip/tar/rar/7z via libarchive, but those limits are not applied when the uploaded file is a single-stream compressed format .gz,...

CVE-2026-19671

Malcolm's safe-extract.py enforces decompression limits only on container archives (zip/tar/rar/7z) but not on single-stream formats (.gz/.xz/.lzma/.lz). An authenticated user can upload a small gzip bomb that decompresses unboundedly, exhausting the shared Docker volume used by OpenSearch, Logst...

CVE-2026-19670 Incorrect Authorization in CISA Malcolm

Malcolm's nginx Lua role-based access control RBAC layer decides whether an authenticated user may reach a role-restricted path e.g. /htadmin, /auth, /adminlogin, /arkime/api/esadmin, NetBox, upload endpoints by pattern-matching the raw, percent-encoded request URI. Nginx itself, however, selects...

cve-analysis-lab

Vulnerability Research & CVE Analysis Lab Analyst: Harsha...

VulnCheck KEV: CVE-2026-58231

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high...