SolarWinds Orion API - Auth Bypass

SolarWinds Orion API is vulnerable to an authentication bypass vulnerability that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance...

Kibana Timelion - Arbitrary Code Execution

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands...

Cisco ASA - Local File Inclusion

Cisco Adaptive Security Appliances ASA web interfaces could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. It is also possible on certain software releases that the ASA will not reload, but an attacker...

Adobe ColdFusion - Access Control Bypass

An attacker is able to access every CFM and CFC endpoint within the ColdFusion Administrator path /CFIDE/, of which there are 437 CFM files and 96 CFC files in a ColdFusion 2021 Update 6 install. id: CVE-2023-29298 info: name: Adobe ColdFusion - Access Control Bypass author:...

Apache Struts2 S2-053 - Remote Code Execution

Apache Struts 2.1.x and 2.3.x with the Struts 1 plugin might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage. id: CVE-2017-9791 info: name: Apache Struts2 S2-053 - Remote Code Execution author: pikpikcu severity: critical description: | Apache...

Apache Tomcat Servers - Remote Code Execution

Apache Tomcat servers 7.0.0 to 79 are susceptible to remote code execution. By design, you are not allowed to upload JSP files via the PUT method. This is likely a security measure to prevent an attacker from uploading a JSP shell and gaining remote code execution on the server. However, due to t...

Worpress Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote...

Joomla! Webservice - Password Disclosure

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. id: CVE-2023-23752 info: name: Joomla! Webservice - Password Disclosure author: badboycxcc,Sascha Brendel severity: medium description: | An issue was discovered in...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

PT-2026-71871

Name of the Vulnerable Software and Affected Versions Vault Secrets Operator versions 1.3.0 through 1.4.1 Description An arbitrary file read and credential exfiltration issue exists in the AppRole authentication configuration. This allows a tenant with limited Kubernetes RBAC Role-Based Access...

PT-2026-71693

Name of the Vulnerable Software and Affected Versions HTML::FormHandler versions prior to 0.40069 Description An issue exists where apply actions and add error use error message text constructed from request data as a Locale::Maketext bracket notation template. Because the default handle's lexico...

PT-2026-71595

amazing-print/amazing print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with ...

PT-2026-71695

Form::Processor::Field::HtmlArea versions from 0.06 through 1.162360 for Perl allow attacker selected method dispatch and resource exhaustion via an HTML::Tidy diagnostic that validate passes to add error as a Locale::Maketext template. validate runs HTML::Tidy over the submitted markup and passe...

Linux Distros Unpatched Vulnerability : CVE-2026-73231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows...

PT-2026-76575

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...

CVE-2026-69184

GHSA-pjmc-gx33-gc76: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains...

CVE-2026-67986

amazing-print/amazingprint at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArraygrep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a...

UBUNTU-CVE-2026-69184

GHSA-pjmc-gx33-gc76: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains...

Linux Distros Unpatched Vulnerability : CVE-2022-4993

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because applyactions and adderror use error...

PT-2026-75934

Summary Vault token and secret values are exposed in thrown errors when using hashi-vault-js. Details Every API method in Vault.js executes throw parseAxiosErrorerr, which returns the raw AxiosError untouched. That error carries the full Axios configuration, including the X-Vault-Token header and...