newsThe portal itself — self-promo until real sponsors land
Subscribe, build a custom feed, or pitch a sponsorship at hello@acadenix.com
Latest intel// live feed
25 results//sorted by published//last sync 2026-07-15 22:11Z
Subscribe to news →
CVE-2020-21818 — Gnu Libredwg: A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:48.
A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:48. CVSSv3.1 8.8 (HIGH) · EPSS 65th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2020-21816 — Gnu Libredwg: A heab based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:46.
A heab based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:46. CVSSv3.1 8.8 (HIGH) · EPSS 65th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2020-21814 — Gnu Libredwg: A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlwescape ../../programs/escape.c:97.
A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlwescape ../../programs/escape.c:97. CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2021-29053 — Liferay Dxp: Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 and Liferay DXP 7.3 before fix pack 1 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to (1) CommerceChannelRelFinder.countByC_C, or (2) CommerceChannelRelFinder.findByC_C. CVSSv3.1 8.8 (HIGH) · EPSS 64th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2021-27384 — Siemens Simatic_wincc_runtime_advanced: SmartVNC has an out-of-bounds memory access vulnerability in the device layout handler, represented by
A vulnerability has been identified in SIMATIC HMI Comfort Outdoor Panels V15 7\" & 15\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Outdoor Panels V16 7\" & 15\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI Comfort Panels V15 4\" - 22\" (incl. SIPLUS variants) (All versions < V15.1 Update 6), SIMATIC HMI Comfort Panels V16 4\" - 22\" (incl. SIPLUS variants) (All versions < V16 Update 4), SIMATIC HMI KTP Mobile Panels V15 CVSSv3.1 9.8 (CRITICAL) · EPSS 81th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2021-28860 — Adaltas Mixme: This will put the availability of the program at risk causing a potential denial
In Node.js mixme, prior to v0.5.1, an attacker can add or alter properties of an object via '__proto__' through the mutate() and merge() functions. The polluted attribute will be directly assigned to every object in the program. This will put the availability of the program at risk causing a potential denial of service (DoS). CVSSv3.1 9.1 (CRITICAL) · EPSS 78th percentile
9.1
CVSS v3.1
96
Edit Score
CVE-2021-25681 — Adtran Personal_phone_manager: Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for
AdTran Personal Phone Manager 10.8.1 software is vulnerable to an issue that allows for exfiltration of data over DNS. This could allow for exposed AdTran Personal Phone Manager web servers to be used as DNS redirectors to tunnel arbitrary data over DNS. NOTE: The affected appliances NetVanta 7060 and NetVanta 7100 are considered End of Life and as such this issue will not be patched. CVSSv3.1 7.5 (HIGH) · EPSS 96th percentile
7.5
CVSS v3.1
92
Edit Score
CVE-2021-27130 — Janobe Online_reviewer_system: Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may
Online Reviewer System 1.0 contains a SQL injection vulnerability through authentication bypass, which may lead to a reverse shell upload. CVSSv3.1 9.8 (CRITICAL) · EPSS 68th percentile
9.8
CVSS v3.1
99
Edit Score
CVE-2020-21884 — Indionetworks Unibox_u50_firmware: Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain
Unibox SMB 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a cross-site request forgery (CSRF) vulnerability in /tools/network-trace, /list_users, /list_byod?usertype=raduser, /dhcp_leases, /go?rid=202 in which a specially crafted HTTP request may reconfigure the device. CVSSv3.1 8.8 (HIGH) · EPSS 63th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2020-21883 — Indionetworks Unibox_u50_firmware: Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain
Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping, which can leads to complete device takeover. CVSSv3.1 8.8 (HIGH) · EPSS 92th percentile
8.8
CVSS v3.1
96
Edit Score
CVE-2021-30246 — Kjur Jsrsasign: In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures
In the jsrsasign package through 10.1.13 for Node.js, some invalid RSA PKCS#1 v1.5 signatures are mistakenly recognized to be valid. NOTE: there is no known practical attack. CVSSv3.1 9.1 (CRITICAL) · EPSS 57th percentile
9.1
CVSS v3.1
96
Edit Score
CVE-2021-22659 — Rockwellautomation Micrologix_1400_firmware: Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker
Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus packet allowing the attacker to retrieve or modify random values in the register. If successfully exploited, this may lead to a buffer overflow resulting in a denial-of-service condition. The FAULT LED will flash RED and communications may be lost. Recovery from denial-of-service condition requires the fault to be cleared by the user. CVSSv3.1 8.6 (HIGH) · EPSS 72th percentile
8.6
CVSS v3.1
93
Edit Score
CVE-2021-25667 — Siemens Ruggedcom_rm1224_firmware: Affected devices contain a stack-based buffer overflow vulnerability in the handling of STP BPDU
A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All versions >= V4.3 and < V6.4), SCALANCE SC-600 Family (All versions >= V2.0 and < V2.1.3), SCALANCE XB-200 (All versions < V4.1), SCALANCE XC-200 (All versions < V4.1), SCALANCE XF-200BA (All versions < V4.1), SCALANCE XM400 (All versions < V6.2), SCALANCE XP-200 (All versions < V4.1), SCALANCE XR-300WG (All versions < CVSSv3.1 8.8 (HIGH) · EPSS 54th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2020-29238 — Expressvpn Expressvpn: An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows
An integer buffer overflow in the Nginx webserver of ExpressVPN Router version 1 allows remote attackers to obtain sensitive information when the server running as reverse proxy via specially crafted request. CVSSv3.1 7.5 (HIGH) · EPSS 97th percentile
7.5
CVSS v3.1
92
Edit Score
CVE-2020-27575 — Maxum Rumpus: 8.2.13 and 8.2.14 is affected by a command injection vulnerability.
Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation. CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile
8.8
CVSS v3.1
95
Edit Score
CVE-2020-27574 — Maxum Rumpus: 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF).
Maxum Rumpus 8.2.13 and 8.2.14 is affected by cross-site request forgery (CSRF). If an authenticated user visits a malicious page, unintended actions could be performed in the web application as the authenticated user. CVSSv3.1 8.8 (HIGH) · EPSS 51th percentile
8.8
CVSS v3.1
94
Edit Score
CVE-2020-24914 — Qcubed Qcubed: A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes
A PHP object injection bug in profile.php in qcubed (all versions including 3.1.1) unserializes the untrusted data of the POST-variable "strProfileData" and allows an unauthenticated attacker to execute code via a crafted POST request. CVSSv3.1 9.8 (CRITICAL) · EPSS 92th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2020-24913 — Qcubed Qcubed: A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the
A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request. CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2020-24036 — Fork-cms Fork_cms: PHP object injection in the Ajax endpoint of the backend in ForkCMS below version
PHP object injection in the Ajax endpoint of the backend in ForkCMS below version 5.8.3 allows an authenticated remote user to execute malicious code. CVSSv3.1 8.8 (HIGH) · EPSS 85th percentile
8.8
CVSS v3.1
95
Edit Score
CVE-2021-27132 — Sercomm Agcombo_vd625_firmware: AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in
SerComm AG Combo VD625 AGSOT_2.1.0 devices allow CRLF injection (for HTTP header injection) in the download function via the Content-Disposition header. CVSSv3.1 9.8 (CRITICAL) · EPSS 97th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-21974 — Vmware Cloud_foundation: A malicious actor residing within the same network segment as ESXi who has access
OpenSLP as used in ESXi (7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG) has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue in OpenSLP service resulting in remote code execution. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2020-24841 — Sdg Pnpscada: 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp.
PNPSCADA 2.200816204020 allows SQL injection via parameter 'interf' in /browse.jsp. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. CVSSv3.1 9.8 (CRITICAL) · EPSS 75th percentile
9.8
CVSS v3.1
100
Edit Score
CVE-2021-25299 — Nagios Nagios_xi: XI version xi-5.7.5 is affected by cross-site scripting (XSS).
Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server. CVSSv3.1 6.1 (MEDIUM) · EPSS 100th percentile
6.1
CVSS v3.1
100
Edit Score
CVE-2021-25298 — Nagios Nagios_xi: XI version xi-5.7.5 is affected by OS command injection.
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. CVSSv3.1 8.8 (HIGH) · EPSS 99th percentile
8.8
CVSS v3.1
100
Edit Score
CVE-2021-25297 — Nagios Nagios_xi: XI version xi-5.7.5 is affected by OS command injection.
Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile
8.8
CVSS v3.1
100
Edit Score