In OCaml-TLS before 2.1.0, the server implementation does insufficient checks of the certificate provided by the client (when doing client authentication), which allows impersonation with certificates that are not meant for client authentication (because of KeyUsage and ExtendedKeyUsage). CVSSv3.1 9.1 (CRITICAL)
In OCaml-TLS before 2.1.0, the client implementation does insufficient checks of the certificate provided by the server, which allows impersonation with certificates that are not meant for server authentication (because of KeyUsage and ExtendedKeyUsage). CVSSv3.1 9.1 (CRITICAL)
Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive database information via crafted SQL statements. CVSSv3.1 9.8 (CRITICAL)
An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality. CVSSv3.1 8.4 (HIGH)
An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component. CVSSv3.1 9.8 (CRITICAL)
RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information. CVSSv3.1 9.8 (CRITICAL)
Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker with a valid API token can upload a malicious PHP script and execute arbitrary code on the server. CVSSv3.1 9.8 (CRITICAL)
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_ims_on_with_apn via the ims_apn parameter. CVSSv3.1 9.8 (CRITICAL)
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_dial_call via the dialNumber parameter. CVSSv3.1 9.8 (CRITICAL)
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_radio_on_with_ia_apn via the ia parameter. CVSSv3.1 9.8 (CRITICAL)
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter. CVSSv3.1 9.8 (CRITICAL)
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter. CVSSv3.1 9.8 (CRITICAL)
Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_unlock_sim via the pin parameter. CVSSv3.1 9.8 (CRITICAL)
A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL commands via the 'table' GET parameter in alias_management.php. CVSSv3.1 8.8 (HIGH)
ThingsBoard v4.3.0.1 is vulnerable to an authentication bypass during the OAuth authorization code exchange. The application improperly trusts user-supplied identity data within the user parameter of the /login/oauth2/code/ endpoint. By manipulating the email address in this JSON object, a remote attacker can bypass authentication and gain full access to any existing user account on the platform without possessing the target user's credentials. This results in a complete acco CVSSv3.1 9.8 (CRITICAL)
remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability. CVSSv3.1 9.1 (CRITICAL)
remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability. CVSSv3.1 9.8 (CRITICAL)
An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's trusted Received interface. These conditions establish a vector for arbitrary code execution if the payload is an APK file, or a denial-of-service condition through resource exha CVSSv3.1 8.0 (HIGH)
A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system CVSSv3.1 6.5 (MEDIUM) · EPSS 75th percentile
Fortra's Core Privileged Access Manager (BoKS) contains an OS command injection vulnerability in the boks_autoregisterd service. A remote attacker with network access to the service may be able to cause commands to be executed with the privileges of the service during the autoregistration processing. CVSSv3.1 9.8 (CRITICAL)
CVE-2026-48558 is an OIDC authentication bypass in SimpleHelp that allows unauthenticated attackers to create and authenticate as Technician accounts when OIDC is enabled with specific group configurations. Successful exploitation grants remote access to managed endpoints, script execution, and administrative privileges. SimpleHelp released patches (5.5.16, 6.0 RC2) in May 2026; Horizon3.ai disclosed the vulnerability publicly in June 2026 with indicators of compromise and detection guidance.
AzureHound v2.12.2 released with minor maintenance updates: semver compliance fix for rolling build version strings, GitHub Actions workflow updates, removal of unnecessary build credentials, and migration to Node.js 24 for DigiCert signing.
Exodus Intelligence disclosed a use-after-free vulnerability in VirtualBox's SVGA device implementation affecting Context-Object Tables (COTables). By binding a memory object (MOB) to a COTable and then destroying it without validation, an attacker can maintain a dangling pointer and reuse freed heap memory to corrupt host state and achieve guest-to-host escape with hypervisor-level code execution. The vulnerability was patched in Oracle's January 2026 Critical Patch Update.
Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250. CVSSv3.1 8.8 (HIGH)
Improper Control of Generation of Code ('Code Injection') vulnerability in Edgar Rojas WooCommerce PDF Invoice Builder allows Remote Code Inclusion. This issue affects WooCommerce PDF Invoice Builder: from n/a through 2.0.8. CVSSv3.1 10.0 (CRITICAL)