Monitor and prioritize what really matters — the 1% of vulnerabilities that can cause real impact.
An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.
An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allows an unauthenticated remote attacker to modify certain system configurations.
The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.
Zbtlink WE1326, WE357, WE5926, WE5926-WD, WE826-Q, WE826-T2, WE826-WD, WG108, and WG3526 firmware 19.1101, Zbtlink WE2426-C firmware 19.1112, Zbtlink WE5926-EC_QP firmware 20.0516, Zbtlink WF3526-P firmware 19.051, CTN720-W1, LF-1541, and MT7620N firmware 19.1101, and WRC1 firmware 20.0622 contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.
This vulnerability is a SQL Injection flaw caused by improper sanitization of input parameters within the GeoTools Java library. Specifically, the PostGIS DataStore implementation's `jsonArrayContains` function constructs SQL queries by directly embedding the `<value>` parameter without escaping, affecting versions 30.5 and earlier up to 33.6 and 34.5. The root cause lies in unsafe query generation when handling String or JSON fields in PostGIS 12 or greater environments.
This vulnerability is a code injection flaw rooted in improper handling of user-supplied input within the SPIP content management system. Specifically, the analyse_resultat_skel function fails to sanitize the X-Spip-Filtre HTTP request header, allowing arbitrary code to be injected and executed. The flaw affects SPIP versions prior to 4.4.21 and involves the HTTP header processing mechanism.
This vulnerability is a remote code execution flaw caused by improper handling of PHP code blocks within SPIP versions prior to 4.4.20. The root cause lies in incorrect parsing and identification of '<?php' tags combined with var_export's faulty processing of strings containing the '<' character. This parsing error occurs in the code serialization component responsible for exporting PHP variables, leading to unsafe code injection opportunities.
This vulnerability is a deserialization flaw occurring within Microsoft Entra ID's data processing component. The root cause stems from improper handling of untrusted serialized input, which is deserialized without sufficient validation or integrity checks. This flaw affects the deserialization routines responsible for processing network-received data structures, enabling manipulation of internal object states during runtime.
This vulnerability is a code injection flaw classified under CWE-94, caused by improper handling of user-supplied scripts within the TrueConf Server isolated environment. The root cause lies in insufficient validation and sanitization of input scripts processed on port 4307/TCP, allowing crafted payloads to escape sandbox restrictions. The affected component is the script execution environment in TrueConf Server versions 5.3.x through 5.5.5 on Windows and Linux platforms.
This vulnerability is an authentication bypass (CWE-306) affecting TrueConf Server's internal function handling. The root cause is the presence of an undocumented function accessible over network port 4307/TCP that lacks authentication controls, allowing unauthorized invocation. The affected component is the TrueConf Server software versions 5.3.x through 5.5.5 on both Windows and Linux platforms.
This vulnerability is a server-side request forgery (SSRF) caused by improper validation of webhook URLs in MLflow's webhook testing endpoint. The root cause lies in inconsistent URL validation: the _validate_webhook_url() function only checks the original URL, while subsequent HTTP requests follow redirects and re-resolve hostnames without enforcing address pinning. This flaw affects the POST /api/2.0/mlflow/webhooks/{id}/test endpoint, specifically in the webhook URL validation and delivery components.
This vulnerability is a malicious code injection introduced via a tampered plugin build for WPManageNinja Fluent Forms Pro version 6.2.7. The root cause is the inclusion of a rogue PHP file (libs/class-license-sync.php) loaded through a require_once directive in the main plugin file fluentformpro.php. This backdoor component modifies the plugin’s behavior by establishing unauthorized REST API endpoints and persistence mechanisms within the WordPress environment.
This vulnerability is an embedded malicious code issue caused by a tampered plugin build of WPManageNinja Ninja Tables Pro version 5.2.11. The root cause is the inclusion of a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) within the plugin package, which establishes unauthorized backdoor functionality. The affected components include the plugin's updater library and the mu-plugins and uploads directories where persistent PHP files are dropped.
This vulnerability is a command injection flaw rooted in improper sanitization of untrusted input within the SNMP notification processing component of Zimbra Collaboration Suite (ZCS). Specifically, when the optional zimbra-snmp package is installed and SNMP notifications are enabled, maliciously crafted SMTP requests can inject operating system commands. The flaw arises from inadequate input validation during the handling of SNMP notifications in affected ZCS versions prior to 10.1.20.
This vulnerability is an unauthenticated sensitive data exposure affecting the REST API Log component of the Pete Nelson plugin up to version 1.7.1. The root cause lies in improper access control on specific REST API endpoints, allowing external actors to retrieve sensitive log data without authentication. The flaw resides in the API's failure to enforce authorization checks on log retrieval functions.
The vulnerability is an unauthenticated broken access control flaw affecting MultiVendorX versions up to 5.0.10. The root cause lies in improper enforcement of access control checks on certain backend endpoints, allowing unauthorized users to bypass restrictions. This issue specifically impacts the access control mechanisms within the MultiVendorX plugin's API or administrative functions.
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. This vulnerability is due to insufficient error checking when processing HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device. A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition.
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.
This vulnerability is an authentication bypass issue rooted in improper state management within the Screen Sharing service of Apple macOS. The flaw allows network-based attackers to circumvent authentication controls by exploiting how session state is handled during the authentication process. The affected component is the Screen Sharing feature across multiple macOS versions, where authentication validation does not adequately verify credential legitimacy.
This vulnerability is an authentication bypass stemming from an incomplete patch applied to N-able N-central versions through 2026.3.1. The root cause lies in improper validation of authentication tokens within the access control mechanism, specifically affecting the authentication workflow component. The flaw allows bypassing normal authentication checks due to insufficient verification logic in the session validation process.
This vulnerability is an authentication bypass in N-able N-central caused by improper validation of authentication mechanisms, allowing an attacker to circumvent normal authentication controls. The root cause lies in an alternate path or channel within the authentication process that fails to enforce required credentials. This flaw affects the authentication component of N-central versions through 2026.1, enabling unauthorized access through this bypass vector.
This vulnerability is a directory traversal flaw within the VMware vCenter Syslog server component of VMware Cloud Foundation. The root cause lies in insufficient validation of file path inputs, allowing crafted requests to access arbitrary filesystem locations. This improper sanitization enables manipulation of file paths processed by the Syslog server, exposing underlying system directories.
This vulnerability is a malicious code injection caused by the inclusion of an obfuscated JavaScript payload within the Blade template rendering security OTP emails in VaahCMS. The root cause lies in the compromised template file used for email generation, which executes unauthorized JavaScript in any browser processing the affected email. The flaw specifically affects VaahCMS versions 2.0.0 through 2.3.4, targeting the email rendering component responsible for security OTP delivery.
This vulnerability is an authentication bypass caused by the presence of static user credentials embedded within the Cisco Secure Firewall Management Center (FMC) web interface. The root cause lies in the use of hardcoded low-privileged account credentials that allow unauthenticated remote access. The affected component is the FMC management software's web interface authentication mechanism, which fails to enforce unique or dynamic credential validation for this account.
This vulnerability is a privilege escalation flaw rooted in improper access control within the registration method of the balbooa.com Gridbox Joomla extension. The registration functionality incorrectly accepts user-supplied usergroup IDs without validation, enabling unauthorized assignment of administrative privileges. The affected component is the user registration process in Gridbox versions prior to 2.20.2.
The vulnerability is an authenticated arbitrary file upload flaw in the Gridbox extension for Joomla, specifically affecting versions prior to 2.20.2. The root cause lies in insufficient validation and sanitization of uploaded files within the file upload handling component. This allows authenticated users to upload files without proper restriction on file type or content, compromising the integrity of the upload mechanism.
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.
Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.
This vulnerability is an authentication bypass affecting the Check Point SmartConsole login process within the Quantum Security Management product. The root cause lies in improper validation of authentication tokens during the login sequence, allowing an unauthenticated attacker to retrieve a valid application login token. The flaw specifically impacts the authentication mechanism of the Management Server component when Trusted Clients restrictions are not enforced.
This vulnerability is a SQL injection rooted in a route confusion issue within the WordPress REST API batch endpoint. The flaw arises from improper handling of the author__not_in parameter in WP_Query, which allows crafted queries to bypass intended filtering. The affected component is the REST API batch endpoint in WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2, where route resolution errors enable injection of malicious SQL commands.
This vulnerability is a SQL Injection flaw caused by improper sanitization of the author__not_in parameter within the WP_Query component of WordPress. The root cause lies in the failure to validate or escape untrusted input passed to this parameter, allowing malicious input to be interpreted as part of an SQL query. This affects the query construction logic in WordPress versions prior to 6.8.6, 6.9.5, and 7.0.2.
This vulnerability is a chained authentication bypass and arbitrary code execution flaw in IBM Langflow OSS versions 1.0.0 through 1.10.0. The root cause lies in the /api/v1/auto_login endpoint, which mints SUPERUSER tokens without authentication, combined with the /api/v1/validate/code endpoint that executes user-supplied code via the unsafe use of exec(). These two components together enable unauthorized execution of arbitrary commands on default Langflow deployments.
This vulnerability is a stack-based buffer overflow caused by the use of an unsafe strcpy operation within the UPnP handling code of DD-WRT's ssdp.c component. Specifically, the flaw exists in the ssdp_msearch function which processes M-SEARCH requests. The root cause is the lack of proper boundary checks when copying incoming data into a fixed-size internal buffer, affecting the UPnP feature of the router firmware.
This vulnerability is a post-authentication code injection flaw rooted in improper control over code generation within the SonicWall SMA1000 Appliance Management Console (AMC). The vulnerability arises due to insufficient validation of user-supplied input that is incorporated into command execution contexts. The affected component is the AMC interface, which processes administrative commands and configurations.
This vulnerability is a Server-Side Request Forgery (SSRF) affecting the SonicWall SMA1000 Appliance Work Place interface. The root cause lies in improper validation of user-supplied URLs, allowing the appliance to be manipulated into making arbitrary HTTP requests. The flaw exists within the appliance's internal request handling mechanism, specifically in the interface that processes incoming request parameters without adequate origin verification.
This vulnerability is an authentication bypass caused by weak authentication mechanisms within Microsoft Office SharePoint. The root cause lies in improper validation of authentication tokens or credentials, allowing unauthorized access. The affected component is the authentication subsystem of Microsoft SharePoint Enterprise Server 2016 and related versions, which fails to enforce proper security checks over network requests.
This vulnerability is a deserialization flaw occurring within Microsoft Office SharePoint's data processing components. It arises from improper handling of untrusted serialized input, allowing maliciously crafted data to be processed without sufficient validation. The affected component is the deserialization mechanism in Microsoft SharePoint Enterprise Server 2016 and related versions, which fails to securely parse incoming serialized objects over network interfaces.
This vulnerability is a deserialization flaw in Microsoft Office SharePoint's handling of untrusted data. The root cause lies in insecure deserialization logic within SharePoint Enterprise Server 2016 and related versions, where unvalidated input is processed by deserialization routines. This affects the SharePoint server component responsible for processing serialized data objects over network requests.
This vulnerability is an authentication bypass caused by missing authentication checks on critical functions within Microsoft Office SharePoint. The root cause stems from insufficient access control enforcement in the SharePoint Enterprise Server 2016 component, allowing unauthenticated network requests to invoke privileged operations. The flaw specifically affects the authentication mechanism protecting sensitive SharePoint server functions.
ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute code within the ServiceNow platform. ServiceNow addressed this vulnerability by deploying a security update to hosted instances. Relevant security updates have also been provided to ServiceNow self-hosted customers and partners. Further, the vulnerability is addressed in the listed patches and family releases, which have been made available to hosted and self-hosted customers, as well as partners. We are not currently aware of exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.
This vulnerability is an unauthenticated arbitrary file upload flaw in the Balbooa Forms extension for Joomla. The root cause lies in insufficient validation and sanitization of uploaded files within the form submission handler, allowing executable files to be accepted and stored. The affected component is the file upload functionality of the Balbooa Forms Joomla extension, which fails to restrict file types or enforce authentication checks before processing uploads.
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated Authorization header to trigger an OAuth2 passthrough fallback path that replaced failed LiteLLM key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid LiteLLM key. This issue is fixed in version 1.84.0.
This vulnerability is an unauthenticated arbitrary file upload flaw stemming from improper input validation in the Blocksy Companion Pro WordPress plugin prior to version 2.1.47. The root cause is a flawed substring check using strpos() in the Custom Fonts extension, which incorrectly validates file extensions by allowing double-extension filenames to bypass the extension filter. The affected component is the save_attachments function exposed via the Advanced Reviews feature, which processes uploaded files without adequate sanitization.
This vulnerability is an OS command injection caused by improper handling of input in the unauthenticated POST /api/tunnel/tailscale-install endpoint of 9Router. The sudoPassword parameter from the request body is directly passed to the stdin of a 'sudo -S sh' child process without validation or sanitization. The affected component is the tailscale-install API route, which lacks authorization checks due to exclusion from the dashboard middleware matcher.
This vulnerability is an arbitrary file upload flaw caused by improper validation of file extensions in the Divi Form Builder plugin's do_image_upload() function. The root cause lies in the direct interpolation of user-supplied input from the acceptFileTypes POST parameter into a regular expression used for file validation. This affects the file upload component responsible for restricting executable file types, allowing bypass of intended security controls.
