Skip to content

Threat feed

Security alerts

Notable vulnerabilities from public sources: new CISA KEV additions, critical CVEs (CVSS 9 or higher) and newly published public exploits. Updated continuously, newest first.

Search a CVE Atom feed

2,031 alerts · page 15 of 102

  1. Critical (CVSS 9+) Published · updated

    CVE-2026-116785 FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: signalwire freeswitch

    FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, ws_read_frame() decoded a WebSocket frame's 64-bit extended payload length with...

  2. Critical (CVSS 9+) Published · updated

    CVE-2026-100358 SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection

    CriticalCVSS 9.4

    Exploit status: No public exploit known

    Affects: SuiteCRM

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the Studio Dropdown Editor passes $dropdown_name through html_entity_decode() and writes the result verbatim into a PHP language file under custom...

  3. Critical (CVSS 9+) Published · updated

    CVE-2026-71550 SuiteCRM: LFI to RCE via AOW_WorkFlow

    CriticalCVSS 9.9

    Exploit status: No public exploit known

    Affects: SuiteCRM

    SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the workflow controller uses a path-traversal-capable aow_action value in require_once() without constraining the resolved file. The affected flow...

  4. Critical (CVSS 9+) Published

    CVE-2026-123198 LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>

    CriticalCVSS 9.3

    Exploit status: No public exploit known

    Affects: lmfdb/lmfdb

    LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query-string values or 'content' data to /knowle...

  5. Critical (CVSS 9+) Published · updated

    CVE-2026-54143 OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: tinyhumansai openhuman

    OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before version 0.57.13, an attacker who can send messages to a configured external channel can cause the agent to create persistent shell cron jobs without human approval. The scheduler...

  6. Critical (CVSS 9+) Published · updated

    CVE-2026-54141 OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`

    CriticalCVSS 9.0

    Exploit status: No public exploit known

    Affects: tinyhumansai openhuman

    OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, a remote direct message received through a configured Yuanbao channel is converted into a generic channel AgentTurnRequest that uses the default tool policy without esta...

  7. Critical (CVSS 9+) Published · updated

    CVE-2026-119344 Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: ultravioletrs cocos

    Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidence to an allowed platform owner or unique ma...

  8. CISA KEV addition Published · updated

    CVE-2026-123158 sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be...

    HighCVSS 8.1 EPSS 16.5% CISA KEV added 2026-11-09 · due 2026-11-12 Exploited in the wild

    Exploit status: Exploited in the wild (confirmed)

    Affects: azure linux openssh, redhat/openssh, redhat/openshell and 5 more

    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256...

  9. Critical (CVSS 9+) Published · updated

    CVE-2026-74841 Apache OFBiz: Denial of Service via unauthenticated userTenantId in multitenant mode

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: Apache OFBiz

    In multitenant deployments, ContextFilter and LoginWorker built a per-tenant delegator name from a request-supplied userTenantId parameter and requested a delegator for it before confirming the tenant existed. DelegatorFactory's internal cache retains every delegator name it is a...

  10. Critical (CVSS 9+) Published · updated

    CVE-2026-81815 Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Apache OFBiz

    SQL Injection in the entity engine's generic performFind service in Apache OFBiz 24.09 before 24.09.08 on MySQL/MariaDB-backed deployments allows a remote unauthenticated attacker to disclose arbitrary rows from the queried entity by submitting an ignore-case find request (e.g. _...

  11. Critical (CVSS 9+) Published · updated

    CVE-2026-82907 Apache OFBiz: externalLoginKey honoured pre-auth, reusable and unbound

    CriticalCVSS 9.8 EPSS 0.80%

    Exploit status: No public exploit known

    Affects: Apache OFBiz

    Authentication Bypass by Capture-replay in ExternalLoginKeysManager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker who captures a live externalLoginKey value to obtain a complete, cookie-free, reusable session as the user who issue...

  12. Critical (CVSS 9+) Published · updated

    CVE-2026-83542 Apache OFBiz: Unauthenticated RCE via login-page widget injection

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Apache OFBiz

    Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipart upload and overriding the mainDecoratorLo...

  13. Critical (CVSS 9+) Published · updated

    CVE-2026-105330 Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT Token Authentication Enables Unauthenticated Administrative Access

    CriticalCVSS 9.8

    Exploit status: No public exploit known

    Affects: Apache OFBiz

    Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms allows an unauthenticated, network-reachable attacker to obtain full administrative access via a forged JWT signed with the factory-default security.token.key va...

  14. Critical (CVSS 9+) Published · updated

    CVE-2026-117691 Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names

    CriticalCVSS 9.1

    Exploit status: No public exploit known

    Affects: redhat build keycloak, redhat red hat single sign on, redhat/rhbk/keycloak-operator-bundle:26.6.9-1 and 4 more

    A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this...

  15. Critical (CVSS 9+) Published · updated

    CVE-2026-121489 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-microservice-core, org.apache.juneau/juneau-commons

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Juneau. The microservice DirectoryResource does not keep request paths inside its configured root directory. When an application enables the resource's view, upload or delete se...

  16. Critical (CVSS 9+) Published · updated

    CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-marshall

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Juneau. HTML document serialization does not HTML-encode variable substitutions in the page chrome (header, nav, aside, footer and similar fields). Applications whose chro...

  17. Critical (CVSS 9+) Published · updated

    CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-rest-server.

    Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache Juneau. The Apache Juneau REST server passed response header values and redirect targets to the servlet container unchecked. An application that sets a response header or...

  18. Critical (CVSS 9+) Published · updated

    CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-rest-client, org.apache.juneau/juneau-rest-common

    Insufficiently Protected Credentials vulnerability in Apache Juneau. The Apache Juneau RestClient followed HTTP redirects while keeping credential headers from the original request, so a server that redirected the client to a different host or port, or from HTTPS to HTTP, could r...

  19. Critical (CVSS 9+) Published · updated

    CVE-2026-73101 Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-rest-server.

    Generation of Error Message Containing Sensitive Information vulnerability in Apache Juneau. The REST server sends the internal exception class and message to clients in a "Thrown" response header on every error response, and can include internal exception messages in the error b...

  20. Critical (CVSS 9+) Published · updated

    CVE-2026-73100 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors

    CriticalCVSS 10.0

    Exploit status: No public exploit known

    Affects: org.apache.juneau/juneau-rest-server., org.apache.juneau/juneau-rest-common

    Insertion of Sensitive Information into Log File vulnerability in Apache Juneau. The default REST server call logger records request headers for requests that end in a server error, without redacting them. Any client able to cause a server error gets headers such as Authorization...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS and public exploit-reference metadata. A proof-of-concept means public code exists; it is not evidence of exploitation. "Exploited in the wild" means confirmed exploitation (e.g. a CISA KEV listing).