Security watch
Zero-days first, then everything added to the CISA Known Exploited Vulnerabilities catalog in the last 30 days, and high and critical flaws in popular software. Updated 13 Nov 2026.
Flaws that the vendor says were exploited, or publicly disclosed, before a fix was available. Microsoft publishes this flag for every vulnerability, so Microsoft entries are complete. CISA marks a few others in its own wording. Other vendors do not publish a machine-readable flag, so the absence of a badge does not prove a flaw was not a zero-day. The last 150 days are shown, and entries from the last 30 days have a red edge.
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
Vendor advisory →Out-of-bounds write in .NET allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Vendor advisory →Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network.
Vendor advisory →Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally.
Vendor advisory →Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
Vendor advisory →Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
Vendor advisory →Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".
Vendor advisory →Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to perform tampering locally.
Vendor advisory →Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Vendor advisory →Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.
Vendor advisory →Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
Vendor advisory →Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
Vendor advisory →Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
Vendor advisory →No zero-days match these filters.
Added to the CISA Known Exploited Vulnerabilities catalog in the last 30 days, zero-days first.
Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.
Vendor advisory →Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially…
Vendor advisory →Check Point Firewall, Multi-Domain Security Management Server, Scalable Platforms, Security Gateway, and Security Management Server contain an incorrect permissions assignment for critical resources vulnerability when the Gaia…
Vendor advisory →UnrealIRCd UnrealIRCd contains an improper neutralization of delimiters vulnerability that allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.
Vendor advisory →Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.
Vendor advisory →Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect…
Vendor advisory →Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a…
Vendor advisory →Openwave Messaging Limited Webtop Media Transcoder contains an incorrect resource transfer between spheres vulnerability that may allow an authenticated user to process and convert unintended document types if bypassing the…
Vendor advisory →Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an…
Vendor advisory →IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.
Vendor advisory →OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.
Vendor advisory →SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.
Vendor advisory →GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and…
Vendor advisory →SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful…
Vendor advisory →Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
Vendor advisory →WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable…
Vendor advisory →Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This…
Vendor advisory →Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and…
Vendor advisory →GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular…
Vendor advisory →Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload…
Vendor advisory →Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer…
Vendor advisory →Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Vendor advisory →Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control…
Vendor advisory →PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
Vendor advisory →PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
Vendor advisory →Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the…
Vendor advisory →Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
Vendor advisory →Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652…
Vendor advisory →Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This…
Vendor advisory →Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be…
Vendor advisory →Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the…
Vendor advisory →Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to…
Vendor advisory →EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Vendor advisory →Nothing matches these filters in the last 30 days.
Each entry is a vulnerability that CISA says attackers are using, shown with zero-days first. It is a subset of all published CVEs. Always check the vendor advisory for affected versions and fixes.
High and critical flaws (CVSS 7.0 or higher) published in the last 30 days across languages, frameworks, web servers, Microsoft products, VMware, firewalls and databases. Not every entry is being exploited. A red badge marks the ones that are.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose…
PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before…
Vendor advisory →A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to…
Vendor advisory →PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory…
Vendor advisory →A use-after-free in the replication component of MongoDB Server can occur when a newly elected replica set primary completes catch-up. The condition can be caused by requests that do not require authentication, and may result in…
Vendor advisory →Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all versions…
A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6 may allow an unauthenticated attacker to execute…
A improper encoding or escaping of output vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.2, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer Cloud 8.0.1 through 8.0.2, FortiAnalyzer Cloud 7.6.0 through 7.6.7…
A missing authentication for critical function vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow an unauthenticated attacker with HA FGSP +…
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 8.0.0 through 8.0.1, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11…
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.4, FortiMail 7.4.0 through 7.4.6 may allow an…
Heap-based buffer overflow in Xbox allows an unauthorized attacker to execute code over a network.
Vendor advisory →Integer overflow or wraparound in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Microsoft Color Management allows an unauthorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Vendor advisory →Out-of-bounds write in Microsoft Windows Search Component allows an unauthorized attacker to execute code over a network.
Vendor advisory →Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Windows Xbox Live Networking Service allows an unauthorized attacker to execute code over a network.
Vendor advisory →Out-of-bounds write in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.
Vendor advisory →A numeric truncation error vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a configured ibgp neighbor to send…
A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2 all…
An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
Vendor advisory →Impact Crafted payloads targeting frameworks supporting React Server Components can lead to remote code execution. This only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled…
Vendor advisory →Incorrect authorization in ASP.NET Core allows an authorized attacker to elevate privileges over a network.
Vendor advisory →Laravel's built-in TokenGuard, when configured with a standard token-based API guard, may be bypassed to authenticate as an arbitrary existing user without knowledge of their valid API token. Under certain database…
Vendor advisory →Impact A memory-related vulnerability has been discovered in an upstream library used for Image Optimization can lead to possible remote code execution (RCE) when Next.js runs on glibc-based Linux. Workaround Ensure the version…
Impact A vulnerability in applications using App router with Cache Component can lead to remote code execution. The application needs to have a use cache function that returns multiple typed arrays. Workaround There is no known…
Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with…
Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12…
Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication…
Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgresfdw can legitimately encounter this…
Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause…
Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row…
Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any". Versions before PostgreSQL 18.7…
Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE…
A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a time-series bucket document during a write. The condition can be caused by an authenticated user with privileges to…
Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
Vendor advisory →Null pointer dereference in Microsoft Defender allows an unauthorized attacker to execute code over a network.
Vendor advisory →Stack-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.
Vendor advisory →Untrusted pointer dereference in SQL Server allows an authorized attacker to elevate privileges over a network.
Vendor advisory →Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
Vendor advisory →Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Vendor advisory →Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Vendor advisory →Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
Vendor advisory →Incorrect authorization in Active Directory Domain Services allows an authorized attacker to execute code over a network.
Vendor advisory →Heap-based buffer overflow in Windows Network Connected Devices Auto-Setup Service allows an unauthorized attacker to execute code over an adjacent network.
Vendor advisory →Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xf35-v9jh-g65w. This link is maintained to preserve external references. Original Description Stack-based buffer overflow in Visual Studio…
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-fpxj-5c99-g7vj. This link is maintained to preserve external references. Original Description Deserialization of untrusted data in Visual…
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Vendor advisory →Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
Vendor advisory →Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Vendor advisory →Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster…
Vendor advisory →Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Vendor advisory →nginx-http-flv-module is a media streaming server based on nginx-rtmp-module. Prior to version 1.2.14, if a server received an HTTP/1.0 request without a header Host, which was permitted by HTTP core of Nginx, then…
An incorrect authorization check in the MongoDB Server authorization subsystem may allow an unauthenticated party with local host access to obtain administrative privileges on a database server that has authorization enabled…
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49…
Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Vendor advisory →Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's modhttp2 in assignheaders() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70…
Vendor advisory →Double free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
Vendor advisory →Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
Vendor advisory →Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.
Vendor advisory →Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49…
Vendor advisory →Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49…
Vendor advisory →Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49…
Vendor advisory →The OpenSSL library bundled with the Illumio VEN is affected by an uncontrolled search path vulnerability. A low-privileged, authenticated local attacker could potentially leverage this vulnerability to execute arbitrary code…
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. A crafted PDB LFDECIMAL…
Vendor advisory →Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Attacker-controlled COFF…
Vendor advisory →Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. A Portable PDB…
Vendor advisory →Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. An oversized Portable PDB…
Vendor advisory →Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET. This advisory provides guidance on updating affected applications and components. Crafted PDB line metadata…
Vendor advisory →Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
Vendor advisory →Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
Vendor advisory →Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Vendor advisory →Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49…
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster…
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster…
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
Vendor advisory →An improper privilege management issue in the sharding subsystem of MongoDB Server may allow a user holding certain shard-level administrative privileges to cause persisted internal coordination state to be reprocessed with…
A use-after-free weakness in MongoDB Server's server-side JavaScript support for aggregation may allow a stale reference to previously freed process memory to be read and returned. An authenticated user with minimal or no…
Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld deletes them. Unlike other Docker Engine networking components, the overlay driver does not handle firewalld reload…
Nothing matches these filters.
Sources: NVD, GitHub Advisory Database and Microsoft Security Update Guide. Each product shows its 8 most severe recent entries; 1020 high or critical flaws matched in total.
Stay informed
A short digest of new exploited vulnerabilities and zero-days for the platforms you choose. We only send when there is something new.
Prefer a feed reader? Subscribe to the RSS feed.
We can assess your exposure, plan the fixes and apply them with a rollback path.