Vulnerability Intelligence
Reviewed CVE records, security advisories and in-depth analysis — every entry linked to its official source.
Watchguard Fireware >= 12.0, < 12.5.21
A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting…
Jetbrains Youtrack < 2026.2.19197
In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution
Jetbrains Teamcity < 2025.11.8
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
Electronjs Electron < 41.10.6
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron guest could enable nodeIntegrationInWorker for its Web Workers even…
Gnome Libsoup < 3.7.3
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the…
Simple-git Project Simple-git < 4.0.0
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous…
Simple-git Project Simple-git >= 3.15.0, < 4.0.1
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not classify trailer..cmd as unsafe…
Dell Policy Manager For Secure Connect Gateway < 5.36.00.16
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access could potentially…
Balbooa Forms < 2.4.3.4
Joomla Extension – balbooa.com – Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 – The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores…
Balbooa Forms < 2.4.3.4
Joomla Extension – balbooa.com – Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 – Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature…