Vulnerability Intelligence
Reviewed CVE records, security advisories and in-depth analysis — every entry linked to its official source.
Microsoft Sharepoint Server < 16.0.19725.20522
Microsoft SharePoint Code Injection Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Adobe Commerce < 2.4.4
Adobe Commerce and Magento Incorrect Authorization Vulnerability
Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue…
Wso2 Api Control Plane >= 4.5.0, < 4.5.0.58
WSO2 Multiple Products Path Traversal Vulnerability
The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly…
Broadcom VMWare ESX Insufficient Logging Vulnerability
VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.
Jfrog Artifactory < 7.133.11
JFrog Artifactory Incorrect Authorization Vulnerability
JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
Sangoma Switchvox >= 8.2.2.1, < 8.4.0.2
Sangoma Switchvox SQL Injection Vulnerability
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An…
Adobe Commerce 2.4.4
Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access…
Litellm Litellm < 1.84.0
BerriAI LiteLLM Improper Authentication Vulnerability
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoint allowed an unauthenticated attacker to use a fabricated…
Kestra Kestra < 1.0.45
Kestra OSS OS Command Injection Vulnerability
Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a…
Linux Linux Kernel >= 5.4.73, < 5.5
Linux Kernel Out-of-Bounds Write Vulnerability
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNAT target keeps the Ethernet source address rewrite behind skb_ensure_writable(skb, 0). This is…