24h | 7d | 30d

CVE-2017-11882

Overview

  • Microsoft Corporation
  • Microsoft Office
15 Nov 2017
Published
21 Oct 2025
Updated
CVSS
Pending
EPSS
94.38%
KEV

Description

Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.

Statistics

  • 1 Post
Last activity: 6 hours ago

Bluesky

Profile picture fallback
piggo @pigondrugs.bsky.social
~Cofense~ Threat actors increasingly abuse legitimate Remote Access Tools (RATs) like NetSupport and ConnectWise to bypass EDR. - IOCs: NetSupport RAT, ConnectWise RAT, CVE-2017-11882 - #Malware #RAT #ThreatIntel
  • 0
  • 0
  • 0
  • 6h ago

CVE-2026-41167

Overview

  • CyferShepard
  • Jellystat
22 Apr 2026
Published
22 Apr 2026
Updated
CVSS v3.1
CRITICAL (9.1)
EPSS
Pending
KEV

Description

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields directly into raw SQL strings. An authenticated user can inject arbitrary SQL via `POST /api/getUserDetails` and `POST /api/getLibrary`, enabling full read of any table in the database - including `app_config`, which stores the Jellystat admin credentials, the Jellyfin API key, and the Jellyfin host URL. Because the vulnerable call site dispatches via `node-postgres`'s simple query protocol (no parameter array is passed), stacked queries are allowed, which escalates the injection from data disclosure to arbitrary command execution on the PostgreSQL host via `COPY ... TO PROGRAM`. Under the role shipped by the project's `docker-compose.yml` (a PostgreSQL superuser), no additional privileges are required to reach the RCE primitive. Version 1.1.10 contains a fix.

Statistics

  • 1 Post
Last activity: Last hour

Fediverse

Profile picture fallback
OffSequence @offseq

🚨 CRITICAL: CyferShepard Jellystat <1.1.10 vulnerable to SQL injection (CVE-2026-41167). Auth’d users can read any DB table & execute commands on the PostgreSQL host. Upgrade to 1.1.10 ASAP! radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • Last hour

CVE-2026-33626

Overview

  • InternLM
  • lmdeploy
20 Apr 2026
Published
21 Apr 2026
Updated
CVSS v3.1
HIGH (7.5)
EPSS
0.03%
KEV

Description

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions prior to 0.12.3 have a Server-Side Request Forgery (SSRF) vulnerability in LMDeploy's vision-language module. The `load_image()` function in `lmdeploy/vl/utils.py` fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources. Version 0.12.3 patches the issue.

Statistics

  • 1 Post
Last activity: 4 hours ago

Bluesky

Profile picture fallback
CyberVeille @cyberveille-ch.bsky.social
📢 CVE-2026-33626 : exploitation de LMDeploy en 12h via SSRF sur endpoint vision-LLM 📝 ## 🗓️ Contexte Le 22 avril 2026, la Sysdig Threat Research T… https://cyberveille.ch/posts/2026-04-22-cve-2026-33626-exploitation-de-lmdeploy-en-12h-via-ssrf-sur-endpoint-vision-llm/ #AI_infrastructure #Cyberveille
  • 0
  • 0
  • 0
  • 4h ago

CVE-2026-30108

Overview

  • Pending
Pending
Published
Pending
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

This candidate has been reserved by a CVE Numbering Authority (CNA). This record will be updated by the assigning CNA once details are available.

Statistics

  • 1 Post
Last activity: 21 hours ago

Fediverse

Profile picture fallback
ZAST AI @zastai

ZAST has identified and verified an insecure deserialization issue in pycel <= 1.0b30, now assigned CVE-2026-30108.

Project page: github.com/dgorissen/pycel
Project footprint: 618 GitHub stars as of April 20, 2026.
Package page: pypi.org/project/pycel/
Latest PyPI release: 1.0b30 on October 13, 2021.

The verified issue is in ExcelCompiler.from_file(), which loads pickle-backed files through pickle.load() without enforcing a trust boundary. The result is a deserialization path where attacker-controlled content can execute code before the application later rejects the loaded object.

This is a representative example of why security teams need automated exploit verification. A dangerous API can often be detected syntactically. The harder problem is determining whether a real product path makes that sink reachable with untrusted input and whether the impact is real. In this case, the PoC confirmed arbitrary code execution during deserialization.

ZAST.AI promotes findings into reports only after successful PoC validation, which supports a zero-false-positive operating model and helps teams prioritize what is demonstrably real.

Full report: blog.zast.ai/vulnerability%20r

  • 0
  • 0
  • 0
  • 21h ago

CVE-2024-10924

Overview

  • Really Simple Plugins
  • Really Simple Security Pro multisite
15 Nov 2024
Published
23 Jan 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
93.89%
KEV

Description

The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default).

Statistics

  • 1 Post
Last activity: 15 hours ago

Fediverse

Profile picture fallback
Analis Siber Purwakarta @analis_siber_purwakarta

CW: Cybersecurity Technical Analysis

WordPress kembali menghadapi tantangan keamanan kritis. Kali ini menyerang plugin "Really Simple Security" (CVE-2024-10924) yang memungkinkan bypass autentikasi 2FA.

Baca selengkapnya di sini: analis-siber-purwakarta.blogsp

#Infosec #CyberSecurity #WordPress #Pentest #BlueTeam #AnalisSiber #WebSecurity

  • 0
  • 0
  • 0
  • 15h ago

CVE-2026-6834

Overview

  • aEnrich
  • a+HRD
22 Apr 2026
Published
22 Apr 2026
Updated
CVSS v4.0
HIGH (7.1)
EPSS
0.04%
KEV

Description

The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a specific API method.

Statistics

  • 1 Post
Last activity: 18 hours ago

Fediverse

Profile picture fallback
OffSequence @offseq

🔒 HIGH severity: aEnrich a+HRD (CVE-2026-6834) missing authorization flaw lets authenticated users read any database content via API. No patch yet — restrict API access & monitor for abuse. radar.offseq.com/threat/cve-20

  • 0
  • 0
  • 0
  • 18h ago

CVE-2026-6299

Overview

  • Google
  • Chrome
15 Apr 2026
Published
16 Apr 2026
Updated
CVSS
Pending
EPSS
0.05%
KEV

Description

Use after free in Prerender in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

Statistics

  • 1 Post
Last activity: 11 hours ago

Bluesky

Profile picture fallback
ケイ | 副業Webライター📖 @keiwork35.bsky.social
【脆弱性情報】 CVE-2026-6299 chromeの脆弱性について Google Chrome の 147.0.7727.101 より前のバージョンにおいて、Prerender に解放後使用の脆弱性が存在します。細工された HTML ページを介して、遠隔の攻撃者が任意のコードを実行できる可能性があります。
  • 0
  • 0
  • 0
  • 11h ago

CVE-2025-40739

Overview

  • Siemens
  • Solid Edge SE2025
08 Jul 2025
Published
08 Jul 2025
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.02%
KEV

Description

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.

Statistics

  • 2 Posts
Last activity: Last hour

Fediverse

Profile picture fallback
datatofu @drmorrisj

Warning: CVE-2025-40739 (CWEs: ['CWE-125']) found no CAPEC relationships.
Warning: CVE-2025-40741 (CWEs: ['CWE-121']) found no CAPEC relationships.

#SoftwareSecurity #MemorySafety #CWE #ADBE
2/2

  • 0
  • 0
  • 0
  • Last hour
Profile picture fallback
datatofu @drmorrisj

Adobe’s 95% VaR is driven by CVE-2025-40739 and CVE-2025-40740. These are CWE-125 (Out-of-bounds Read) and CWE-121 (Stack-based Buffer Overflow) flaws. In a modern stack, these should be legacy ghosts.

Instead, they remain the primary drivers of execution mass. When combined with the P5 Execution vector of 1.44, it reveals that the Adobe consumer is still vulnerable to the most fundamental classes of memory corruption.

Artifacts:
1/2

  • 0
  • 0
  • 0
  • Last hour

CVE-2025-40741

Overview

  • Siemens
  • Solid Edge SE2025
08 Jul 2025
Published
08 Jul 2025
Updated
CVSS v3.1
HIGH (7.8)
EPSS
Pending
KEV

Description

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications contain a stack based overflow vulnerability while parsing specially crafted CFG files. This could allow an attacker to execute code in the context of the current process.

Statistics

  • 1 Post
Last activity: Last hour

Fediverse

Profile picture fallback
datatofu @drmorrisj

Warning: CVE-2025-40739 (CWEs: ['CWE-125']) found no CAPEC relationships.
Warning: CVE-2025-40741 (CWEs: ['CWE-121']) found no CAPEC relationships.

#SoftwareSecurity #MemorySafety #CWE #ADBE
2/2

  • 0
  • 0
  • 0
  • Last hour

CVE-2025-40740

Overview

  • Siemens
  • Solid Edge SE2025
08 Jul 2025
Published
08 Jul 2025
Updated
CVSS v3.1
HIGH (7.8)
EPSS
0.02%
KEV

Description

A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 5). The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.

Statistics

  • 1 Post
Last activity: Last hour

Fediverse

Profile picture fallback
datatofu @drmorrisj

Adobe’s 95% VaR is driven by CVE-2025-40739 and CVE-2025-40740. These are CWE-125 (Out-of-bounds Read) and CWE-121 (Stack-based Buffer Overflow) flaws. In a modern stack, these should be legacy ghosts.

Instead, they remain the primary drivers of execution mass. When combined with the P5 Execution vector of 1.44, it reveals that the Adobe consumer is still vulnerable to the most fundamental classes of memory corruption.

Artifacts:
1/2

  • 0
  • 0
  • 0
  • Last hour
Showing 31 to 40 of 47 CVEs