24h | 7d | 30d

CVE-2026-107818

Overview

  • MariaDB
  • server
09 Oct 2026
Published
09 Oct 2026
Updated
CVSS v3.1
HIGH (8.4)
EPSS
0.34%
KEV

Description

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Statistics

  • 1 Post
Last activity: 14 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Nine MariaDB vulnerabilities enable privilege escalation and code execution, rated up to CVSS 8.5. Upgrade to the fixed Server and Connector/C releases.

securityonline.info/mariadb-vu

  • 0
  • 0
  • 0
  • 14h ago

CVE-2026-85955

Overview

  • Progress Software Corporation
  • MarkLogic Server
12 Oct 2026
Published
12 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
Pending
KEV

Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with query-execution access to invoke an XQuery evaluation function without the additional required evaluation privilege, which could result in server-side code execution with elevated permissions.

Statistics

  • 1 Post
Last activity: 10 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Progress fixed 31 MarkLogic Server vulnerabilities, including CVSS 9.9 privilege escalation flaws. Upgrade to MarkLogic 12.1 or 11.3.7 now.

securityonline.info/critical-m

  • 0
  • 0
  • 0
  • 10h ago

CVE-2026-103529

Overview

  • Thelia
  • Thelia
12 Oct 2026
Published
12 Oct 2026
Updated
CVSS
Pending
EPSS
Pending
KEV

Description

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's `install()` method which will then be executed upon installation, enabling remote code execution with the privileges of the web server.

Statistics

  • 1 Post
Last activity: 11 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

CERT/CC lists 11 unpatched Thelia vulnerabilities, including remote code execution flaws in versions 2.6.0, 2.6.1 and 3.0.0. Lock down admin access now.

securityonline.info/thelia-vul

  • 0
  • 0
  • 0
  • 11h ago

CVE-2026-96012

Overview

  • IBM
  • Db2 Mirror for i
12 Oct 2026
Published
12 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
Pending
KEV

Description

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation checks to execute malicious code. An attacker could exploit this vulnerability to obtain elevated privileges on the system.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Three IBM critical vulnerabilities, rated up to CVSS 9.9, hit IBM i, Db2 Mirror and Maximo AI Service, including remote code execution. Patch now.

securityonline.info/ibm-critic

  • 0
  • 0
  • 0
  • 2h ago

CVE-2026-85948

Overview

  • Progress Software Corporation
  • MarkLogic Server
12 Oct 2026
Published
12 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
Pending
KEV

Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

Statistics

  • 1 Post
Last activity: 10 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Progress fixed 31 MarkLogic Server vulnerabilities, including CVSS 9.9 privilege escalation flaws. Upgrade to MarkLogic 12.1 or 11.3.7 now.

securityonline.info/critical-m

  • 0
  • 0
  • 0
  • 10h ago

CVE-2026-90920

Overview

  • IBM
  • Maximo AI Service
12 Oct 2026
Published
12 Oct 2026
Updated
CVSS v3.1
CRITICAL (9.8)
EPSS
Pending
KEV

Description

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

Statistics

  • 1 Post
Last activity: 2 hours ago

Fediverse

Profile picture fallback
Daily CyberSecurity @DailyCyberSecurity

Three IBM critical vulnerabilities, rated up to CVSS 9.9, hit IBM i, Db2 Mirror and Maximo AI Service, including remote code execution. Patch now.

securityonline.info/ibm-critic

  • 0
  • 0
  • 0
  • 2h ago

CVE-2025-41452

Overview

  • Danfoss
  • AK-SM8xxA Series
22 Aug 2025
Published
22 Aug 2025
Updated
CVSS v4.0
MEDIUM (6.8)
EPSS
0.27%
KEV

Description

Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of service attack induced by improper handling of exceptional conditions

Statistics

  • 1 Post
Last activity: 14 hours ago

Bluesky

Profile picture fallback
Kevin Poireault @leekthehack.bsky.social
Danfoss products have been found to contain critical cybersecurity vulnerabilities in the past, such as CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, some of which could allow attackers to gain privileged access to refrigeration control systems and manipulate physical equipment.
  • 0
  • 0
  • 0
  • 14h ago

CVE-2025-41450

Overview

  • Danfoss
  • AK-SM 8xxA Series
08 May 2025
Published
27 Aug 2025
Updated
CVSS v3.1
HIGH (8.2)
EPSS
0.35%
KEV

Description

Improper Authentication vulnerability in Danfoss AKSM8xxA Series.This issue affects Danfoss AK-SM 8xxA Series prior to version 4.2

Statistics

  • 1 Post
Last activity: 14 hours ago

Bluesky

Profile picture fallback
Kevin Poireault @leekthehack.bsky.social
Danfoss products have been found to contain critical cybersecurity vulnerabilities in the past, such as CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, some of which could allow attackers to gain privileged access to refrigeration control systems and manipulate physical equipment.
  • 0
  • 0
  • 0
  • 14h ago

CVE-2023-25915

Overview

  • Danfoss
  • AK-SM800A
21 Aug 2023
Published
09 Jan 2025
Updated
CVSS v3.1
CRITICAL (9.9)
EPSS
1.04%
KEV

Description

Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system.

Statistics

  • 1 Post
Last activity: 14 hours ago

Bluesky

Profile picture fallback
Kevin Poireault @leekthehack.bsky.social
Danfoss products have been found to contain critical cybersecurity vulnerabilities in the past, such as CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, some of which could allow attackers to gain privileged access to refrigeration control systems and manipulate physical equipment.
  • 0
  • 0
  • 0
  • 14h ago

CVE-2025-41451

Overview

  • Danfoss
  • AK-SM8xxA Series
22 Aug 2025
Published
22 Aug 2025
Updated
CVSS v4.0
HIGH (8.7)
EPSS
0.96%
KEV

Description

Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potential post-authenticated remote code execution on an attacked system.

Statistics

  • 1 Post
Last activity: 14 hours ago

Bluesky

Profile picture fallback
Kevin Poireault @leekthehack.bsky.social
Danfoss products have been found to contain critical cybersecurity vulnerabilities in the past, such as CVE-2023-25915, CVE-2025-41450, CVE-2025-41451 and CVE-2025-41452, some of which could allow attackers to gain privileged access to refrigeration control systems and manipulate physical equipment.
  • 0
  • 0
  • 0
  • 14h ago
Showing 61 to 70 of 70 CVEs