CVE-2026-80104 — Critical vulnerability brief
CVSS 9.3DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in…
Category: Critical CVEs
Critical and exploited CVEs, vulnerability intelligence and remediation guidance.
CVE-2026-79787 — Critical vulnerability brief
CVSS 9.3Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user…
CVE-2026-76195 — Critical vulnerability brief
CVSS 10Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability…
CVE-2024-58378 — Critical vulnerability brief
CVSS 9.3Nokogiri before 1.15.6 and 1.16.x before 1.16.2 (CRuby, when using the packaged libxml2) is affected by a use-after-free vulnerability in libxml2 (CVE-2024-25062)…
CVE-2026-16286 — Critical vulnerability brief
CVSS 9.8Unrestricted upload of file with dangerous type vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Software Repository…
CVE-2024-28224: Ollama DNS Rebinding Vulnerability
CVE-2024-28224 is a vulnerability in Ollama that allows DNS rebinding attacks to access the Ollama API without authentication. The issue was fixed…
Marimo Notebook High-Severity Flaw Allows MCP Command Execution Before Cell Execution
Marimo, the developer of the open-source Marimo notebook software, has patched a high-severity code injection vulnerability tracked as CVE-2026-75149. The flaw, discovered…
CVE-2026-75149 — Vulnerability brief
CVE-2026-75149 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
CVE-2026-67618 — Vulnerability brief
CVE-2026-67618 was identified as a relevant cybersecurity entity in recently ingested reporting. This profile is generated so related cyber news, CVEs, malware,…
Attackers Exploit miniOrange SAML Flaws to Gain WordPress Admin Access
Threat actors are actively exploiting two critical authentication bypass vulnerabilities in the Xecurify miniOrange SAML 2.0 Single Sign On plugin for WordPress.…