Aggregator

CVE-2025-63910 | Cohesity TranZman Migration Appliance 4.0 Build 14614 Patch File unrestricted upload

VulDB Recent Entries
1 month 1 week ago
A vulnerability, which was classified as critical, was found in Cohesity TranZman Migration Appliance 4.0 Build 14614. This impacts an unknown function of the component Patch File Handler. The manipulation results in unrestricted upload. This vulnerability was named CVE-2025-63910. The attack may be performed from remote. There is no available exploit.
vuldb.com

CVE-2021-35485 | Nokia Impact up to 19.11.2.10-202 application fileupload unrestricted upload

VulDB Recent Entries
1 month 1 week ago
A vulnerability, which was classified as critical, has been found in Nokia Impact up to 19.11.2.10-202. This affects an unknown function of the file /ui/rest-proxy/application. The manipulation of the argument fileupload leads to unrestricted upload. This vulnerability is uniquely identified as CVE-2021-35485. The attack is possible to be carried out remotely. No exploit exists.
vuldb.com

CVE-2021-35483 | Nokia Impact up to 19.11.2.10-202 application fileupload unrestricted upload

VulDB Recent Entries
1 month 1 week ago
A vulnerability classified as critical was found in Nokia Impact up to 19.11.2.10-202. The impacted element is an unknown function of the file /ui/rest-proxy/application. Executing a manipulation of the argument fileupload can lead to unrestricted upload. This vulnerability is handled as CVE-2021-35483. The attack can be executed remotely. There is not any exploit available.
vuldb.com

Amazon Says Drone Strikes Disrupted Middle East Data Centers

Ransomware DataBreachToday.com
1 month 1 week ago
Iranian Cyberespionage Group MuddyWater Goes Dark
Physical effects rather than cyber strikes are triggering Middle Eastern connectivity problems during day four of a sustained U.S. and Israeli bombing campaign against Iran. Iran is responding with drone and missile attacks targeting U.S. military as well as British bases in Bahrain, Cyprus.

Coruna: Spy-grade iOS exploit kit powering financial crime

Help Net Security
1 month 1 week ago

A powerful iOS exploit kit has circulated among multiple threat actors over the past year, moving from a commercial surveillance operation to state-linked espionage campaigns and, ultimately, ended into the hands of financially motivated hackers, according to new research from Google’s Threat Intelligence Group (GTIG). “The exploit kit, named ‘Coruna’ by its developers, contained five full iOS exploit chains and a total of 23 exploits,” the analysts noted. The exploit list includes both CVE-tracked vulnerabilities … More →

The post Coruna: Spy-grade iOS exploit kit powering financial crime appeared first on Help Net Security.

Zeljka Zorz

CVE-2026-1927 | Greenshift Plugin up to 12.5.7 on WordPress AI API Key greenshift_app_pass_validation information disclosure

Vuldb Updates
1 month 1 week ago
A vulnerability was found in Greenshift Plugin up to 12.5.7 on WordPress. It has been declared as problematic. Affected by this vulnerability is the function greenshift_app_pass_validation of the component AI API Key Handler. Executing a manipulation can lead to information disclosure. This vulnerability is handled as CVE-2026-1927. The attack can be executed remotely. There is not any exploit available.
vuldb.com

CVE-2026-26275 | junkurihara httpsig-rs up to 0.0.22 integrity check (GHSA-7v42-g35v-xrch)

Vuldb Updates
1 month 1 week ago
A vulnerability was found in junkurihara httpsig-rs up to 0.0.22 and classified as problematic. This affects an unknown part. Executing a manipulation can lead to improper validation of integrity check value. This vulnerability appears as CVE-2026-26275. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.
vuldb.com

CVE-2026-27199 | Pallets Werkzeug up to 3.1.5 send_from_directory windows device name (GHSA-29vq-49wr-vm6x)

Vuldb Updates
1 month 1 week ago
A vulnerability categorized as problematic has been discovered in Pallets Werkzeug up to 3.1.5. Affected by this vulnerability is the function send_from_directory. The manipulation results in improper handling of windows device names. This vulnerability is reported as CVE-2026-27199. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.
vuldb.com

CVE-2026-27198 | getformwork up to 2.3.3 Account Creation privileges management (GHSA-34p4-7w83-35g2)

Vuldb Updates
1 month 1 week ago
A vulnerability identified as critical has been detected in getformwork formwork up to 2.3.3. Affected by this issue is some unknown functionality of the component Account Creation Handler. This manipulation causes improper privilege management. This vulnerability appears as CVE-2026-27198. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.
vuldb.com

CVE-2026-3057 | a54552239 pearProjectApi up to 2.8.10 Backend Interface Task.php dateTotalForProject projectCode sql injection

Vuldb Updates
1 month 1 week ago
A vulnerability, which was classified as critical, was found in a54552239 pearProjectApi up to 2.8.10. Affected is the function dateTotalForProject of the file application/common/Model/Task.php of the component Backend Interface. The manipulation of the argument projectCode results in sql injection. This vulnerability is reported as CVE-2026-3057. The attack can be launched remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.
vuldb.com

CVE-2026-25591 | QuantumNous new-api up to 0.10.8-alpha.9 Token Search Endpoint /api/token/search keyword/token data query logic injection (GHSA-w6x6-9fp7-fqm4)

Vuldb Updates
1 month 1 week ago
A vulnerability classified as problematic has been found in QuantumNous new-api up to 0.10.8-alpha.9. Impacted is an unknown function of the file /api/token/search of the component Token Search Endpoint. Performing a manipulation of the argument keyword/token results in improper neutralization of special elements in data query logic. This vulnerability is identified as CVE-2026-25591. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2026-26993 | FlintSH Flare 1.7.1 SVG cross site scripting (GHSA-q8fp-w6m5-4gjm)

Vuldb Updates
1 month 1 week ago
A vulnerability was found in FlintSH Flare 1.7.1. It has been declared as problematic. This affects an unknown function of the component SVG Handler. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-26993. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.
vuldb.com

CVE-2025-37184 | HPE EdgeConnect SD-WAN Orchestrator up to 9.4.4/9.6.0 Orchestrator Service improper authentication

Vuldb Updates
1 month 1 week ago
A vulnerability was found in HPE EdgeConnect SD-WAN Orchestrator up to 9.4.4/9.6.0. It has been classified as critical. Impacted is an unknown function of the component Orchestrator Service. Performing a manipulation results in improper authentication. This vulnerability is known as CVE-2025-37184. Remote exploitation of the attack is possible. No exploit is available.
vuldb.com

CVE-2024-0756 | Insert or Embed Articulate Content into WordPress Plugin cross site scripting

Vuldb Updates
1 month 1 week ago
A vulnerability, which was classified as problematic, has been found in Insert or Embed Articulate Content into WordPress Plugin up to 4.3000000023 on WordPress. Affected is an unknown function. This manipulation causes basic cross site scripting. The identification of this vulnerability is CVE-2024-0756. It is possible to initiate the attack remotely. There is no exploit available.
vuldb.com

Ariomex, Iran-based crypto exchange, suffers data leak

Security Affairs
1 month 1 week ago
Resecurity says Iran’s Ariomex crypto exchange suffered a data leak exposing user and transaction data from 2022 to 2025. Resecurity (USA) reports that Ariomex’s database, one of Iran’s cryptocurrency exchange platforms, suffered a data leak. The report published by the cybersecurity company presents the findings of a structured analysis of the leaked database, which contains […]
Pierluigi Paganini

Managed ad