News

• NVD CVE API 2.0 Fri 23 Oct

  CVE-2025-30054 · CVSS 9.3

  CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2025-30054
• NVD CVE API 2.0 Fri 23 Oct

  CVE-2025-30050 · CVSS 9.4

  CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges. This issue was fixed in version 2026.MS3

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2025-30050
• NVD CVE API 2.0 Fri 23 Oct

  CVE-2025-30047 · CVSS 9.4

  CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server. This issue was fixed in version 2026.MS3

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2025-30047
• NVD CVE API 2.0 Fri 23 Oct

  CVE-2025-30046 · CVSS 9.0

  In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2025-30046
• NVD CVE API 2.0 Fri 23 Oct

  CVE-2026-63244 · CVSS 9.8

  An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, potentially resulting in unauthorised access to user accounts and full administrative control of the LMS platform.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-63244
• NVD CVE API 2.0 Fri 23 Oct

  CVE-2026-55981 · CVSS 9.6

  A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-55981
• NVD CVE API 2.0 Fri 23 Oct

  CVE-2026-54630 · CVSS 9.6

  Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension blocklist does not include phar. AttachmentSubmitHandler::renameBlacklistedExtensions() rewrites dangerous extensions (php, phtml, sh, cgi, py, js, html, htaccess, ...) to .txt, but phar is absent from the list, so a .phar file keeps its extension. Public attachments (the default) are written into public/media/, which is the Apache docume

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-54630
• NVD CVE API 2.0 Fri 23 Oct

  CVE-2026-115547 · CVSS 9.1

  An input validation issue in the Okta Access Gateway (OAG) Admin Console allows the processing of specially formatted configuration values. An authenticated administrator can leverage this to execute system commands within the context of the OAG service account.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-115547
• NVD CVE API 2.0 Fri 23 Oct

  CVE-2026-19677 · CVSS 9.3

  An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-19677
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-110243 · CVSS 9.4

  The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.

  Fix: vendor advisory: CISA ICS Advisories Fix panel

  detailsCVE-2026-110243
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-107861 · CVSS 9.4

  The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

  Fix: vendor advisory: CISA ICS Advisories Fix panel

  detailsCVE-2026-107861
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-97785 · CVSS 10.0

  Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-97785
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-83938 · CVSS 10.0

  Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

  Fix: vendor advisory: Microsoft Security Update Guide Fix panel

  detailsCVE-2026-83938
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-111594 · CVSS 9.2

  InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-111594
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-110063 · CVSS 10.0

  Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

  Fix: vendor advisory: Microsoft Security Update Guide Fix panel

  detailsCVE-2026-110063
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-109122 · CVSS 9.4

  The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system commands as root, and the malicious configuration persists across reboots. Successful exploitation could result in full device compromise, including exposure of stored credentials and cryptographic material.

  Fix: vendor advisory: CISA ICS Advisories Fix panel

  detailsCVE-2026-109122
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-105014 · CVSS 9.1

  Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

  Fix: vendor advisory: Microsoft Security Update Guide Fix panel

  detailsCVE-2026-105014
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2024-21762 · fortinet, fortiproxy, fortios · CVSS 9.8

  Analyzed. A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortiOS 6.4.0 through 6.4.14, FortiOS 6.2.0 through 6.2.15, FortiOS 6.0 all versions, FortiProxy 7.4.0 through 7.4.2, FortiProxy 7.2.0 through 7.2.8, FortiProxy 7.0.0 through 7.0.14, FortiProxy 2.0.0 through 2.0.13, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specifically crafted reques

  Fix: 15 public exploits · CISA: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. (due 2024-02-16) · 2 patch or advisory references on NVD Fix panel

  KEV · due 2024-02-16detailsCVE-2024-21762
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79876 · CVSS 9.3

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79876
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79875 · CVSS 9.3

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79875
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79874 · CVSS 9.3

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79874
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79873 · CVSS 9.3

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79873
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79872 · CVSS 9.4

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79872
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79871 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79871
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79870 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79870
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79869 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79869
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79868 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79868
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79867 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79867
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79866 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79866
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79865 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79865
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79864 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79864
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79863 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79863
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79862 · CVSS 9.6

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79862
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79861 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79861
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79860 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79860
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79859 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79859
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79858 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79858
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79857 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79857
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79856 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79856
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79855 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79855
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79854 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79854
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79853 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79853
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79852 · CVSS 9.8

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79852
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79851 · CVSS 10.0

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79851
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79850 · CVSS 10.0

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79850
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79849 · CVSS 10.0

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79849
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79848 · CVSS 10.0

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79848
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79847 · CVSS 10.0

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79847
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79846 · CVSS 10.0

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79846
• NVD CVE API 2.0 Thu 22 Oct

  CVE-2026-79844 · CVSS 10.0

  No description provided

  Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

  detailsCVE-2026-79844

Older