CVE ID :CVE-2026-56265 Published : June 21, 2026, 1:26 p.m. | 5 hours, 43 minutes ago Description :Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the…
CVE ID :CVE-2026-56345 Published : June 20, 2026, 6:27 p.m. | 34 minutes ago Description :AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin’s uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An…
CVE ID :CVE-2026-56340 Published : June 20, 2026, 6:27 p.m. | 34 minutes ago Description :vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an…
CVE ID :CVE-2026-56341 Published : June 20, 2026, 6:27 p.m. | 34 minutes ago Description :AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers…
CVE ID :CVE-2024-58351 Published : June 20, 2026, 3:21 p.m. | 3 hours, 39 minutes ago Description :Flowise before 2.1.4 allows configuration to be injected into the Chainflow during execution via the overrideConfig option, supported in both the frontend web integration and…
CVE ID :CVE-2022-50972 Published : June 20, 2026, 1:37 p.m. | 5 hours, 24 minutes ago Description :WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the product-type parameter. Attackers…
Security researchers at Paradigm Shift have published a working exploit, dubbed usbliter8, that achieves arbitrary code execution inside the SecureROM of Apple’s A12 and A13 chips. That code is burned into the silicon at manufacture. No software update can reach it. Affected devices…
The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suite of endpoint detection and response (EDR) killers that it hands out to affiliates for impairing system defenses before deploying the encryptor. This mature portfolio of EDR-terminating tools is…
CVE ID :CVE-2023-54357 Published : June 19, 2026, 5:52 p.m. | 1 hour, 3 minutes ago Description :Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user accounts by exploiting the getUserData function in the customer…
CVE ID :CVE-2019-25762 Published : June 19, 2026, 5:48 p.m. | 1 hour, 6 minutes ago Description :Joomla! Component JoomProject 1.1.3.2 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive user data by exploiting the projects endpoint. Attackers can…