آخرین آسیب‌پذیری‌ها

Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

net: skbuff: preserve shared-frag marker during coalescing

Microsoft SharePoint Remote Code Execution Vulnerability

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected install…

LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026. Detection is best done via a command line of grep -rE "cpanel_jsonapi_func=redisAble" /…

Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

Microsoft Defender Elevation of Privilege Vulnerability

Microsoft Defender Denial of Service Vulnerability

A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434), distributed from the legitimate website daemon-tools.cc between approximately…

Microsoft Exchange Server Spoofing Vulnerability

Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability

PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities

Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys

LiteLLM: SQL injection in Proxy API key verification

LiteLLM: Authenticated command execution via MCP stdio test endpoints

An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution.

PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

WebPros cPanel and WHM Authentication Bypass via Login Flow

crypto: algif_aead - Revert to operating out-of-place

Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

Microsoft SharePoint Server Spoofing Vulnerability