C/CONATION SECURITY
РусскийCMS

UNIFIED INTELLIGENCE CORPUS

One event. Every artifact.

Vulnerabilities, patches, attacks, breaches, research and reprints linked into a single dossier with provenance intact.

30events
Reset
vendor
RUVerified4 artifacts

Google Brotli Unchecked Return Value Vulnerability

Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.

advisory:ROSA-SA-2026-3331advisory:ROSA-SA-2026-3332cve:CVE-2026-111497ghsa:GHSA-9v8h-qqgm-4m35
Coverage: 4ru-rosa-advisories-json · global-cisa-kev · ru-yandex-cloud-bulletins-markdown
vulnerability
GLOBALVerified2 artifacts

Cisco BroadWorks Improper Restriction of XML External Entity Reference Vulnerability

Cisco BroadWorks contains an improper restriction of XML external entity reference vulnerability that could allow an unauthenticated, remote attacker to read sensitive configuration information on an affected system.

cve:CVE-2026-111560cve:CVE-2026-111793cve:CVE-2026-116606cve:CVE-2026-124194cve:CVE-2026-125350
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified1 artifacts

Barracuda Networks Multiple Products OS Command Injection Vulnerability

Barracuda Networks Email Security Gateway (ESG), Load Balancer, Application Delivery Controller (ADC), Message Archiver (BMA), WAF Control Center (WCC), Web Application Firewall (WAF), and Web Security Gateway (WSG) contain an OS command injection vulnerability. This vulnerability could allow an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed. This vulnerability can be chained with CVE-2026-116606

cve:CVE-2026-111560cve:CVE-2026-116606
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified1 artifacts

Barracuda Networks Email Security Gateway (ESG) Authentication Bypass Using an Alternate Path or Channel Vulnerability

Barracuda Networks Email Security Gateway (ESG) contains an authentication bypass using an alternate path or channel that could allow an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration. This vulnerability can be chained with CVE-2026-111560.

cve:CVE-2026-111560cve:CVE-2026-116606
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified1 artifacts

Google Chromium Use-After-Free Vulnerability

Google Chromium contains a use-after-free vulnerability in the XML component that could allow a remote attacker to execute arbitrary code inside the sandbox via a specially crafted webpage. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

cve:CVE-2026-125350
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified2 artifacts

GPUStack Improper Authentication Vulnerability

GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.

cve:CVE-2026-102895cve:CVE-2026-116779cve:CVE-2026-123158cve:CVE-2026-123218
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified1 artifacts

SignalWire FreeSwitch Code Injection Vulnerability

SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.

cve:CVE-2026-116779
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified1 artifacts

IBM Aspera Faspex Incorrect Authorization Vulnerability

IBM Aspera Faspex contains an incorrect authorization vulnerability that could allow an authenticated user to craft a specific message to bypass authorization, causing privilege escalations.

cve:CVE-2026-123218
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified2 artifacts

SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

cve:CVE-2026-19868
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified2 artifacts

Apple Multiple Products Improper Authentication Vulnerability

Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.

cve:CVE-2024-27834
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified2 artifacts

WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability

WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.

cve:CVE-2026-119977
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified4 artifacts

Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

cve:CVE-2026-104935cve:CVE-2026-111357cve:CVE-2026-118527
Coverage: 4global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified2 artifacts

GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability

GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.

cve:CVE-2026-76418cve:CVE-2026-97229
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified1 artifacts

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability

Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

cve:CVE-2026-76418
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified2 artifacts

Broadcom VMWare ESX Insufficient Logging Vulnerability

Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.

cve:CVE-2026-41709cve:CVE-2026-46300
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified4 artifacts

Linux Kernel Missing Initialization of a Variable Vulnerability

Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.

cve:CVE-2026-109618cve:CVE-2026-109619cve:CVE-2026-46300ghsa:GHSA-6wmf-4rv5-p3rpghsa:GHSA-w8hw-w9fx-j79w
Coverage: 4global-cisa-kev · global-cisa-advisories-rss · global-krebs · ru-yandex-cloud-bulletins-markdown
vulnerability
GLOBALVerified2 artifacts

Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability

Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.

cve:CVE-2026-111497cve:CVE-2026-48356
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified1 artifacts

PHP Memory Corruption Vulnerability

PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.

cve:CVE-2026-109618
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified1 artifacts

PHP Stale Internal Request-State Vulnerability

PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.

cve:CVE-2026-109619
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified2 artifacts

Arista VeloCloud Orchestrator SQL Injection Vulnerability

Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

cve:CVE-2026-114625
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified2 artifacts

Collabora Online – Built-in CODE Server OS Command Injection Vulnerability

Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.

cve:CVE-2026-110447
Coverage: 2global-cisa-kev · global-cisa-advisories-rss
vulnerability
GLOBALVerified1 artifacts

EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability

EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.

cve:CVE-2026-106931
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified4 artifacts

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.

cve:CVE-2026-96652cve:CVE-2026-96654cve:CVE-2026-96655cve:CVE-2026-96656
Coverage: 4global-cisa-kev
vulnerability
GLOBALVerified1 artifacts

Siemens Software Center Uncontrolled Search Path Element Vulnerability

Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.

cve:CVE-2026-110936
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified1 artifacts

Fortinet Multiple Products Path Traversal Vulnerability

FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.

cve:CVE-2025-61624
Coverage: 1global-cisa-kev
vulnerability
GLOBALVerified1 artifacts

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.

cve:CVE-2026-21589
Coverage: 1global-cisa-kev