Explore real-world cybersecurity vulnerabilities and stay informed about emerging threats.
Data provided by CISA.
Vendor: Ivanti
Product: Connect Secure
Vulnerability: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
Date Added: 2026-10-30
Description: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
Vendor: Ivanti
Product: Connect Secure
Vulnerability: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Date Added: 2026-10-30
Description: Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
Vendor: GitLab
Product: Community Edition and Enterprise Edition
Vulnerability: GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
Date Added: 2026-10-29
Description: GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
Vendor: Cisco
Product: Secure Firewall ASA Software and Cisco Secure FTD Software
Vulnerability: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
Date Added: 2026-10-29
Description: Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
Vendor: Broadcom
Product: VMware ESX
Vulnerability: Broadcom VMWare ESX Insufficient Logging Vulnerability
Date Added: 2026-10-28
Description: Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
Vendor: Linux
Product: Kernel
Vulnerability: Linux Kernel Missing Initialization of a Variable Vulnerability
Date Added: 2026-10-28
Description: Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
Vendor: Adobe
Product: Commerce and Magento
Vulnerability: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
Date Added: 2026-10-27
Description: Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
Vendor: Google
Product: Brotli
Vulnerability: Google Brotli Unchecked Return Value Vulnerability
Date Added: 2026-10-27
Description: Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Vendor: PHP Group
Product: PHP
Vulnerability: PHP Memory Corruption Vulnerability
Date Added: 2026-10-26
Description: PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
Vendor: PHP Group
Product: PHP
Vulnerability: PHP Stale Internal Request-State Vulnerability
Date Added: 2026-10-26
Description: PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.