Yazoul Security - CVE Advisories

CVE-2026-67620: Security Advisory: CVE-2026-67620

Yazoul Security (contact@yazoul.net) — Sat, 08 Aug 2026 00:00:00 GMT

CVE-2026-67620 - HIGH severity (CVSS 7.7)

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata ...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-18577: Security Advisory: CVE-2026-18577

Yazoul Security (contact@yazoul.net) — Sun, 02 Aug 2026 00:00:00 GMT

CVE-2026-18577 - HIGH severity (CVSS 8.2)

An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-18556: Security Advisory: CVE-2026-18556

Yazoul Security (contact@yazoul.net) — Sat, 01 Aug 2026 00:00:00 GMT

CVE-2026-18556 - HIGH severity (CVSS 8.2)

Authentication bypass using an alternate path or channel vulnerability in N-able N-central allows Authentication Bypass. This issue affects N-central: through 2026.1....

Affected Products: N-Able N-Central

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-20316: Security Advisory: CVE-2026-20316

Yazoul Security (contact@yazoul.net) — Wed, 29 Jul 2026 00:00:00 GMT

CVE-2026-20316 - MEDIUM severity (CVSS 5.3)

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged ac...

Affected Products: Cisco Secure Firewall Management Center

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-16812: Security Advisory: CVE-2026-16812

Yazoul Security (contact@yazoul.net) — Mon, 27 Jul 2026 00:00:00 GMT

CVE-2026-16812 - CRITICAL severity (CVSS 10)

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may ...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-55579: Security Advisory: CVE-2026-55579

Yazoul Security (contact@yazoul.net) — Mon, 27 Jul 2026 00:00:00 GMT

CVE-2026-55579 - CRITICAL severity (CVSS 9.8)

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-512 hash stored at pheditor.ph...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-63077: Security Advisory: CVE-2026-63077

Yazoul Security (contact@yazoul.net) — Mon, 27 Jul 2026 00:00:00 GMT

CVE-2026-63077 - CRITICAL severity (CVSS 9.8)

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol...

Affected Products: Jetbrains Teamcity

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-47668: Security Advisory: CVE-2026-47668

Yazoul Security (contact@yazoul.net) — Thu, 23 Jul 2026 00:00:00 GMT

CVE-2026-47668 - CRITICAL severity (CVSS 10)

DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the `functionName` parame...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-16232: Security Advisory: CVE-2026-16232

Yazoul Security (contact@yazoul.net) — Wed, 22 Jul 2026 00:00:00 GMT

CVE-2026-16232 - CRITICAL severity (CVSS 9.1)

An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-60137: Security Advisory: CVE-2026-60137

Yazoul Security (contact@yazoul.net) — Fri, 17 Jul 2026 00:00:00 GMT

CVE-2026-60137 - CRITICAL severity (CVSS 9.1)

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme pas...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-63030: Security Advisory: CVE-2026-63030

Yazoul Security (contact@yazoul.net) — Fri, 17 Jul 2026 00:00:00 GMT

CVE-2026-63030 - CRITICAL severity (CVSS 9.8)

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), coul...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-9198: Security Advisory: CVE-2026-9198

Yazoul Security (contact@yazoul.net) — Fri, 17 Jul 2026 00:00:00 GMT

CVE-2026-9198 - CRITICAL severity (CVSS 9.8)

IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exe...

Affected Products: Langflow

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2021-27137: Security Advisory: CVE-2021-27137

Yazoul Security (contact@yazoul.net) — Thu, 16 Jul 2026 00:00:00 GMT

CVE-2021-27137 - HIGH severity (CVSS 8.1)

An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handling functionality allows an unauthenticated remote attacker to send a request that would ove...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-15409: Security Advisory: CVE-2026-15409

Yazoul Security (contact@yazoul.net) — Tue, 14 Jul 2026 00:00:00 GMT

CVE-2026-15409 - CRITICAL severity (CVSS 10)

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make re...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-15410: Security Advisory: CVE-2026-15410

Yazoul Security (contact@yazoul.net) — Tue, 14 Jul 2026 00:00:00 GMT

CVE-2026-15410 - HIGH severity (CVSS 7.2)

Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could pot...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-50522: Security Advisory: CVE-2026-50522

Yazoul Security (contact@yazoul.net) — Tue, 14 Jul 2026 00:00:00 GMT

CVE-2026-50522 - CRITICAL severity (CVSS 9.8)

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....

Affected Products: Microsoft Sharepoint Server

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-56155: Security Advisory: CVE-2026-56155

Yazoul Security (contact@yazoul.net) — Tue, 14 Jul 2026 00:00:00 GMT

CVE-2026-56155 - HIGH severity (CVSS 7.8)

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally....

Affected Products: Microsoft Windows 10 1607, Microsoft Windows 10 1809, Microsoft Windows Server 2012, Microsoft Windows Server 2016, Microsoft Windows Server 2019

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-56164: Security Advisory: CVE-2026-56164

Yazoul Security (contact@yazoul.net) — Tue, 14 Jul 2026 00:00:00 GMT

CVE-2026-56164 - CRITICAL severity (CVSS 9.8)

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network....

Affected Products: Microsoft Sharepoint Server

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-58644: Security Advisory: CVE-2026-58644

Yazoul Security (contact@yazoul.net) — Tue, 14 Jul 2026 00:00:00 GMT

CVE-2026-58644 - CRITICAL severity (CVSS 9.8)

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network....

Affected Products: Microsoft Sharepoint Server

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-56291: Security Advisory: CVE-2026-56291

Yazoul Security (contact@yazoul.net) — Thu, 09 Jul 2026 00:00:00 GMT

CVE-2026-56291 - CRITICAL severity (CVSS 10)

The Joomla extension Balbooa Forms is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE....

Affected Products: Balbooa Forms

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-23697: Security Advisory: CVE-2026-23697

Yazoul Security (contact@yazoul.net) — Tue, 07 Jul 2026 00:00:00 GMT

CVE-2026-23697 - HIGH severity (CVSS 8.8)

Vtiger CRM before 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file containing arbitrary PHP code th...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-23698: Security Advisory: CVE-2026-23698

Yazoul Security (contact@yazoul.net) — Tue, 07 Jul 2026 00:00:00 GMT

CVE-2026-23698 - HIGH severity (CVSS 8.6)

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by sub...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-34038: Security Advisory: CVE-2026-34038

Yazoul Security (contact@yazoul.net) — Mon, 06 Jul 2026 00:00:00 GMT

CVE-2026-34038 - CRITICAL severity (CVSS 9.9)

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticated remote command injection vulnerability in application depl...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-48282: Security Advisory: CVE-2026-48282

Yazoul Security (contact@yazoul.net) — Tue, 30 Jun 2026 00:00:00 GMT

CVE-2026-48282 - CRITICAL severity (CVSS 10)

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execut...

Affected Products: Adobe Coldfusion

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-58138: Security Advisory: CVE-2026-58138

Yazoul Security (contact@yazoul.net) — Tue, 30 Jun 2026 00:00:00 GMT

CVE-2026-58138 - CRITICAL severity (CVSS 9.8)

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow defini...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-56290: Security Advisory: CVE-2026-56290

Yazoul Security (contact@yazoul.net) — Mon, 29 Jun 2026 00:00:00 GMT

CVE-2026-56290 - CRITICAL severity (CVSS 10)

The Joomla extension Page Builder CK is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE....

Affected Products: Joomlack Page Builder Ck

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-55255: Security Advisory: CVE-2026-55255

Yazoul Security (contact@yazoul.net) — Tue, 23 Jun 2026 00:00:00 GMT

CVE-2026-55255 - HIGH severity (CVSS 8.4)

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to 1.9.1, an Insecure Direct Object Reference (IDOR) vulnerability in /api/v1/responses endpoint allows an authenti...

Affected Products: Langflow

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-48908: Security Advisory: CVE-2026-48908

Yazoul Security (contact@yazoul.net) — Sat, 20 Jun 2026 00:00:00 GMT

CVE-2026-48908 - CRITICAL severity (CVSS 10)

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code....

Affected Products: Ollyo Sp Page Builder

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-48939: Security Advisory: CVE-2026-48939

Yazoul Security (contact@yazoul.net) — Sat, 20 Jun 2026 00:00:00 GMT

CVE-2026-48939 - CRITICAL severity (CVSS 10)

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution....

Affected Products: Joomlic Icagenda

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-12569: Security Advisory: CVE-2026-12569

Yazoul Security (contact@yazoul.net) — Thu, 18 Jun 2026 00:00:00 GMT

CVE-2026-12569 - CRITICAL severity (CVSS 9.3)

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. * ...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-20262: Security Advisory: CVE-2026-20262

Yazoul Security (contact@yazoul.net) — Mon, 15 Jun 2026 00:00:00 GMT

CVE-2026-20262 - MEDIUM severity (CVSS 6.5)

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an af...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-54420: Security Advisory: CVE-2026-54420

Yazoul Security (contact@yazoul.net) — Sun, 14 Jun 2026 00:00:00 GMT

CVE-2026-54420 - HIGH severity (CVSS 8.5)

LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running Clou...

Affected Products: Litespeedtech Litespeed Cpanel Plugin, Litespeedtech Litespeed Whm Plugin

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-48558: Security Advisory: CVE-2026-48558

Yazoul Security (contact@yazoul.net) — Fri, 12 Jun 2026 00:00:00 GMT

CVE-2026-48558 - CRITICAL severity (CVSS 10)

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. When OIDC authentication is configured, identity token...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-35273: Security Advisory: CVE-2026-35273

Yazoul Security (contact@yazoul.net) — Thu, 11 Jun 2026 00:00:00 GMT

CVE-2026-35273 - CRITICAL severity (CVSS 9.8)

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploita...

Affected Products: Oracle Peoplesoft Enterprise Peopletools

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-10520: Security Advisory: CVE-2026-10520

Yazoul Security (contact@yazoul.net) — Tue, 09 Jun 2026 00:00:00 GMT

CVE-2026-10520 - CRITICAL severity (CVSS 10)

An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-11645: Security Advisory: CVE-2026-11645

Yazoul Security (contact@yazoul.net) — Tue, 09 Jun 2026 00:00:00 GMT

CVE-2026-11645 - HIGH severity (CVSS 8.8)

Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: H...

Affected Products: Google Chrome, Apple Macos, Linux Kernel, Microsoft Windows

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-25089: Security Advisory: CVE-2026-25089

Yazoul Security (contact@yazoul.net) — Tue, 09 Jun 2026 00:00:00 GMT

CVE-2026-25089 - CRITICAL severity (CVSS 9.8)

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox ...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-50751: Security Advisory: CVE-2026-50751

Yazoul Security (contact@yazoul.net) — Mon, 08 Jun 2026 00:00:00 GMT

CVE-2026-50751 - CRITICAL severity (CVSS 9.3)

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-48907: Security Advisory: CVE-2026-48907

Yazoul Security (contact@yazoul.net) — Fri, 05 Jun 2026 00:00:00 GMT

CVE-2026-48907 - CRITICAL severity (CVSS 10)

A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution....

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-7473: Security Advisory: CVE-2026-7473

Yazoul Security (contact@yazoul.net) — Fri, 05 Jun 2026 00:00:00 GMT

CVE-2026-7473 - MEDIUM severity (CVSS 6.9)

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is p...

Affected Products: Arista Eos, Arista 7020Sr-24C2, Arista 7020Sr-32C2, Arista 7020Srg-24C2, Arista 7020Tr-48

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-20245: Security Advisory: CVE-2026-20245

Yazoul Security (contact@yazoul.net) — Thu, 04 Jun 2026 00:00:00 GMT

CVE-2026-20245 - HIGH severity (CVSS 7.8)

A vulnerability in the CLI of Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, and Cisco Catalyst SD-WAN Validator, formerly SD-WAN vBo...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-28318: Security Advisory: CVE-2026-28318

Yazoul Security (contact@yazoul.net) — Thu, 04 Jun 2026 00:00:00 GMT

CVE-2026-28318 - HIGH severity (CVSS 7.5)

SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure custom...

Affected Products: Solarwinds Serv-U

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-8037: Security Advisory: CVE-2026-8037

Yazoul Security (contact@yazoul.net) — Thu, 04 Jun 2026 00:00:00 GMT

CVE-2026-8037 - CRITICAL severity (CVSS 9.8)

OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting uns...

Affected Products: Progress Connection Manager For Objectscale, Progress Ecs Connection Manager, Progress Loadmaster

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-20230: Security Advisory: CVE-2026-20230

Yazoul Security (contact@yazoul.net) — Wed, 03 Jun 2026 00:00:00 GMT

CVE-2026-20230 - HIGH severity (CVSS 8.6)

A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote attacke...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2025-48595: Security Advisory: CVE-2025-48595

Yazoul Security (contact@yazoul.net) — Mon, 01 Jun 2026 00:00:00 GMT

CVE-2025-48595 - HIGH severity (CVSS 8.4)

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. Us...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-46817: Security Advisory: CVE-2026-46817

Yazoul Security (contact@yazoul.net) — Thu, 28 May 2026 00:00:00 GMT

CVE-2026-46817 - CRITICAL severity (CVSS 9.8)

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allow...

Affected Products: Oracle E-Business Suite

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-44590: Security Advisory: CVE-2026-44590

Yazoul Security (contact@yazoul.net) — Wed, 27 May 2026 00:00:00 GMT

CVE-2026-44590 - CRITICAL severity (CVSS 9.3)

Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pull...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-48027: Security Advisory: CVE-2026-48027

Yazoul Security (contact@yazoul.net) — Wed, 27 May 2026 00:00:00 GMT

CVE-2026-48027 - CRITICAL severity (CVSS 9.8)

Nx Console is the user interface for Nx & Lerna. On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available ...

Affected Products: Nx Console

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-45247: Security Advisory: CVE-2026-45247

Yazoul Security (contact@yazoul.net) — Tue, 26 May 2026 00:00:00 GMT

CVE-2026-45247 - CRITICAL severity (CVSS 9.8)

Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a...

Affected Products: Multiple systems

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.

CVE-2026-45659: Security Advisory: CVE-2026-45659

Yazoul Security (contact@yazoul.net) — Fri, 22 May 2026 00:00:00 GMT

CVE-2026-45659 - HIGH severity (CVSS 8.8)

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network....

Affected Products: Microsoft Sharepoint Server

Read the full security advisory on Yazoul Security

This advisory is published by Yazoul Security - Your trusted source for CVE intelligence and remediation guidance.

Generated by Yazoul AI, an automated pipeline. Not reviewed by a person before publication.