Total
24 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-0237 | 2 Apple, Paloaltonetworks | 2 Macos, Prisma Browser | 2026-07-14 | N/A | 7.8 HIGH |
| An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls. | |||||
| CVE-2026-0268 | 2 Linux, Paloaltonetworks | 2 Linux Kernel, Prisma Access Agent | 2026-07-13 | N/A | 4.4 MEDIUM |
| A security control bypass vulnerability in Prisma Access Agent for Linux allows a local attacker to route network traffic outside the VPN tunnel. This does not impact Prisma Access Agent on Windows, macOS, iOS, Android, or ChromeOS. | |||||
| CVE-2026-54423 | 2026-07-10 | N/A | 8.2 HIGH | ||
| In OpenStack Ironic before 37.0.1, an Ironic user with the ability to deploy nodes using the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control. | |||||
| CVE-2026-4913 | 2026-06-17 | N/A | 5.7 MEDIUM | ||
| Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled. | |||||
| CVE-2026-4270 | 1 Amazon | 1 Aws Api Mcp Server | 2026-06-17 | N/A | 5.5 MEDIUM |
| Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions >= 0.2.14 and < 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To remediate this issue, users should upgrade to version 1.3.9. | |||||
| CVE-2025-6250 | 1 Beyondtrust | 1 Privilege Management For Windows | 2026-06-17 | N/A | 6.7 MEDIUM |
| Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions. | |||||
| CVE-2025-68939 | 1 Gitea | 1 Gitea | 2026-06-17 | N/A | 8.2 HIGH |
| Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API. | |||||
| CVE-2025-58079 | 2026-06-17 | N/A | 4.3 MEDIUM | ||
| Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications. | |||||
| CVE-2025-4617 | 2026-06-17 | N/A | N/A | ||
| An insufficient policy enforcement vulnerability in Palo Alto Networks Prisma® Browser on Windows allows a locally authenticated non-admin user to bypass the screenshot control feature of the browser. Browser self-protection should be enabled to mitigate this issue. | |||||
| CVE-2025-49163 | 2026-06-17 | N/A | 6.7 MEDIUM | ||
| Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow booting an arbitrary image via a crafted /usr/bin/gunzip file. | |||||
| CVE-2025-49162 | 2026-06-17 | N/A | 6.4 MEDIUM | ||
| Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allows an attacker to control the local filename. | |||||
| CVE-2025-48828 | 1 Vbulletin | 1 Vbulletin | 2026-06-17 | N/A | 9.0 CRITICAL |
| Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template code in an alternative PHP function invocation syntax, such as the "var_dump"("test") syntax, attackers can bypass security checks and execute arbitrary PHP code, as exploited in the wild in May 2025. | |||||
| CVE-2025-48827 | 1 Vbulletin | 1 Vbulletin | 2026-06-17 | N/A | 10.0 CRITICAL |
| vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025. | |||||
| CVE-2025-46655 | 2026-06-17 | N/A | 4.9 MEDIUM | ||
| CodiMD through 2.5.4 has a CSP-based protection mechanism against XSS through uploaded SVG documents containing JavaScript, but it can be bypassed in certain cases of different-origin file storage, such as AWS S3. NOTE: it can be considered a user error if AWS is employed for hosting untrusted JavaScript content, but the selected architecture within AWS does not have components that are able to insert Content-Security-Policy headers. | |||||
| CVE-2025-46654 | 1 Hackmd | 1 Codimd | 2026-06-17 | N/A | 4.9 MEDIUM |
| CodiMD through 2.2.0 has a CSP-based protection mechanism against XSS through uploaded JavaScript content, but it can be bypassed by uploading a .html file that references an uploaded .js file. | |||||
| CVE-2025-0113 | 2026-06-17 | N/A | N/A | ||
| A problem with the network isolation mechanism of the Palo Alto Networks Cortex XDR Broker VM allows attackers unauthorized access to Docker containers from the host network used by Broker VM. This may allow access to read files sent for analysis and logs transmitted by the Cortex XDR Agent to the Cortex XDR server. | |||||
| CVE-2024-8781 | 2026-06-17 | N/A | N/A | ||
| Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allows Privilege Escalation, -Privilege Abuse. This issue affects Application Security Platform (ASP): v1.4.25.188. | |||||
| CVE-2024-8311 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 6.5 MEDIUM |
| An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template. | |||||
| CVE-2024-58136 | 1 Yiiframework | 1 Yii | 2026-06-17 | N/A | 9.0 CRITICAL |
| Yii 2 before 2.0.52 mishandles the attaching of behavior that is defined by an __class array key, a CVE-2024-4990 regression, as exploited in the wild in February through April 2025. | |||||
| CVE-2024-3927 | 1 Bdthemes | 1 Element Pack | 2026-06-17 | N/A | 5.3 MEDIUM |
| The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows) plugin for WordPress is vulnerable to Form Submission Admin Email Bypass in all versions up to, and including, 5.6.3. This is due to the plugin not properly checking for all variations of an administrators emails. This makes it possible for unauthenticated attackers to bypass the restriction using a +value when submitting the contact form. | |||||