Monthly
Privileged remote modification of critical program parameters in MB connect line mbCONNECT24 and mymbCONNECT24 allows authenticated high-privilege attackers to reach a hidden configuration method that should be inaccessible to any user, resulting in total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue was coordinated through CERT@VDE under advisory VDE-2026-068.
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.7.21, 5.8.0-5.8.23, 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.8, 7.0.0-7.0.3), allowing attackers to bypass security controls that rely on these headers such as HSTS, X-Frame-Options, or CSP policies. This header omission could enable various attacks including clickjacking, man-in-the-middle attacks, or other exploits depending on which protections are intended. No patch is currently available for this critical vulnerability.
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed URLs with invalid host/authority components. The url.Parse function fails to properly validate authority sections, enabling resource exhaustion attacks against any Go application parsing untrusted URLs. EPSS score of 0.07% (22nd percentile) suggests low probability of widespread exploitation despite the network attack vector. Vendor patch available with multiple Red Hat security advisories issued.
8180 Ip Audio Alerter Firmware versions up to 5.5 contains a vulnerability that allows attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio A (CVSS 7.5).
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.12.16. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote access to the cookies.txt file in MeTube (versions up to 2026.06.10) exposes yt-dlp session cookies via a direct HTTP request to the predictable path /download/.metube/cookies.txt. Any remote actor who can reach the MeTube instance can retrieve cookies potentially authenticating to YouTube or other streaming platforms, enabling session hijacking on those services. A public exploit has been disclosed; upgrading to version 2026.06.20 resolves the issue.
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.
Direct unauthenticated access to a SQL database backup file exposes sensitive data in SourceCodester Online Clothing Store 1.0. The file /db/shopping.sql is placed within a web-accessible directory with no access restriction, allowing any remote attacker to download the full database backup by issuing a direct HTTP request. Based on the publicly disclosed Medium write-up, the exposed backup contains administrative credentials, meaning exploitation can serve as a stepping stone to full application compromise. A proof-of-concept has been publicly disclosed; no public active exploitation (CISA KEV) has been confirmed.
Privileged remote modification of critical program parameters in MB connect line mbCONNECT24 and mymbCONNECT24 allows authenticated high-privilege attackers to reach a hidden configuration method that should be inaccessible to any user, resulting in total compromise of confidentiality, integrity, and availability. No public exploit identified at time of analysis, and the issue was coordinated through CERT@VDE under advisory VDE-2026-068.
Spring Security fails to properly write HTTP response headers in servlet applications across multiple versions (5.7.0-5.7.21, 5.8.0-5.8.23, 6.3.0-6.3.14, 6.4.0-6.4.14, 6.5.0-6.5.8, 7.0.0-7.0.3), allowing attackers to bypass security controls that rely on these headers such as HSTS, X-Frame-Options, or CSP policies. This header omission could enable various attacks including clickjacking, man-in-the-middle attacks, or other exploits depending on which protections are intended. No patch is currently available for this critical vulnerability.
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed URLs with invalid host/authority components. The url.Parse function fails to properly validate authority sections, enabling resource exhaustion attacks against any Go application parsing untrusted URLs. EPSS score of 0.07% (22nd percentile) suggests low probability of widespread exploitation despite the network attack vector. Vendor patch available with multiple Red Hat security advisories issued.
8180 Ip Audio Alerter Firmware versions up to 5.5 contains a vulnerability that allows attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio A (CVSS 7.5).
Direct Request ('Forced Browsing') vulnerability in Apache OFBiz.12.16. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated remote access to the cookies.txt file in MeTube (versions up to 2026.06.10) exposes yt-dlp session cookies via a direct HTTP request to the predictable path /download/.metube/cookies.txt. Any remote actor who can reach the MeTube instance can retrieve cookies potentially authenticating to YouTube or other streaming platforms, enabling session hijacking on those services. A public exploit has been disclosed; upgrading to version 2026.06.20 resolves the issue.
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.
Direct unauthenticated access to a SQL database backup file exposes sensitive data in SourceCodester Online Clothing Store 1.0. The file /db/shopping.sql is placed within a web-accessible directory with no access restriction, allowing any remote attacker to download the full database backup by issuing a direct HTTP request. Based on the publicly disclosed Medium write-up, the exposed backup contains administrative credentials, meaning exploitation can serve as a stepping stone to full application compromise. A proof-of-concept has been publicly disclosed; no public active exploitation (CISA KEV) has been confirmed.