Do now Restrict public access to YOOtheme Pro's image transformation handler until a vendor fix is released. No fix named yet. Last checked 24 Oct, 12:17 UTC. Advisory
KEV – Record ✓ Vendor –
New that day
-
YOOtheme Pro for Joomla Remote code execution -
Linux kernel Critical vulnerability Do now Check the advisory for a fixed version before you assume one exists. No fix named yet. Last checked 24 Oct, 06:45 UTC.KEV – Record ✓ Vendor – -
SonicWall SMA 1000 SMA1000 Appliance Work Place: server-side request forgery Do now Restrict access to the SMA1000 Work Place interface and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 12:17 UTC. AdvisoryKEV – Record ✓ Vendor – -
Flowise Critical vulnerability Fixed in flowise 3.1.3, flowise-components 3.1.3Re-plated 24 Octnpm install flowise@3.1.3npm install flowise-components@3.1.3On hold (status unknown)→ Order up (fix available) KEV – Record ✓ Vendor – -
jxrlib Heap buffer overflow Fixed in mircomir/jxrlib 1.4.4 AdvisoryRe-scored 24 Octhigh→ unknown KEV – Record – Vendor –
Updated that day
-
Fortinet FortiMail Path Traversal Do now Restrict access to FortiMail HTTP and HTTPS interfaces and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 12:17 UTC. AdvisoryKEV ✓ Record ✓ Vendor – -
ProFTPD Improper Access Control Do now Restrict access to the ProFTPD SITE CPFR and SITE CPTO commands and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 12:17 UTC. AdvisoryKEV ✓ Record ✓ Vendor – -
BeyondTrust Remote Support Authentication Bypass by Spoofing Do now Restrict network access to BeyondTrust Remote Support and watch for a vendor fix. No fix named yet. Last checked 24 Oct, 12:17 UTC. AdvisoryKEV ✓ Record ✓ Vendor – -
Collabora Online Built-in CODE Server OS Command Injection Fixed in 26.4.303 AdvisoryRe-plated 24 OctOn hold (status unknown)→ Order up (fix available) KEV ✓ Record ✓ Vendor ✓ -
Murrelektronik AAS Edge Client Critical vulnerability Do now Vendor won't fix: replace or isolate it. Murrelektronik will not provide a fix. AdvisoryRe-plated 24 OctOn hold (status unknown)→ 86'd (no fix yet) KEV – Record ✓ Vendor – -
Brotli HTTP2Shell Now hitting Python (Brotli) too (added 23 Oct)Fixed in Node.js 26.12.1, Node.js 24.22.1 +4 AdvisoryRe-plated 24 Octpip install --upgrade "Brotli>=1.2.1"86'd (no fix yet)→ Order up (fix available) KEV – Record ✓ Vendor ✓
Show the other 5
-
Oracle Java SE Trusts compromised eMudhra CA certificates The vendor: “Update to the latest Java release, which distrusts the impacted eMudhra intermediate CAs.” See the vendor's fixed-release tableRe-plated 24 OctOn hold (status unknown)→ Order up (fix available) KEV – Record ✓ Vendor ✓ -
odhcpd Remote code execution Fixed in 25.12 AdvisoryRe-plated 24 OctOn hold (status unknown)→ Order up (fix available) KEV – Record ✓ Vendor ✓ -
GeoVision GV-ASManager Critical vulnerability Fixed in 6.4.0 AdvisoryRe-plated 24 OctOn hold (status unknown)→ Order up (fix available) KEV – Record ✓ Vendor ✓ -
FortiSIEM Critical FortiSIEM Flaw Gets Public Exploit PoC Fixed in 7.5.1 AdvisoryRe-plated 24 OctOn hold (status unknown)→ Order up (fix available) KEV – Record ✓ Vendor ✓ -
eMudhra certificates EMudhra CA Keys Compromised Do now Check whether any eMudhra-issued certificates are in use and plan replacements before the authority's withdrawal takes effect. AdvisoryRe-scored 24 Octcritical→ unknown