https://security-recipes.ai/cve-database/Recent content in CVE Database on security-recipes.aien-ushttps://security-recipes.ai/cve/CVE-2026-9198/https://security-recipes.ai/cve/CVE-2026-9198/Fri, 21 Aug 2026 00:00:00 GMTRemediate CVE-2026-9198 Langflow auto-login RCE. GHAD vulnerabilities empty. NVD CPE excludes 1.10.1. Do not invent 1.10.2.https://security-recipes.ai/cve/CVE-2026-9082/https://security-recipes.ai/cve/CVE-2026-9082/Fri, 21 Aug 2026 00:00:00 GMTRemediate CVE-2026-9082 Drupal core PostgreSQL SQLi. GHAD first_patched 10.4.10 / 10.5.10 / 10.6.9 / 11.1.10 / 11.2.12 / 11.3.10 matches NVD.https://security-recipes.ai/cve/CVE-2026-72898/https://security-recipes.ai/cve/CVE-2026-72898/Fri, 21 Aug 2026 00:00:00 GMTRemediate CVE-2026-72898 Metabase reset-password SQLi. Live GHAD 404. NVD excludes 0.58.24 / 0.59.21 / 0.60.17 / 0.61.11 / 0.62.9 / 0.63.5.https://security-recipes.ai/cve/CVE-2026-64849/https://security-recipes.ai/cve/CVE-2026-64849/Fri, 21 Aug 2026 00:00:00 GMTCVE-2026-64849 is a critical unauthenticated MLflow webhook SSRF. Upgrade to 3.15.0+, keep the tracking server off public networks, review logs, and rotate cloud credentials if the webhook test route was reachable.https://security-recipes.ai/cve/CVE-2026-63077/https://security-recipes.ai/cve/CVE-2026-63077/Fri, 21 Aug 2026 00:00:00 GMTCVE-2026-63077 is a critical unauthenticated TeamCity On-Premises RCE via the agent polling protocol. Upgrade to 2025.11.7 or 2026.1.3, or install the vendor security patch plugin, then review builds and rotate credentials.https://security-recipes.ai/cve/CVE-2026-55255/https://security-recipes.ai/cve/CVE-2026-55255/Fri, 21 Aug 2026 00:00:00 GMTCVE-2026-55255 is Langflow IDOR. GHAD first_patched is 1.9.1. NVD excludes 1.9.1. Treat later Langflow KEVs as a higher fleet floor.https://security-recipes.ai/cve/CVE-2026-48172/https://security-recipes.ai/cve/CVE-2026-48172/Fri, 21 Aug 2026 00:00:00 GMTActively exploited LiteSpeed cPanel plugin root escalation. Upgrade user-end versions 2.3-2.4.4 to 2.4.7 / WHM 5.3.1.0 or later and review redisAble logs.https://security-recipes.ai/cve/CVE-2026-48027/https://security-recipes.ai/cve/CVE-2026-48027/Fri, 21 Aug 2026 00:00:00 GMTRemediate CVE-2026-48027 Nx Console 18.95.0 compromise. Live GHAD 404. NVD exact-affects 18.95.0. Repo first_patched 18.100.0 is not an NVD exclude.https://security-recipes.ai/cve/CVE-2026-45321/https://security-recipes.ai/cve/CVE-2026-45321/Fri, 21 Aug 2026 00:00:00 GMTCVE-2026-45321 covers 84 malicious TanStack npm versions. Remove exact versions, rebuild cleanly, purge caches, rotate credentials, and harden CI.https://security-recipes.ai/cve/CVE-2026-39987/https://security-recipes.ai/cve/CVE-2026-39987/Fri, 21 Aug 2026 00:00:00 GMTRemediate CVE-2026-39987 Marimo pre-auth terminal RCE. GHAD first_patched 0.23.0. NVD excludes 0.23.0. Vendor last-affects 0.20.4.https://security-recipes.ai/cve/CVE-2026-35616/https://security-recipes.ai/cve/CVE-2026-35616/Fri, 21 Aug 2026 00:00:00 GMTCVE-2026-35616 is a CISA KEV improper-access issue in FortiClient EMS 7.4.5–7.4.6. Upgrade to 7.4.7+ or apply the Fortinet hotfix; 7.2 is not affected.https://security-recipes.ai/cve/CVE-2026-33116/https://security-recipes.ai/cve/CVE-2026-33116/Fri, 21 Aug 2026 00:00:00 GMTCVE-2026-33116 affects System.Security.Cryptography.Xml with denial-of-service flaws. Upgrade each deployed .NET 8, 9, or 10 release train to a patched build.https://security-recipes.ai/cve/CVE-2026-21643/https://security-recipes.ai/cve/CVE-2026-21643/Fri, 21 Aug 2026 00:00:00 GMTRemediate CVE-2026-21643 FortiClient EMS SQLi. GHAD vulnerabilities empty. NVD exact-affects 7.4.4. Vendor names 7.4.5.https://security-recipes.ai/cve/CVE-2026-14956/https://security-recipes.ai/cve/CVE-2026-14956/Fri, 21 Aug 2026 00:00:00 GMTCritical, unauthenticated Bricksforge privilege escalation (CVSS 9.8). Check public User Registration forms. Upgrade WordPress sites to Bricksforge 3.1.8.7 or later.https://security-recipes.ai/cve/CVE-2025-62593/https://security-recipes.ai/cve/CVE-2025-62593/Fri, 21 Aug 2026 00:00:00 GMTCVE-2025-62593 is a critical Ray dashboard jobs RCE reachable from Firefox and Safari. Upgrade to 2.52.0+, enable token auth, and keep port 8265 off untrusted networks.https://security-recipes.ai/cve/CVE-2025-60455/https://security-recipes.ai/cve/CVE-2025-60455/Fri, 21 Aug 2026 00:00:00 GMTUpgrade Modular Max Serve to 25.6.0 or later to fix unsafe deserialization; disable the experimental kvcache agent until all deployments are patched.https://security-recipes.ai/cve/CVE-2025-48384/https://security-recipes.ai/cve/CVE-2025-48384/Fri, 21 Aug 2026 00:00:00 GMTCVE-2025-48384 leftover. Live GHAD 404. NVD CPE excludes 2.43.7 / 2.44.4 / 2.45.4 / 2.46.4 / 2.47.3 / 2.48.2 / 2.49.1 / 2.50.1.https://security-recipes.ai/cve/CVE-2025-3248/https://security-recipes.ai/cve/CVE-2025-3248/Fri, 21 Aug 2026 00:00:00 GMTCVE-2025-3248 leftover. GHAD first_patched langflow 1.3.0 and langflow-base 0.3.0. NVD CPE excludes 1.3.0. Do not flatten 1.3.0 onto langflow-base.https://security-recipes.ai/cve/CVE-2025-2747/https://security-recipes.ai/cve/CVE-2025-2747/Fri, 21 Aug 2026 00:00:00 GMTCVE-2025-2747 is CISA KEV Kentico leftover. NVD CPE last-affects including 13.0.178. Vendor names 13.0.178. 13.0.178 is not an NVD exclude.https://security-recipes.ai/cve/CVE-2025-25257/https://security-recipes.ai/cve/CVE-2025-25257/Fri, 21 Aug 2026 00:00:00 GMTCritical FortiWeb SQL injection exploited in the wild. Identify affected 7.0-7.6 appliances, upgrade to a Fortinet-fixed release, and verify without probing.https://security-recipes.ai/cve/CVE-2025-1976/https://security-recipes.ai/cve/CVE-2025-1976/Fri, 21 Aug 2026 00:00:00 GMTCVE-2025-1976 is CISA KEV Brocade Fabric OS code injection in 9.1.0–9.1.1d6. Upgrade to 9.1.1d7 or later; 9.2.0 and later are not affected.https://security-recipes.ai/cve/CVE-2025-11953/https://security-recipes.ai/cve/CVE-2025-11953/Fri, 21 Aug 2026 00:00:00 GMTCVE-2025-11953 (Metro4Shell) is a critical React Native CLI command injection. Upgrade to 18.0.1, 19.1.2, or 20.0.0 and restrict Metro exposure.https://security-recipes.ai/cve/CVE-2024-9465/https://security-recipes.ai/cve/CVE-2024-9465/Fri, 21 Aug 2026 00:00:00 GMTCVE-2024-9465 is CISA KEV Palo Alto Expedition SQL injection. Upgrade Expedition to 1.2.96+; PAN-OS, Panorama, Prisma Access, and Cloud NGFW are not affected.https://security-recipes.ai/cve/CVE-2024-6387/https://security-recipes.ai/cve/CVE-2024-6387/Fri, 21 Aug 2026 00:00:00 GMTRemediate CVE-2024-6387 (regreSSHion), an OpenSSH sshd signal-handler race enabling unauthenticated root RCE. NVD last-affects including 9.8. Vendor names 9.8p1.https://security-recipes.ai/cve/CVE-2024-40711/https://security-recipes.ai/cve/CVE-2024-40711/Fri, 21 Aug 2026 00:00:00 GMTCVE-2024-40711 is CISA KEV Veeam Backup & Replication deserialization. Upgrade to 12.2 build 12.2.0.334 or later; leftover draft text is not a floor.https://security-recipes.ai/cve/CVE-2024-3400/https://security-recipes.ai/cve/CVE-2024-3400/Fri, 21 Aug 2026 00:00:00 GMTCVE-2024-3400 leftover. NVD exact last-affects 10.2.9 / 11.0.4 / 11.1.2-h1. Vendor names 10.2.9-h1 / 11.0.4-h1 / 11.1.2-h3.https://security-recipes.ai/cve/CVE-2024-3094/https://security-recipes.ai/cve/CVE-2024-3094/Fri, 21 Aug 2026 00:00:00 GMTMaintainer-implanted backdoor in liblzma reachable through sshd. Roll back to 5.4.x; treat any network-exposed affected host as compromised.https://security-recipes.ai/cve/CVE-2024-1709/https://security-recipes.ai/cve/CVE-2024-1709/Fri, 21 Aug 2026 00:00:00 GMTCritical, exploited ScreenConnect authentication bypass. Upgrade self-hosted servers from 23.9.7 or earlier to 23.9.8+ and review administrative access.https://security-recipes.ai/cve/CVE-2023-34362/https://security-recipes.ai/cve/CVE-2023-34362/Fri, 21 Aug 2026 00:00:00 GMTKnown-exploited MOVEit Transfer leftover. NVD CPE excludes 2023.0.2. Vendor names 2023.0.1. Prefer a current Progress-supported release.https://security-recipes.ai/cve/CVE-2023-1671/https://security-recipes.ai/cve/CVE-2023-1671/Fri, 21 Aug 2026 00:00:00 GMTRemediate CVE-2023-1671 Sophos Web Appliance command injection. GHAD vulnerabilities empty. NVD CPE excludes 4.3.10.4.https://security-recipes.ai/cve/CVE-2022-26134/https://security-recipes.ai/cve/CVE-2022-26134/Fri, 21 Aug 2026 00:00:00 GMTCVE-2022-26134 is CISA KEV Confluence leftover. NVD exact last-affects 7.18.0. Vendor names 7.18.1. 7.18.1 is not an NVD CPE floor.https://security-recipes.ai/cve/CVE-2021-44228/https://security-recipes.ai/cve/CVE-2021-44228/Fri, 21 Aug 2026 00:00:00 GMTCVE-2021-44228 Log4Shell RCE: upgrade log4j-core to 2.17.1+ (2.12.4 on Java 7 or 2.3.2 on Java 6); use legacy mitigations only until patched.https://security-recipes.ai/recipes/cve/cve-2017-18342-pyyaml/https://security-recipes.ai/recipes/cve/cve-2017-18342-pyyaml/Fri, 21 Aug 2026 00:00:00 GMT`yaml.load` resolved arbitrary Python tags by default. Replace with `safe_load` and pin PyYAML ≥ 6.0 where the unsafe default was finally removed.https://security-recipes.ai/cve/CVE-2025-55182/https://security-recipes.ai/cve/CVE-2025-55182/Tue, 04 Aug 2026 00:00:00 GMTCVE-2025-55182 is a CRITICAL vulnerability: Meta React Server Components Remote Code Execution Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2025-10035/https://security-recipes.ai/cve/CVE-2025-10035/Tue, 04 Aug 2026 00:00:00 GMTCVE-2025-10035 is a CRITICAL vulnerability: Fortra GoAnywhere MFT Deserialization of Untrusted Data Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2024-41713/https://security-recipes.ai/cve/CVE-2024-41713/Tue, 04 Aug 2026 00:00:00 GMTCVE-2024-41713 is a CRITICAL vulnerability: Mitel MiCollab Path Traversal Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2024-0012/https://security-recipes.ai/cve/CVE-2024-0012/Tue, 04 Aug 2026 00:00:00 GMTCVE-2024-0012 is a CRITICAL vulnerability: Palo Alto Networks PAN-OS Management Interface Authentication Bypass Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2019-11581/https://security-recipes.ai/cve/CVE-2019-11581/Sun, 02 Aug 2026 00:00:00 GMTCVE-2019-11581 is a CRITICAL vulnerability: Atlassian Jira Server and Data Center Server-Side Template Injection Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2020-25223/https://security-recipes.ai/cve/CVE-2020-25223/Sat, 01 Aug 2026 00:00:00 GMTCVE-2020-25223 is a CRITICAL vulnerability: Sophos SG UTM Remote Code Execution Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2022-47966/https://security-recipes.ai/cve/CVE-2022-47966/Fri, 31 Jul 2026 00:00:00 GMTCVE-2022-47966 is a CRITICAL vulnerability: Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2017-15944/https://security-recipes.ai/cve/CVE-2017-15944/Thu, 30 Jul 2026 00:00:00 GMTCVE-2017-15944 is a CRITICAL vulnerability: Palo Alto Networks PAN-OS Remote Code Execution Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2020-2021/https://security-recipes.ai/cve/CVE-2020-2021/Wed, 29 Jul 2026 00:00:00 GMTCVE-2020-2021 is a CRITICAL vulnerability: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2025-0108/https://security-recipes.ai/cve/CVE-2025-0108/Sat, 25 Jul 2026 00:00:00 GMTCVE-2025-0108 is a CRITICAL vulnerability: Palo Alto Networks PAN-OS Authentication Bypass Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2026-20182/https://security-recipes.ai/cve/CVE-2026-20182/Thu, 23 Jul 2026 00:00:00 GMTCVE-2026-20182 is an exploited Cisco Catalyst SD-WAN authentication bypass. Upgrade each component to the fixed release for its branch; no workaround exists.https://security-recipes.ai/cve/CVE-2026-20045/https://security-recipes.ai/cve/CVE-2026-20045/Thu, 23 Jul 2026 00:00:00 GMTCVE-2026-20045 is a pre-auth RCE in Cisco Unified Communications products. Upgrade 14.x to 14SU5 and 15.x to 15SU4; migrate 12.5 because no workaround exists.https://security-recipes.ai/cve/CVE-2026-1731/https://security-recipes.ai/cve/CVE-2026-1731/Thu, 23 Jul 2026 00:00:00 GMTCVE-2026-1731 is an exploited pre-auth RCE in BeyondTrust RS and PRA. Upgrade RS to 25.3.2+ and PRA to 25.1.1+, or apply the BT26-02 appliance patch.https://security-recipes.ai/cve/CVE-2025-64446/https://security-recipes.ai/cve/CVE-2025-64446/Thu, 23 Jul 2026 00:00:00 GMTCVE-2025-64446 is known-exploited FortiWeb path traversal enabling admin commands. Upgrade every affected software branch: 8.0.2, 7.6.5, 7.4.10, 7.2.12, or 7.0.12.https://security-recipes.ai/cve/CVE-2025-20337/https://security-recipes.ai/cve/CVE-2025-20337/Thu, 23 Jul 2026 00:00:00 GMTCVE-2025-20337 Cisco ISE/ISE-PIC API root RCE (CSCwp02814). CSCwo99449 hot patches do not fix it; upgrade to 3.3 Patch 7 or 3.4 Patch 2.https://security-recipes.ai/cve/CVE-2025-20281/https://security-recipes.ai/cve/CVE-2025-20281/Thu, 23 Jul 2026 00:00:00 GMTCVE-2025-20281 Cisco ISE/ISE-PIC API root RCE (CSCwo99449). Upgrade 3.3 to Patch 7 and 3.4 to Patch 2; attempted exploitation is reported.https://security-recipes.ai/cve/CVE-2024-47575/https://security-recipes.ai/cve/CVE-2024-47575/Thu, 23 Jul 2026 00:00:00 GMTCVE-2024-47575 is the exploited FortiManager authentication bypass. Upgrade to 6.2.13, 6.4.15, 7.0.13, 7.2.8, 7.4.5, or 7.6.1.https://security-recipes.ai/cve/CVE-2024-37079/https://security-recipes.ai/cve/CVE-2024-37079/Thu, 23 Jul 2026 00:00:00 GMTCVE-2024-37079 is a critical vCenter Server out-of-bounds-write RCE. Upgrade to 8.0 U2d, 8.0 U1e, or 7.0 U3r; Broadcom lists no workaround.https://security-recipes.ai/cve/CVE-2024-23897/https://security-recipes.ai/cve/CVE-2024-23897/Thu, 23 Jul 2026 00:00:00 GMTCVE-2024-23897 allows arbitrary Jenkins controller files to be read via CLI. Upgrade every affected software branch to 2.442, LTS 2.426.3, or LTS 2.440.1.https://security-recipes.ai/cve/CVE-2021-42013/https://security-recipes.ai/cve/CVE-2021-42013/Thu, 23 Jul 2026 00:00:00 GMTCVE-2021-42013 is the Apache HTTP Server 2.4.50 incomplete-fix bypass for CVE-2021-41773. Upgrade 2.4.49/2.4.50 to 2.4.51+ to stop traversal and CGI RCE.https://security-recipes.ai/cve/CVE-2021-41773/https://security-recipes.ai/cve/CVE-2021-41773/Thu, 23 Jul 2026 00:00:00 GMTCVE-2021-41773 Apache HTTP Server 2.4.49 path traversal can expose files and enable CGI RCE. Upgrade to 2.4.51+; the 2.4.50 fix is incomplete.https://security-recipes.ai/cve/CVE-2021-35395/https://security-recipes.ai/cve/CVE-2021-35395/Thu, 23 Jul 2026 00:00:00 GMTCVE-2021-35395 affects Realtek AP-Router SDK boa web servers. Apply Realtek's listed boa patch for SDK 3.2.3, 3.4.11, 3.4T-CT, or rtl819x-eCos 1.5.3.https://security-recipes.ai/cve/CVE-2026-39808/https://security-recipes.ai/cve/CVE-2026-39808/Fri, 17 Jul 2026 00:00:00 GMTCVE-2026-39808 is a CRITICAL vulnerability: Fortinet FortiSandbox OS Command Injection Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2025-34028/https://security-recipes.ai/cve/CVE-2025-34028/Fri, 17 Jul 2026 00:00:00 GMTCVE-2025-34028 is a CRITICAL vulnerability: Commvault Command Center Path Traversal Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.