Api

Ivanti Endpoint Manager Mobile (EPMM) Unauthenticated Remote API Access (CVE-2023-35078) new KEV RW EPSS 100%CVE-2023-35078networkCRITICAL 9.8Unverified2026-08-09Hoverfly Middleware Command Injection to RCE (CVE-2025-54123) new EPSS 11%CVE-2025-54123webCRITICAL 9.8Patched2026-07-06FlowiseAI Account-Takeover via Forgot-Password Token Leak (CVE-2025-58434) new EPSS 50%CVE-2025-58434webCRITICAL 9.8Patched2026-07-06YAMCS Unauthorized User Enumeration via IAM API (CVE-2026-44595) newCVE-2026-44595 / GHSA-p2rj-mrmc-9w29webMEDIUM 4.3Patched2026-07-05Vaultwarden Organization Collection Permissions Bypass & Cipher Enumeration (CVE-2026-26012) newCVE-2026-26012webMEDIUM 6.5Patched2026-07-05SmarterMail Unauthenticated Admin Password Reset (CVE-2026-0001 / WT-2026-0001) newCVE-2026-0001webCRITICAL 9Patched2026-07-05Langflow Unauthenticated Remote Code Execution via `validate/code` Endpoint (CVE-2026-0770) new KEV EPSS 63%CVE-2026-0770webCRITICALPatched2026-07-05Langflow Knowledge Base Path Traversal / Arbitrary Directory Deletion (CVE-2026-42048) newCVE-2026-42048webHIGHPatched2026-07-05Grafana Dashboard Permissions Broken Access Control — Editor-to-Admin Privilege Escalation (CVE-2026-21721) newCVE-2026-21721webHIGHPatched2026-07-05Gitea OAuth2 Scope Enforcement Bypass via HTTP Basic Auth — CVE-2026-28699 newCVE-2026-28699webHIGHPatched2026-07-05FortiAuthenticator Unauthenticated RCE Endpoint Probe (CVE-2026-44277) newCVE-2026-44277webCRITICALPatched2026-07-05Coolify Authenticated Remote Command Injection via Deployment Config (CVE-2026-34038) newCVE-2026-34038webCRITICAL 10Patched2026-07-05Apache Superset Authenticated SQL Injection via sqlExpression/where Bypass — CVE-2026-23980 newCVE-2026-23980webMEDIUM 6.5Patched2026-07-05Azure Networking Privilege Escalation via Missing Privilege Check newCVE-2025-54914cloudCRITICAL 10Patched2026-05-17