Security Operations
Threat Intelligence
🔎
❓

Threat Feed

Normalized, deduplicated intelligence. When several agencies report the same CVE, they are merged into one object showing all reporting sources.
DEMO MODE
HIGH
CVE-2026-118692 - CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers
NEAR-REAL-TIME
CVE-2026-118692 · NIST NVD - National Vulnerability Database · published 2026-10-28T22:17
Source ↗
LOW
CVE-2026-118691 - xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint th
NEAR-REAL-TIME
CVE-2026-118691 · NIST NVD - National Vulnerability Database · published 2026-10-28T22:17
Source ↗
CRITICAL
CVE-2026-118690 - Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attacke
NEAR-REAL-TIME
CVE-2026-118690 · NIST NVD - National Vulnerability Database · published 2026-10-28T22:17
Source ↗
HIGH
CVE-2026-118689 - OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthe
NEAR-REAL-TIME
CVE-2026-118689 · NIST NVD - National Vulnerability Database · published 2026-10-28T22:17
Source ↗
HIGH
CVE-2026-118682 - KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing att
NEAR-REAL-TIME
CVE-2026-118682 · NIST NVD - National Vulnerability Database · published 2026-10-28T22:17
Source ↗
MEDIUM
CVE-2026-118538 - A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTr
NEAR-REAL-TIME
CVE-2026-118538 · NIST NVD - National Vulnerability Database · published 2026-10-28T22:17
Source ↗
MEDIUM
CVE-2026-118537 - A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catal
NEAR-REAL-TIME
CVE-2026-118537 · NIST NVD - National Vulnerability Database · published 2026-10-28T22:17
Source ↗
MEDIUM
CVE-2026-116641 - The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. Howe
NEAR-REAL-TIME
CVE-2026-116641 · NIST NVD - National Vulnerability Database · published 2026-10-28T22:17
Source ↗
CRITICAL
GHSA-6jp4-8v48-cc5v - Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
NEAR-REAL-TIME
CVE-2026-117601 · GitHub Security Advisories · published 2026-10-28T21:23 · correlated from 2 sources
electrum
Source ↗
MEDIUM
GHSA-2hw4-c9m4-f2fj - knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-28T21:20
knative
Source ↗
MEDIUM
GHSA-jf75-q64q-g65r - Waline login accepts a non-string email as a match-all MongoDB query
NEAR-REAL-TIME
GitHub Security Advisories · published 2026-10-28T21:17
@waline
Source ↗
MEDIUM
GHSA-5324-3w58-qpp2 - Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
NEAR-REAL-TIME
CVE-2026-116575 · GitHub Security Advisories · published 2026-10-28T21:17 · correlated from 2 sources
mem0ai
Source ↗
HIGH
CVE-2026-118659 - Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.2, the Hap
NEAR-REAL-TIME
CVE-2026-118659 · NIST NVD - National Vulnerability Database · published 2026-10-28T21:16
Source ↗
HIGH
GHSA-vvm8-gf78-28g4 - Go JOSE: Panics in JSON parsing
NEAR-REAL-TIME
CVE-2026-116586 · GitHub Security Advisories · published 2026-10-28T21:14 · correlated from 3 sources
githubRed Hat
Source ↗
HIGH
GHSA-4w3g-jfj2-cw2q - Go JOSE: Panic during CBC-HMAC processing
NEAR-REAL-TIME
CVE-2026-116585 · GitHub Security Advisories · published 2026-10-28T21:14 · correlated from 3 sources
githubRed Hat
Source ↗
LOW
GHSA-4vjg-vx72-qq4g - systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
NEAR-REAL-TIME
CVE-2026-116673 · GitHub Security Advisories · published 2026-10-28T21:13 · correlated from 3 sources
systeminformationRed Hatlinux
Source ↗
MEDIUM
GHSA-7648-jmwf-vw7j - systeminformation has prototype pollution in `networkStats()` via the interface name
NEAR-REAL-TIME
CVE-2026-116674 · GitHub Security Advisories · published 2026-10-28T21:13 · correlated from 3 sources
systeminformationRed Hat
Source ↗
HIGH
CVE-2026-118752 - freeimage: FreeImage: Arbitrary code execution via heap-based buffer overflow in image decoder
NEAR-REAL-TIME
CVE-2026-118752 · Red Hat - CVE Feed · published 2026-10-28T21:11 · correlated from 2 sources
Red Hat
Source ↗
HIGH
CVE-2026-118694 - markdown2: markdown2: Denial of Service via unclosed inline link destinations
NEAR-REAL-TIME
CVE-2026-118694 · Red Hat - CVE Feed · published 2026-10-28T21:11 · correlated from 2 sources
Red Hat
Source ↗
LOW
GHSA-3cmx-xjww-583x - i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
NEAR-REAL-TIME
CVE-2026-118258 · GitHub Security Advisories · published 2026-10-28T21:10 · correlated from 3 sources
i18next-http-backendRed Hat
Source ↗