DEV Community: Freedom Coder

CVE-2026-72529: TrueConf Server Missing Authentication for Critical Function Vulnerability

Freedom Coder — Thu, 20 Aug 2026 19:06:05 +0000

CVE ID

CVE-2026-72529

Vulnerability Name

TrueConf Server Missing Authentication for Critical Function Vulnerability

Project: TrueConf
Product: Server

Date

Date Added: 2026-08-20
Due Date: 2026-08-23

Description

TrueConf Server contains a missing authentication for critical function vulnerability which could allow a remote unauthorized attacker with network access via port 4307/TCP to execute an arbitrary script.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CVE-2026-72530: TrueConf Server Code Injection Vulnerability

Freedom Coder — Thu, 20 Aug 2026 19:01:04 +0000

CVE ID

CVE-2026-72530

Vulnerability Name

TrueConf Server Code Injection Vulnerability

Project: TrueConf
Product: Server

Date

Date Added: 2026-08-20
Due Date: 2026-09-03

Description

TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://trueconf.com/blog/news/security-fixes-updates-and-advisories ; https://ics-cert.kaspersky.com/advisories/2026/08/11/trueconf-server-breakout-from-isolated-environment/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72530

Related Security News

CISA orders feds to patch actively exploited TrueConf Server flaws

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-64849: MLflow Server-Side Request Forgery Vulnerability

Freedom Coder — Wed, 19 Aug 2026 22:01:04 +0000

CVE ID

CVE-2026-64849

Vulnerability Name

MLflow Server-Side Request Forgery Vulnerability

Project: MLflow
Product: MLflow

Date

Date Added: 2026-08-19
Due Date: 2026-09-02

Description

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive response_status and response_body.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://github.com/mlflow/mlflow/pull/24258 ; https://github.com/mlflow/mlflow/issues/24179 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-64849

Related Security News

CISA warns of hackers exploiting critical MLflow vulnerability

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2021-33045: Dahua IP Camera Authentication Bypass Vulnerability

Freedom Coder — Wed, 19 Aug 2026 17:37:56 +0000

CVE ID

CVE-2021-33045

Vulnerability Name

Dahua IP Camera Authentication Bypass Vulnerability

Project: Dahua
Product: IP Camera Firmware

Date

Date Added: 2024-08-21
Due Date: 2024-09-11

Description

Dahua IP cameras and related products contain an authentication bypass vulnerability when the loopback device is specified by the client during authentication.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://www.dahuasecurity.com/aboutUs/trustedCenter/details/582; https://nvd.nist.gov/vuln/detail/CVE-2021-33045

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2021-27101: Accellion FTA SQL Injection Vulnerability

Freedom Coder — Wed, 19 Aug 2026 17:32:19 +0000

CVE ID

CVE-2021-27101

Vulnerability Name

Accellion FTA SQL Injection Vulnerability

Project: Accellion
Product: FTA

Date

Date Added: 2021-11-03
Due Date: 2021-11-17

Description

Accellion FTA contains a SQL injection vulnerability exploited via a crafted host header in a request to document_root.html.

Known To Be Used in Ransomware Campaigns?

Known

Action

Apply updates per vendor instructions.

Additional Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-27101

Related Security News

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-65400: Apple macOS Improper Authentication Vulnerability

Freedom Coder — Tue, 18 Aug 2026 19:08:37 +0000

CVE ID

CVE-2026-65400

Vulnerability Name

Apple macOS Improper Authentication Vulnerability

Project: Apple
Product: macOS

Date

Date Added: 2026-08-18
Due Date: 2026-08-21

Description

Apple macOS contains an improper authentication vulnerability that could allow an attacker on the network to authenticate to Screen Sharing without valid credentials.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://support.apple.com/en-us/148170; https://support.apple.com/en-us/148171; https://support.apple.com/en-us/148172 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-65400

Related Security News

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-55040: Microsoft SharePoint Weak Authentication Vulnerability

Freedom Coder — Tue, 18 Aug 2026 19:06:06 +0000

CVE ID

CVE-2026-55040

Vulnerability Name

Microsoft SharePoint Weak Authentication Vulnerability

Project: Microsoft
Product: SharePoint

Date

Date Added: 2026-08-18
Due Date: 2026-08-21

Description

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-55040

Related Security News

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-59310: Broadcom VMware vCenter Path Traversal Vulnerability

Freedom Coder — Tue, 18 Aug 2026 19:03:35 +0000

CVE ID

CVE-2026-59310

Vulnerability Name

Broadcom VMware vCenter Path Traversal Vulnerability

Project: Broadcom
Product: VMware vCenter

Date

Date Added: 2026-08-18
Due Date: 2026-08-21

Description

Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/38017 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-59310

Related Security News

Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2025-62593: Ray-Project Ray Code Injection Vulnerability

Freedom Coder — Mon, 17 Aug 2026 19:01:03 +0000

CVE ID

CVE-2025-62593

Vulnerability Name

Ray-Project Ray Code Injection Vulnerability

Project: Ray-Project
Product: Ray

Date

Date Added: 2026-08-17
Due Date: 2026-08-20

Description

Ray-Project Ray contains a code injection vulnerability that could allow remote code execution. Developers using Ray as a development tool may be exposed to this vulnerability exploitable through Firefox and Safari.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://github.com/ray-project/ray/security/advisories/GHSA-q279-jhrf-cc6v ; https://github.com/ray-project/ray/commit/70e7c72780bdec075dba6cad1afe0832772bfe09 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2025-62593

Related Security News

CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2026-72898: Metabase SQL Injection Vulnerability

Freedom Coder — Fri, 14 Aug 2026 19:07:46 +0000

CVE ID

CVE-2026-72898

Vulnerability Name

Metabase SQL Injection Vulnerability

Project: Metabase
Product: Metabase

Date

Date Added: 2026-08-11
Due Date: 2026-08-14

Description

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Additional Notes

https://www.metabase.com/blog/security-update ; https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-72898

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2025-24472: Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Freedom Coder — Tue, 11 Aug 2026 18:30:05 +0000

CVE ID

CVE-2025-24472

Vulnerability Name

Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability

Project: Fortinet
Product: FortiOS and FortiProxy

Date

Date Added: 2025-03-18
Due Date: 2025-04-08

Description

Fortinet FortiOS and FortiProxy contain an authentication bypass vulnerability that allows a remote attacker to gain super-admin privileges via crafted CSF proxy requests.

Known To Be Used in Ransomware Campaigns?

Known

Action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Additional Notes

https://fortiguard.fortinet.com/psirt/FG-IR-24-535 ; https://nvd.nist.gov/vuln/detail/CVE-2025-24472

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List

CVE-2023-43208: NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability

Freedom Coder — Mon, 10 Aug 2026 19:35:39 +0000

CVE ID

CVE-2023-43208

Vulnerability Name

NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability

Project: NextGen Healthcare
Product: Mirth Connect

Date

Date Added: 2024-05-20
Due Date: 2024-06-10

Description

NextGen Healthcare Mirth Connect contains a deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution via a specially crafted request.

Known To Be Used in Ransomware Campaigns?

Known

Action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Additional Notes

This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://github.com/nextgenhealthcare/connect/wiki/4.4.1---What%27s-New ; https://nvd.nist.gov/vuln/detail/CVE-2023-43208

Related Security News

More CVEs Info

Common Vulnerabilities & Exposures (CVE) List