https://security-recipes.ai/cve-database/Recent content in CVE Database on security-recipes.aien-ushttps://security-recipes.ai/cve/CVE-2026-45321/https://security-recipes.ai/cve/CVE-2026-45321/Thu, 23 Jul 2026 00:00:00 GMTCVE-2026-45321 covers 84 malicious TanStack npm versions. Remove exact versions, rebuild cleanly, purge caches, rotate credentials, and harden CI.https://security-recipes.ai/cve/CVE-2026-39987/https://security-recipes.ai/cve/CVE-2026-39987/Thu, 23 Jul 2026 00:00:00 GMTCVE-2026-39987 is a critical pre-auth RCE in Marimo's terminal WebSocket. Upgrade to 0.23.0+ and restrict notebook network exposure.https://security-recipes.ai/cve/CVE-2026-33116/https://security-recipes.ai/cve/CVE-2026-33116/Thu, 23 Jul 2026 00:00:00 GMTCVE-2026-33116 affects System.Security.Cryptography.Xml with denial-of-service flaws. Upgrade each deployed .NET 8, 9, or 10 release train to a patched build.https://security-recipes.ai/cve/CVE-2026-20182/https://security-recipes.ai/cve/CVE-2026-20182/Thu, 23 Jul 2026 00:00:00 GMTCVE-2026-20182 is an exploited Cisco Catalyst SD-WAN authentication bypass. Upgrade each component to the fixed release for its branch; no workaround exists.https://security-recipes.ai/cve/CVE-2026-20045/https://security-recipes.ai/cve/CVE-2026-20045/Thu, 23 Jul 2026 00:00:00 GMTCVE-2026-20045 is a pre-auth RCE in Cisco Unified Communications products. Upgrade 14.x to 14SU5 and 15.x to 15SU4; migrate 12.5 because no workaround exists.https://security-recipes.ai/cve/CVE-2026-1731/https://security-recipes.ai/cve/CVE-2026-1731/Thu, 23 Jul 2026 00:00:00 GMTCVE-2026-1731 is an exploited pre-auth RCE in BeyondTrust RS and PRA. Upgrade RS to 25.3.2+ and PRA to 25.1.1+, or apply the BT26-02 appliance patch.https://security-recipes.ai/cve/CVE-2025-64446/https://security-recipes.ai/cve/CVE-2025-64446/Thu, 23 Jul 2026 00:00:00 GMTCVE-2025-64446 is known-exploited FortiWeb path traversal enabling admin commands. Upgrade every affected software branch: 8.0.2, 7.6.5, 7.4.10, 7.2.12, or 7.0.12.https://security-recipes.ai/cve/CVE-2025-48384/https://security-recipes.ai/cve/CVE-2025-48384/Thu, 23 Jul 2026 00:00:00 GMTCVE-2025-48384 affects recursive clones of untrusted Git repositories. Upgrade to a fixed Git release and disable untrusted recursive submodules.https://security-recipes.ai/cve/CVE-2025-3248/https://security-recipes.ai/cve/CVE-2025-3248/Thu, 23 Jul 2026 00:00:00 GMTCVE-2025-3248 is a critical unauthenticated RCE in Langflow before 1.3.0. Upgrade, restrict the endpoint, review logs, and rotate exposed secrets.https://security-recipes.ai/cve/CVE-2025-20337/https://security-recipes.ai/cve/CVE-2025-20337/Thu, 23 Jul 2026 00:00:00 GMTCVE-2025-20337 Cisco ISE/ISE-PIC API root RCE (CSCwp02814). CSCwo99449 hot patches do not fix it; upgrade to 3.3 Patch 7 or 3.4 Patch 2.https://security-recipes.ai/cve/CVE-2025-20281/https://security-recipes.ai/cve/CVE-2025-20281/Thu, 23 Jul 2026 00:00:00 GMTCVE-2025-20281 Cisco ISE/ISE-PIC API root RCE (CSCwo99449). Upgrade 3.3 to Patch 7 and 3.4 to Patch 2; attempted exploitation is reported.https://security-recipes.ai/cve/CVE-2025-11953/https://security-recipes.ai/cve/CVE-2025-11953/Thu, 23 Jul 2026 00:00:00 GMTCVE-2025-11953 (Metro4Shell) is a critical React Native CLI command injection. Upgrade to 18.0.1, 19.1.2, or 20.0.0 and restrict Metro exposure.https://security-recipes.ai/cve/CVE-2024-6387/https://security-recipes.ai/cve/CVE-2024-6387/Thu, 23 Jul 2026 00:00:00 GMTRemediate CVE-2024-6387 (regreSSHion), an OpenSSH sshd signal-handler race enabling unauthenticated root RCE on glibc Linux. Upgrade to 9.8p1+.https://security-recipes.ai/cve/CVE-2024-47575/https://security-recipes.ai/cve/CVE-2024-47575/Thu, 23 Jul 2026 00:00:00 GMTCVE-2024-47575 is the exploited FortiManager authentication bypass. Upgrade to 6.2.13, 6.4.15, 7.0.13, 7.2.8, 7.4.5, or 7.6.1.https://security-recipes.ai/cve/CVE-2024-37079/https://security-recipes.ai/cve/CVE-2024-37079/Thu, 23 Jul 2026 00:00:00 GMTCVE-2024-37079 is a critical vCenter Server out-of-bounds-write RCE. Upgrade to 8.0 U2d, 8.0 U1e, or 7.0 U3r; Broadcom lists no workaround.https://security-recipes.ai/cve/CVE-2024-23897/https://security-recipes.ai/cve/CVE-2024-23897/Thu, 23 Jul 2026 00:00:00 GMTCVE-2024-23897 allows arbitrary Jenkins controller files to be read via CLI. Upgrade every affected software branch to 2.442, LTS 2.426.3, or LTS 2.440.1.https://security-recipes.ai/cve/CVE-2021-44228/https://security-recipes.ai/cve/CVE-2021-44228/Thu, 23 Jul 2026 00:00:00 GMTCVE-2021-44228 Log4Shell RCE: upgrade log4j-core to 2.17.1+ (2.12.4 on Java 7 or 2.3.2 on Java 6); use legacy mitigations only until patched.https://security-recipes.ai/cve/CVE-2021-42013/https://security-recipes.ai/cve/CVE-2021-42013/Thu, 23 Jul 2026 00:00:00 GMTCVE-2021-42013 is the Apache HTTP Server 2.4.50 incomplete-fix bypass for CVE-2021-41773. Upgrade 2.4.49/2.4.50 to 2.4.51+ to stop traversal and CGI RCE.https://security-recipes.ai/cve/CVE-2021-41773/https://security-recipes.ai/cve/CVE-2021-41773/Thu, 23 Jul 2026 00:00:00 GMTCVE-2021-41773 Apache HTTP Server 2.4.49 path traversal can expose files and enable CGI RCE. Upgrade to 2.4.51+; the 2.4.50 fix is incomplete.https://security-recipes.ai/cve/CVE-2021-35395/https://security-recipes.ai/cve/CVE-2021-35395/Thu, 23 Jul 2026 00:00:00 GMTCVE-2021-35395 affects Realtek AP-Router SDK boa web servers. Apply Realtek's listed boa patch for SDK 3.2.3, 3.4.11, 3.4T-CT, or rtl819x-eCos 1.5.3.https://security-recipes.ai/recipes/cve/cve-2017-18342-pyyaml/https://security-recipes.ai/recipes/cve/cve-2017-18342-pyyaml/Thu, 23 Jul 2026 00:00:00 GMT`yaml.load` resolved arbitrary Python tags by default. Replace with `safe_load` and pin PyYAML ≥ 6.0 where the unsafe default was finally removed.https://security-recipes.ai/cve/CVE-2026-9082/https://security-recipes.ai/cve/CVE-2026-9082/Wed, 22 Jul 2026 00:00:00 GMTKnown-exploited Drupal core SQL injection affecting PostgreSQL sites. Identify exposure, update to a supported release, and verify every deployment.https://security-recipes.ai/cve/CVE-2026-48172/https://security-recipes.ai/cve/CVE-2026-48172/Wed, 22 Jul 2026 00:00:00 GMTActively exploited LiteSpeed cPanel plugin root escalation. Upgrade user-end versions 2.3-2.4.4 to 2.4.7 / WHM 5.3.1.0 or later and review redisAble logs.https://security-recipes.ai/cve/CVE-2026-21643/https://security-recipes.ai/cve/CVE-2026-21643/Wed, 22 Jul 2026 00:00:00 GMTCritical FortiClient EMS 7.4.4 SQL injection now in CISA KEV. Upgrade to 7.4.5 or later, verify the server version safely, and preserve incident evidence.https://security-recipes.ai/cve/CVE-2025-60455/https://security-recipes.ai/cve/CVE-2025-60455/Wed, 22 Jul 2026 00:00:00 GMTUpgrade Modular Max Serve to 25.6.0 or later to fix unsafe deserialization; disable the experimental kvcache agent until all deployments are patched.https://security-recipes.ai/cve/CVE-2025-25257/https://security-recipes.ai/cve/CVE-2025-25257/Wed, 22 Jul 2026 00:00:00 GMTCritical FortiWeb SQL injection exploited in the wild. Identify affected 7.0-7.6 appliances, upgrade to a Fortinet-fixed release, and verify without probing.https://security-recipes.ai/cve/CVE-2024-3094/https://security-recipes.ai/cve/CVE-2024-3094/Wed, 22 Jul 2026 00:00:00 GMTMaintainer-implanted backdoor in liblzma reachable through sshd. Roll back to 5.4.x; treat any network-exposed affected host as compromised.https://security-recipes.ai/cve/CVE-2024-1709/https://security-recipes.ai/cve/CVE-2024-1709/Wed, 22 Jul 2026 00:00:00 GMTCritical, exploited ScreenConnect authentication bypass. Upgrade self-hosted servers from 23.9.7 or earlier to 23.9.8+ and review administrative access.https://security-recipes.ai/cve/CVE-2023-1671/https://security-recipes.ai/cve/CVE-2023-1671/Wed, 22 Jul 2026 00:00:00 GMTKnown-exploited pre-auth command injection in Sophos Web Appliance. Verify 4.3.10.4, remove public access, preserve evidence, and retire the EOL appliance.https://security-recipes.ai/cve/CVE-2022-26134/https://security-recipes.ai/cve/CVE-2022-26134/Wed, 22 Jul 2026 00:00:00 GMTCVE-2022-26134 is a CRITICAL vulnerability: Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2026-14956/https://security-recipes.ai/cve/CVE-2026-14956/Tue, 21 Jul 2026 00:00:00 GMTCritical, unauthenticated Bricksforge privilege escalation (CVSS 9.8). Check public User Registration forms. Upgrade WordPress sites to Bricksforge 3.1.8.7 or later.https://security-recipes.ai/cve/CVE-2024-9465/https://security-recipes.ai/cve/CVE-2024-9465/Sat, 18 Jul 2026 00:00:00 GMTCVE-2024-9465 is a CRITICAL vulnerability: Palo Alto Networks Expedition SQL Injection Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2024-40711/https://security-recipes.ai/cve/CVE-2024-40711/Sat, 18 Jul 2026 00:00:00 GMTCVE-2024-40711 is a CRITICAL vulnerability: Veeam Backup and Replication Deserialization Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2026-39808/https://security-recipes.ai/cve/CVE-2026-39808/Fri, 17 Jul 2026 00:00:00 GMTCVE-2026-39808 is a CRITICAL vulnerability: Fortinet FortiSandbox OS Command Injection Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2025-34028/https://security-recipes.ai/cve/CVE-2025-34028/Fri, 17 Jul 2026 00:00:00 GMTCVE-2025-34028 is a CRITICAL vulnerability: Commvault Command Center Path Traversal Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2025-2747/https://security-recipes.ai/cve/CVE-2025-2747/Fri, 17 Jul 2026 00:00:00 GMTCVE-2025-2747 is a CRITICAL vulnerability: Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2025-55182/https://security-recipes.ai/cve/CVE-2025-55182/Wed, 15 Jul 2026 00:00:00 GMTCVE-2025-55182 is a CRITICAL vulnerability: Meta React Server Components Remote Code Execution Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2026-48027/https://security-recipes.ai/cve/CVE-2026-48027/Tue, 14 Jul 2026 00:00:00 GMTCVE-2026-48027 is a CRITICAL vulnerability: Nx Console Embedded Malicious Code Vulnerability. Review affected versions, source evidence, and bounded AI remediation guidance.https://security-recipes.ai/cve/CVE-2024-3400/https://security-recipes.ai/cve/CVE-2024-3400/Sun, 12 Jul 2026 00:00:00 GMTCritical unauthenticated PAN-OS GlobalProtect command injection. Upgrade every exposed firewall to a vendor-fixed release, apply the documented Threat Prevention containment while rollout is pending, and preserve evidence before reboot when compromise is suspected.https://security-recipes.ai/cve/CVE-2023-34362/https://security-recipes.ai/cve/CVE-2023-34362/Sun, 12 Jul 2026 00:00:00 GMTKnown-exploited SQL injection in MOVEit Transfer's web application. Contain HTTP/S exposure, preserve evidence, assess compromise, and upgrade every node with a current Progress-supported release.