CVE-2026-3517

MOVEit WAF Critical Alert: Multi-Level RCE and WAF Bypass Vulnerabilities Disclosed

CVE-2024-4358 MOVEit WAF RCE Progress ADC Vulnerabilities

MOVEit WAF Critical Alert: Multi-Level RCE and WAF Bypass Vulnerabilities Disclosed

Do Son April 21, 2026

Progress Software warns of 5 critical MOVEit WAF & ADC flaws. RCE and WAF bypass risks allow total system hijack. Upgrade to v7.2.63.0 now to stay secure.

Progress Kemp LoadMaster Alert: Multiple RCE and WAF Bypass Flaws Patched Kemp LoadMaster flaws command injection remote execution Kemp LoadMaster Vulnerability WAF Bypass Technique Progress WhatsUp Gold Vulnerabilities

Kemp LoadMaster flaws command injection remote execution Kemp LoadMaster Vulnerability WAF Bypass Technique Progress WhatsUp Gold Vulnerabilities

Progress Kemp LoadMaster Alert: Multiple RCE and WAF Bypass Flaws Patched

Do Son April 21, 2026

Progress Kemp LoadMaster reveals 5 high-severity vulnerabilities, including a WAF bypass and OS command injection. Secure your ADC with the April 2026 patch.

📈

EPSS Spike Alerts
Catch risk spikes before they make headlines.

🎯

Custom EPSS/CVSS
Set score thresholds to effectively filter noise.

🛡️

Exploit Intel
Real-world exploit signals beyond the KEV catalog.

🐙

GitHub Issues
Auto-create alert tickets without duplication.

📬

Weekly Digest
Clean summaries, eliminating email spam.

🏷️

Watchlist Groups
Tag vulnerabilities by team (Infra/AppSec/SOC).

🔀

Smart Routing
Route chat channels based on severity levels.

🚨

RBP Tracker
Early warning detection and tracking system.

or try free for 14 days →

CVE-2026-125350
Use after free in XML. Reported by anonymous on 2026-11-06. Google is aware that an exploit for CVE-2026-125350...
Admin intel📅 Updated: Nov 10, 2026
CVE-2026-123751CVSS 9.8
The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not...
Watchtower Verified📅 Updated: Nov 9, 2026
CVE-2026-111793CVSS 4.3
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted....
Admin intel📅 Updated: Nov 9, 2026
CVE-2026-114713CVSS 8.6
The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing...
Admin intel📅 Updated: Nov 9, 2026
CVE-2026-116779CVSS 9.8
Summary `sofia_presence_handle_sip_i_message()` splits the To user of an inbound SIP MESSAGE on `+` and treats the left half...
CISA KEV📅 Added to KEV: Nov 9, 2026
CVE-2026-102895CVSS 9.8
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0,...
CISA KEV📅 Added to KEV: Nov 9, 2026
CVE-2026-123158CVSS 8.1
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for...
CISA KEV📅 Added to KEV: Nov 9, 2026
CVE-2026-19868CVSS 7.5
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate...
CISA KEV📅 Added to KEV: Nov 6, 2026

CVE-2026-125086CVSS 10.0
A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf...
📅 Updated: Nov 10, 2026
CVE-2026-120017CVSS 10.0
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain...
📅 Updated: Nov 10, 2026
CVE-2026-109803CVSS 9.9
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the...
📅 Updated: Nov 10, 2026
CVE-2026-109798CVSS 9.1
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection...
📅 Updated: Nov 10, 2026
CVE-2026-109795CVSS 9.9
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An...
📅 Updated: Nov 10, 2026
CVE-2026-89126CVSS 10.0
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker...
📅 Updated: Nov 10, 2026
CVE-2026-89119CVSS 9.6
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation...
📅 Updated: Nov 10, 2026
CVE-2026-107246CVSS 9.2
The Plesk extension "Site Import" before 1.13.2 does not properly validate domain and session identifiers, allowing path traversal....
📅 Updated: Nov 10, 2026