CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Critical Authentication Bypass in Vvveb CMS Password Reset (CVE-2026-110799)
[Affected Scope] All websites and e-commerce stores running Vvveb CMS versions prior to 1.0.8.7
[Impact] Remote attackers can bypass authentication to reset any user's password, leading to full account takeover including administrative privileges.
[Mitigation] Immediately upgrade Vvveb CMS to version 1.0.8.7 or later.
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
[Impact] Attackers can bypass authentication using crafted JWTs, leading to full administrative account takeover.
[Mitigation] Apply official vendor patches immediately and enforce strict JWT algorithm validation policies.
SysAid On-Prem Unauthenticated XML External Entity (XXE) Vulnerability (CVE-2025-2776) Technical Advisory
[Affected Scope] SysAid On-Prem versions <= 23.3.40
[Impact] Unauthenticated remote attackers can exploit the Server URL processing logic to read arbitrary files, hijack administrator accounts, and potentially achieve Remote Code Execution (RCE)
[Mitigation] Immediately upgrade SysAid On-Prem to the patched version (24.40.60 or higher) and restrict external access to the application
Palo Alto Networks Expedition Administrator Account Takeover and Authentication Bypass Vulnerability (CVE-2024-5910) Security Advisory
[Affected Scope] Palo Alto Networks Expedition versions prior to 1.2.92
[Impact] Attackers with network access can bypass authentication to take over the Expedition administrator account, exposing firewall configurations, credentials, and API keys
[Mitigation] Immediately upgrade Expedition to version 1.2.92 or later, and restrict network access to authorized administrator IPs only
GitLab CE/EE Account Takeover via Password Reset Vulnerability (CVE-2023-7028) Security Advisory
[Affected Scope] GitLab CE/EE versions 16.1 to 16.7.1 (prior to 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, and 16.7.2)
[Impact] An unauthenticated remote attacker can trigger password reset emails to be sent to an arbitrary, unverified email address, leading to complete account takeover.
[Mitigation] Immediately upgrade GitLab instances to the patched versions (16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 or later) and enforce Multi-Factor Authentication (MFA).