CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
[Impact] A local authorized attacker can exploit improper link resolution to elevate privileges to SYSTEM, leading to complete system compromise
[Mitigation] Apply the official Microsoft security updates immediately, or restrict local symbolic link creation privileges as a temporary mitigation
Joomla JCE Editor Extension Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-48907)
[Affected Scope] Vulnerable versions of the JCE (Joomla Content Editor) extension for Joomla CMS
[Impact] Unauthenticated remote attackers can create unauthorized editor profiles, bypass file upload restrictions, and upload malicious PHP scripts to achieve full Remote Code Execution (RCE)
[Mitigation] Immediately upgrade JCE to the latest patched version and deploy Web Application Firewall (WAF) rules to block unauthorized profile modification requests
Ubiquiti UniFi OS Improper Access Control Vulnerability (CVE-2026-34908) - Remote Code Execution and System Takeover Risk
[Affected Scope] Ubiquiti UniFi OS devices accessible via the network
[Impact] Unauthenticated remote attackers can make unauthorized system changes, gain administrative control, and potentially enlist devices into botnets
[Mitigation] Apply the official vendor security patches immediately, restrict access to management interfaces, and monitor for unauthorized configuration changes
Fortinet FortiClientEMS Remote Code Execution (RCE) Vulnerability via Improper Access Control (CVE-2026-35616)
[Affected Scope] Fortinet FortiClientEMS versions 7.4.5 through 7.4.6
[Impact] An unauthenticated remote attacker can execute unauthorized code or commands with system privileges via crafted network requests.
[Mitigation] Apply the official Fortinet security patch (version 7.4.7 or higher) immediately and restrict external network access to the EMS server.
Oracle HTTP Server & WebLogic Server Proxy Plug-in Critical Vulnerability Advisory (CVE-2026-21962)
[Affected Scope] Oracle HTTP Server and WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 within Oracle Fusion Middleware.
[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to compromise the server, leading to unauthorized data modification, deletion, or complete system takeover with potential scope expansion to backend systems (CVSS 10.0).
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, restrict network access, and deploy WAF rules to filter malicious HTTP headers.