CVE-2026-28501
Mar 6, 2026
WWBN AVideo is an open source video platform. Prior to version 24.0, an unauthenticated SQL Injection vulnerability exists in AVideo within the objects/videos.json.php and objects/video.php components...
Read Advisory
[MSF] Metasploit Modules
6 CVEs with a Metasploit Framework exploit module
These vulnerabilities have a working Metasploit Framework module from Rapid7's metasploit-framework repo.
An MSF module means point-and-click exploitation: attackers and red teams already use it. Patch immediately.
CVE-2026-28289
Mar 3, 2026
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with f...
Read Advisory
CVE-2026-20127
Feb 25, 2026
A vulnerability in the peering authentication in Cisco Catalyst SD-WAN Controller, formerly SD-WAN vSmart, and Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an unauthenticated, r...
Read Advisory
CVE-2026-27174
Feb 18, 2026
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to contin...
Read Advisory
CVE-2026-27175
Feb 18, 2026
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double qu...
Read Advisory
CVE-2026-27180
Feb 18, 2026
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method...
Read Advisory