📋 ADVISORIES
- SonicWall Patches Critical RCE Flaws in Discontinued GMS Platform
SonicWall patched critical unauthenticated RCE flaws in its discontinued GMS platform.
- SonicWall GMS Virtual Appliance and Windows versions 9.5.1 and earlier are affected.
CVE-2026-66147enables unauthenticated remote code execution through command injection.CVE-2026-66145enables sensitive-data disclosure through a zip slip attack.- SonicWall fixed the GMS flaws in version 9.5.2 and reported no known exploitation in the wild. 📄 Source: cisecurity.org · 📎 Coverage: radar.offseq.com · 👁 via CIS Advisories
🔓 CVEs & KEV
- CVE-2026-73300 — CVSS 9.6 — Budibase: SQL Injection via
multipleStatements: trueBudibase is an open-sou... - CVE-2026-69106 — CVSS 8.8 — Potential cache poisoning in JFrog ArtifactoryA low-privileged user may poiso...
- CVE-2026-18952 — CVSS 8.6 — Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security A...
- CVE-2026-19311 — CVSS 8.6 — Missing Authorization in Execute Monitor API in OpenSearch Alerting PluginMis...
- CVE-2026-15423 — CVSS 8.5 — Incorrect Authorization in GitLabGitLab has remediated an issue in GitLab CE/...
- CVE-2026-16627 — CVSS 7.7 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scri...
- CVE-2026-16907 — CVSS 7.6 — IBM i is Affected By Multiple Vulnerabilities in the Debug ServerIBM i 7.6, 7...
- CVE-2026-42018 — CVSS 7.5 — Anonymous user token generation exposure in JFrog ArtifactoryJFrog Artifactor...
- CVE-2026-17271 — CVSS 7.5 — IBM i is Affected By Multiple Vulnerabilities in the Debug ServerIBM i 7.6, 7...
- CVE-2026-17248 — CVSS 7.1 — IBM i is Affected By Multiple Vulnerabilities in the Debug ServerIBM i 7.6, 7...
- CVE-2026-18677 — CVSS 6.0 — Kong Mesh: a dataplane token without a workload binding can claim any workloa...