ZEN SecDB Portal

Daily Security Dashboard

3
CISA KEV published in the last 7 days
1246 -39
CVEs published since last week
2065 700
CVEs updated since last week

EPSS - Top rated CVEs published in the last 30 days

CVE-2025-71243
The 'Saisies pour formulaire' (Saisies) plugin for SPIP versions 5.4.0 through 5.11.0 contains a critical Remote Code Execution (RCE) vulnerability. An attacker can exploit this vulnerability to execute arbitrary code on the server. Users should immediately update to version 5.11.1 or later.

# 1

CVE-2026-27180
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated remote code execution through supply chain compromise via update URL poisoning. The saverestore module exposes its admin() method through the /objects/?module=saverestore endpoint without authentication because it uses gr('mode') (which reads directly from $_REQUEST) instead of the framework's $this->mode. An attacker can poison the system update URL via the auto_update_settings mode handler, then trigger the force_update handler to initiate the update chain. The autoUpdateSystem() method fetches an Atom feed from the attacker-controlled URL with trivial validation, downloads a tarball via curl with TLS verification disabled (CURLOPT_SSL_VERIFYPEER set to FALSE), extracts it using exec('tar xzvf ...'), and copies all extracted files to the document root using copyTree(). This allows an attacker to deploy arbitrary PHP files, including webshells, to the webroot with two GET requests.

# 2

CVE-2026-27174
MajorDoMo (aka Major Domestic Module) allows unauthenticated remote code execution via the admin panel's PHP console feature. An include order bug in modules/panel.class.php causes execution to continue past a redirect() call that lacks an exit statement, allowing unauthenticated requests to reach the ajax handler in inc_panel_ajax.php. The console handler within that file passes user-supplied input from GET parameters (via register_globals) directly to eval() without any authentication check. An attacker can execute arbitrary PHP code by sending a crafted GET request to /admin.php with ajax_panel, op, and command parameters.

# 3

CVE-2026-27175
MajorDoMo (aka Major Domestic Module) is vulnerable to unauthenticated OS command injection via rc/index.php. The $param variable from user input is interpolated into a command string within double quotes without sanitization via escapeshellarg(). The command is inserted into a database queue by safe_exec(), which performs no sanitization. The cycle_execs.php script, which is web-accessible without authentication, retrieves queued commands and passes them directly to exec(). An attacker can exploit a race condition by first triggering cycle_execs.php (which purges the queue and enters a polling loop), then injecting a malicious command via the rc endpoint while the worker is polling. The injected shell metacharacters expand inside double quotes, achieving remote code execution within one second.

# 4

CVE-2026-2329
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability affects all six device models in the series: GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630.

# 5

Latest Vulnerabilities & Attacks

See more
WhisperPair
Ni8mare
Mongobleed
React2Shell
Metro4Shell

Quick Filters

More filters

Risk-based filters

Attack-vector filters

New IOCs in the past 30 days

Latest Advisories

All Advisories

New & Updated Vulnerabilities

All CVEs

Latest Articles

Read all articles
What's new in SecDB 26.01

# SecDB # Security Advisory # MCP # CVE # Dashboard # DefectDojo # CycloneDX # PURL # Audit

New "Daily Dashboard", fresh UI, PURL and Linux packages audit with export for DefectDojo and CycloneDX, updated Advisories and new experimental MCP Server for agentic AI

Continue reading
CWE 4.19 is available

# CWE # Weakness

MITRE has released version 4.19 of the Common Weakness Enumeration (CWE) introducing the new "2025 CWE Top 25" and "2025 OWASP Top 10 (RC1)" views, updated categories and refreshed examples and illustrations.

Continue reading
2025 CWE Top 25 Most Dangerous Software Weaknesses

# CWE # Weakness # Top25

MITRE has published the "2025 CWE Top 25 Most Dangerous Software Weaknesses list" (aka "CWE™ Top 25"), based on an analysis of "39,080 CVEs" published in this year’s dataset.

Continue reading
What's new in SecDB 25.5

# SecDB # Security Advisory # CVE # Telegram # IOC # Sightings

SecDB 25.5 brings a range of powerful new features designed to give you deeper visibility into vulnerabilities, real-world exploitation, and threat intelligence.

Continue reading
Image