Vulmon (@vulmoncom) header
Vulmon (@vulmoncom) profile picture

Vulmon

@vulmoncom

Vulnerability Intelligence Search Engine https://teapawt.net/t.co/nxqvEXUxMU Offical Account | Follow @VulmonFeeds for vulnerability feed

 Custom Vulnerability Alerts 👉
alerts.vulmon.com
Joined November 2017
  • Tweets930
  • Following2
  • Followers2.4K
152Media
Photo by Vulmon (@vulmoncom)Photo by Vulmon (@vulmoncom)Photo by Vulmon (@vulmoncom)Photo by Vulmon (@vulmoncom)Photo by Vulmon (@vulmoncom)Photo by Vulmon (@vulmoncom)Photo by Vulmon (@vulmoncom)Photo by Vulmon (@vulmoncom)Photo by Vulmon (@vulmoncom)Photo by Vulmon (@vulmoncom)
An unauthenticated network attacker can take over Oracle WebLogic Server via HTTP. CVE-2026-83021 Affected: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 CVSS 10.0
1
1
1
304
Details: vulmon.com/vulnerabilitydeta…
CVE-2026-83021 - Unauthenticated Takeover of Oracle WebLogic…

CVE-2026-83021 - Unauthenticated Takeover of Oracle WebLogic…

Unauthenticated Takeover of Oracle WebLogic Server via Web Container Vulnerability. A vulnerability in Oracle WebLogic Server's Web Container component enables…

vulmon.com
120
Absolute-form request targets can skip path-scoped auth middleware in Fastify apps. CVE-2026-85184 Affected: @fastify/middie 9.1.0 to 9.3.3 Fixed: 9.3.4 Details: vulmon.com/vulnerabilitydeta…
CVE-2026-85184 - Bypass of Path-Based Access Controls in…

CVE-2026-85184 - Bypass of Path-Based Access Controls in…

Bypass of Path-Based Access Controls in @fastify/middie Versions < 9.3.4. An unauthenticated network attacker may bypass path-based access controls in…

vulmon.com
1
156
A remote, unauthenticated attacker may execute arbitrary commands on a Redis server with TLS enabled. CVE-2026-81934 — use-after-free in tlsProcessPendingData(). Affected: Redis 8.2–8.10 branches. Fixed in 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1. vulmon.com/vulnerabilitydeta…
CVE-2026-81934 - Redis Use-After-Free in TLS Allows Remote…

CVE-2026-81934 - Redis Use-After-Free in TLS Allows Remote…

Redis Use-After-Free in TLS Allows Remote Command Execution. Redis versions prior to 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1 are affected by a use-after-free…

vulmon.com
1
1
204
Sending a single UDP packet executes root commands on Zbtlink routers. CVE-2026-74233 — Command injection in infosrvd (UDP/9992). Auth is bypassed via a hardcoded salt and wildcard MAC. Details: vulmon.com/vulnerabilitydeta…
CVE-2026-74233 - Unauthenticated Command Injection in…

CVE-2026-74233 - Unauthenticated Command Injection in…

Unauthenticated Command Injection in Zbtlink and Other Router Firmware. An unauthenticated command injection vulnerability exists in the infosrvd service…

vulmon.com
1
1
126
Running Spring Security's embedded LDAP server exposes admin credentials on all network interfaces. CVE-2026-59270 affects 7.1.0, 7.0.0-7.0.6, 6.5.0-6.5.11, 6.4.0-6.4.18, 5.8.0-5.8.27, 5.7.0-5.7.25. vulmon.com/vulnerabilitydeta…
CVE-2026-59270 - Spring Security Embedded LDAP Server Binds…

CVE-2026-59270 - Spring Security Embedded LDAP Server Binds…

Spring Security Embedded LDAP Server Binds to All Interfaces. Spring Security versions 7.1.0, 7.0.0 through 7.0.6, 6.5.0 through 6.5.11, 6.4.0 through 6.4.18…

vulmon.com
2
5
836
Vulmon retweeted
Clerk (@clerk) profile picture
Clerk
@clerk9 Jul 2025
Today we published CVE-2025-53548 in response to a vulnerability in our verifyWebhook() helper. It advises those using this helper to upgrade their npm package. Customers we believe were using affected versions were notified yesterday, in advance of the public disclosure. We regret the introduction of this vulnerability and are extremely grateful to the Clerk customer who responsibly disclosed the issue. More details are available here: clerk.com/changelog/2025-07-…
CVE-2025-53548

CVE-2025-53548

clerk.com
1
1
15
2,867
🚨 Two critical Electron vulns patched: 🔹 CVE-2024-46993 (CVSS: 4.4) — Heap buffer overflow in nativeImage functions 🔹 CVE-2024-46992 (CVSS: 7.8) — ASAR integrity bypass on Windows 👉 Update now! #Electron #Vulmon #Electronjs
Image from Vulmon (@vulmoncom)
1
3
470
CVE-2024-46993: vulmon.com/vulnerabilitydeta… CVE-2024-46992: vulmon.com/vulnerabilitydeta…
CVE-2024-46993 - Heap Buffer Overflow in Electron's…

CVE-2024-46993 - Heap Buffer Overflow in Electron's…

Heap Buffer Overflow in Electron's Image Creation Functions Before 28.3.2, 29.3.3, 30.0.3. Electron, an open source framework for creating cross-platform…

vulmon.com
1
245
🚨 CVE-2025-6554: High-severity type confusion vuln in Chrome V8 (pre-138.0.7204.96) allows arbitrary memory access via crafted HTML. Exploit detected in the wild — update now! #CyberSecurity #Vulmon vulmon.com/vulnerabilitydeta…
Image from Vulmon (@vulmoncom)
1
4
1,615
I published blogs detailing two vulnerabilities I recently discovered in Sudo. Update to 1.9.17p1. CVE-2025-32462 - Sudo Host option Elevation of Privilege Vulnerability stratascale.com/vulnerabilit… CVE-2025-32463 - Sudo chroot Elevation of Privilege Vulnerability stratascale.com/vulnerabilit…
11
80
11
264
45,808
Just finished reproducing CVE-2025-32433 and putting together a quick PoC exploit — surprisingly easy. Wouldn’t be shocked if public PoCs start dropping soon. If you’re tracking this, now’s the time to take action. #Erlang #SSH
12
131
8
419
60,180
🚨 CVE-2024-48887 Fortinet FortiSwitch GUI vuln (CVSS 9.3) A remote attacker can change admin passwords without authentication via the set_password endpoint. Unauthenticated access + no verification = full control. #Vulmon #CyberSecurity #Fortinet
Image from Vulmon (@vulmoncom)
1
5
6
799
Details: vulmon.com/vulnerabilitydeta…
CVE-2024-48887 - Unauthenticated Password Change…

CVE-2024-48887 - Unauthenticated Password Change…

Unauthenticated Password Change Vulnerability in Fortinet FortiSwitch GUI. A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a…

vulmon.com
195
🚨 WhatsApp for Windows Vulnerability: CVE-2025-30401 A crafted attachment could trick users into running malicious code instead of just opening the file — simply by clicking it inside WhatsApp. #Vulmon #WhatsApp #infosec
Image from Vulmon (@vulmoncom)
1
4
7
769
Details: vulmon.com/vulnerabilitydeta…
CVE-2025-30401 - WhatsApp for Windows Attachment Spoofing…

CVE-2025-30401 - WhatsApp for Windows Attachment Spoofing…

WhatsApp for Windows Attachment Spoofing Vulnerability Enables Arbitrary Code Execution. A spoofing issue in WhatsApp for Windows prior to version 2.2450.6…

vulmon.com
213
CVE-2025-22457: Stack-based buffer overflow in Ivanti Connect Secure (≤22.7R2.5), Policy Secure & ZTA Gateways could lead to remote code execution (CVSS 9.0). 🚨 limited exploitation observed. #vulmon #ivanti #infosec
Image from Vulmon (@vulmoncom)
1
2
2
335
Details of CVE-2025-22457: vulmon.com/vulnerabilitydeta…
CVE-2025-22457 - Remote Code Execution in Ivanti Connect…

CVE-2025-22457 - Remote Code Execution in Ivanti Connect…

Remote Code Execution in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6…

vulmon.com
185
Authorization Bypass Vulnerability in Vercel Next.js: CVE-2025-29927 It is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. CVSS: 9.1 #Vulmon #React #nextjs #Vercel
Image from Vulmon (@vulmoncom)
1
2
1
5
956
CVE-2025-29927: vulmon.com/vulnerabilitydeta…
CVE-2025-29927 - Authorization Bypass Vulnerability in…

CVE-2025-29927 - Authorization Bypass Vulnerability in…

Authorization Bypass Vulnerability in Next.js Middleware Before 14.2.25 and 15.2.3. A vulnerability exists in Next.js, a React framework for building full-stack…

vulmon.com
277
Load more