@VolerionSec

Instant, consistent, and comprehensive CVE data & prioritization scoring via our next-gen algorithms.

volerion.com
Joined May 2025
  • Tweets182
  • Following6
  • Followers62
6Media
Launching today! Volerion transforms raw CVEs into structured and instant insights #CVE #CyberSecurity #infosec
2
17
40
14,875
Still using the NVD API? Coverage gaps, inconsistent CVSS scoring, missing CPEs, and enrichment delays can slow down triage and automation. We just released our NVD-compatible API, designed as a drop-in replacement. Swap the base URL and try it free. app.volerion.com/solutions/n…
1
1
1
4
714
We did research on the new NVD prioritization strategy, which led to some interesting insights! blog.volerion.com/posts/two-…

Two Months In: Assessing the Impact of NIST's Enrichment Cutbacks

An analysis of the effects of NIST's new operational policy for enrichment of the National Vulnerability Database

blog.volerion.com
1
2
119
🚨 CVE-2026-4283: WP DSGVO Tools plugin lets anyone delete WordPress user accounts remotely, no login needed. Attackers abuse the super-unsubscribe endpoint to wipe profiles instantly. Patch to 3.1.39 now! Full advisory ➡️ volerion.com/vulnerabilities… #WordPress #infosec #AppSec

CVE-2026-4283 – WP DSGVO Tools (GDPR) Missing Authorization Vulnerability Allowing Unauthenticated...

WP DSGVO Tools (GDPR) Missing Authorization Vulnerability Allowing Unauthenticated Account Destruction of Non-Admin Users. Critical severity (CVSS 9.1). Read our full technical analysis, impact...

volerion.com
1
182
🚨 CVE-2026-33169: Long digit strings can stall Ruby on Rails apps through Active Support’s number_to_delimited (remote, no login). Upgrade to 8.1.2.1 / 8.0.4.1 / 7.2.3.1 asap. Full advisory ➡️ volerion.com/vulnerabilities… #Rails #infosec #AppSec
1
138
🚨 CVE-2026-4633: Keycloak leaks valid usernames by returning different errors during login (remote, no login). Attackers can map accounts for further attacks. Disable Organizations or the identity-first login flow until a fix lands. Full advisory ➡️ volerion.com/vulnerabilities… #Keycloak #infosec #AppSec
3
5
697
🚨 CVE-2026-4373: JetFormBuilder for WordPress lets unauthenticated users read any file via crafted form uploads. Upgrade to 3.5.6.3 now to keep data safe! Full advisory ➡️ volerion.com/vulnerabilities… #WordPress #infosec #AppSec
43
🚨 CVE-2026-33069: Unauthenticated SIP message can trigger an out-of-bounds heap read in PJSIP ≤2.16, leaking adjacent memory. Upgrade to 2.17 now! Full advisory ➡️ volerion.com/vulnerabilities… #PJSIP #VoIP #infosec
1
1
227
🚨 CVE-2026-33011: NestJS apps using @nestjs/platform-fastify let HEAD calls bypass GET middleware, running handlers without checks. Upgrade to 11.1.16+ to stay secure. More details ➡️ volerion.com/vulnerabilities… #NestJS #NodeJS #AppSec
50
🚨 CVE-2026-32945: Heap overflow in PJSIP DNS parser lets remote attackers run code, no login needed. Upgrade to 2.17 or disable the built-in DNS resolver. Full advisory ➡️ volerion.com/vulnerabilities… #VoIP #infosec #AppSec

CVE-2026-32945 – PJSIP Heap-Based Buffer Overflow Vulnerability in DNS Parser | Volerion Advisory

PJSIP Heap-Based Buffer Overflow Vulnerability in DNS Parser. Critical severity (CVSS 9.8). Read our full technical analysis, impact assessment and mitigation guidelines.

volerion.com
1
1
63
🚨 CVE-2026-30694: Remote code execution in DedeCMS (up to 5.7.118), no login required. Lock down your site and watch for a patch. Full advisory ➡️ volerion.com/vulnerabilities… #DedeCMS #infosec #AppSec
62
🚨 CVE-2026-2369: Remote integer underflow in GNOME libsoup 3.6.1+ lets crafted zero-length payloads crash apps or leak data. Patch now to keep desktop and server software stable! Full advisory ➡️ volerion.com/vulnerabilities… #infosec #Linux #OpenSource
68
🚨 CVE-2026-27135: Malformed HTTP/2 frames can crash apps using nghttp2 ≤1.68.0 (remote denial of service, no login). Update to 1.68.1 now! Full advisory ➡️ volerion.com/vulnerabilities… #nghttp2 #infosec #DevOps

CVE-2026-27135 – nghttp2 Denial-of-Service Vulnerability Due to Missing State Validation | Volerion...

nghttp2 Denial-of-Service Vulnerability Due to Missing State Validation. High severity (CVSS 8.7). Read our full technical analysis, impact assessment and mitigation guidelines.

volerion.com
60
🚨 CVE-2026-27980: Remote attackers can fill up disk via Next.js image optimization (v10–16.1.6), knocking sites offline. Upgrade to 16.1.7 or routinely clear .next/cache/images. Full advisory ➡️ volerion.com/vulnerabilities… #Nextjs #infosec #webdev

CVE-2026-27980 – Next.js Unbounded Disk Cache Vulnerability in Image Optimization | Volerion...

Next.js Unbounded Disk Cache Vulnerability in Image Optimization. High severity (CVSS 8.7). Read our full technical analysis, impact assessment and mitigation guidelines.

volerion.com
1
97
🚨 CVE-2026-27979: POST requests with ‘next-resume: 1’ can exhaust memory in Next.js sites using Partial Prerendering, leading to DoS. Upgrade to 16.1.7 or block that header. Full advisory ➡️ volerion.com/vulnerabilities… #Nextjs #infosec #webdev
73
🚨 CVE-2026-4271: Remote use-after-free in libsoup’s HTTP/2 server lets anyone crash apps relying on it, knocking services offline. Update libsoup to the latest release or apply vendor patches. Full advisory ➡️ volerion.com/vulnerabilities… #infosec #Linux #GNOME

CVE-2026-4271 – Libsoup Use-After-Free Vulnerability in HTTP/2 Server Implementation Leading to...

Libsoup Use-After-Free Vulnerability in HTTP/2 Server Implementation Leading to Denial-of-Service. High severity (CVSS 7.5). Read our full technical analysis, impact assessment and mitigation...

volerion.com
68
🚨 CVE-2026-3633: Remote CRLF injection in GNOME libsoup lets attackers slip arbitrary headers into your HTTP requests. Patch or sanitize method values to shut it down. Full advisory ➡️ volerion.com/vulnerabilities… #infosec #Linux #AppSec
1
55
🚨 CVE-2026-1069: Unauthenticated GraphQL requests can knock your GitLab CE/EE offline (DoS). Patch to 18.9.2 / 18.8.6 / 18.7.6 ASAP. Full advisory ➡️ volerion.com/vulnerabilities… #GitLab #infosec #DevOps
60
🚨 CVE-2026-26308: Envoy Proxy merges duplicate headers, letting attackers bypass RBAC Deny rules and reach protected services. Update to 1.37.1 / 1.36.5 / 1.35.9 / 1.34.13 or enable rbac_match_headers_individually. More info ➡️ volerion.com/vulnerabilities… #Envoy #infosec #DevOps
1
139
🚨 CVE-2026-26309: Remote off-by-one bug in Envoy’s JSON string escaper can corrupt memory and crash your proxy. Patch to 1.37.1 or the latest stable release now! Full advisory ➡️ volerion.com/vulnerabilities… #Envoy #infosec #DevOps
48
🚨 CVE-2026-26310: A crafted scoped IPv6 address can remotely crash Envoy, causing denial of service. Upgrade to 1.37.1, 1.36.5, 1.35.9 or 1.34.13 ASAP. Full advisory ➡️ volerion.com/vulnerabilities… #Envoy #infosec #DevOps

CVE-2026-26310 – Envoy Denial-of-Service Vulnerability Due to Scoped IPv6 Address Handling |...

Envoy Denial-of-Service Vulnerability Due to Scoped IPv6 Address Handling. High severity (CVSS 7.7). Read our full technical analysis, impact assessment and mitigation guidelines.

volerion.com
1
2
223
Load more