Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51620
Total
4095
Critical
15305
High
14964
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-63732 | CRITICAL | 9.9 | 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation, a bypass of the LOCAL_ONLY … | Jul 23, 2026 |
| CVE-2026-63313 | HIGH | 7.7 | 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to … | Jul 23, 2026 |
| CVE-2026-16807 | HIGH | 8.8 | Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafted … | Jul 23, 2026 |
| CVE-2026-16806 | HIGH | 8.8 | Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted … | Jul 23, 2026 |
| CVE-2026-16805 | HIGH | 8.8 | Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted … | Jul 23, 2026 |
| CVE-2026-16804 | HIGH | 8.3 | Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially perform a … | Jul 23, 2026 |
| CVE-2026-16765 | HIGH | 7.3 | A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of … | Jul 23, 2026 |
| CVE-2026-16764 | MEDIUM | 6.3 | A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of the component API/Web. Such manipulation of … | Jul 23, 2026 |
| CVE-2026-16763 | MEDIUM | 5.3 | A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js of the component Configuration … | Jul 23, 2026 |
| CVE-2025-71389 | CRITICAL | 10.0 | Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling … | Jul 23, 2026 |
| CVE-2024-58355 | HIGH | 8.9 | Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without … | Jul 23, 2026 |
| CVE-2024-58354 | CRITICAL | 9.9 | cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger … | Jul 23, 2026 |
| CVE-2024-58353 | HIGH | 8.9 | Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form … | Jul 23, 2026 |
| CVE-2026-6924 | UNKNOWN | — | A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter … | Jul 23, 2026 |
| CVE-2026-52439 | UNKNOWN | — | An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism | Jul 23, 2026 |
| CVE-2026-50103 | MEDIUM | 6.5 | A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application by sending … | Jul 23, 2026 |
| CVE-2026-50039 | HIGH | 7.5 | The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request. | Jul 23, 2026 |
| CVE-2026-50032 | HIGH | 7.5 | A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending … | Jul 23, 2026 |
| CVE-2026-49035 | HIGH | 8.1 | The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstrated when ASLR … | Jul 23, 2026 |
| CVE-2026-47724 | CRITICAL | 9.9 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token … | Jul 23, 2026 |
| CVE-2026-47723 | UNKNOWN | — | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `internal/web/` or … | Jul 23, 2026 |
| CVE-2026-39155 | UNKNOWN | — | Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. This can … | Jul 23, 2026 |
| CVE-2026-38764 | UNKNOWN | — | An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys | Jul 23, 2026 |
| CVE-2026-34496 | UNKNOWN | — | Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1. | Jul 23, 2026 |
| CVE-2026-21655 | UNKNOWN | — | Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0. | Jul 23, 2026 |