Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51620
Total
4095
Critical
15305
High
14964
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-21653 | UNKNOWN | — | Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure 9000 and victor application … | Jul 23, 2026 |
| CVE-2026-16796 | HIGH | 7.3 | Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute … | Jul 23, 2026 |
| CVE-2026-16002 | HIGH | 8.2 | The affected product is vulnerable to an Out-of-bounds read, which may allow an attacker to crash the parsing process and cause a denial of service. | Jul 23, 2026 |
| CVE-2026-15981 | CRITICAL | 9.8 | The SAML Single Sign On – SSO Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.4.4. This … | Jul 23, 2026 |
| CVE-2026-15968 | HIGH | 7.1 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before … | Jul 23, 2026 |
| CVE-2026-15967 | HIGH | 7.5 | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. | Jul 23, 2026 |
| CVE-2026-15966 | HIGH | 7.5 | Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. | Jul 23, 2026 |
| CVE-2026-15630 | UNKNOWN | — | A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch … | Jul 23, 2026 |
| CVE-2026-10697 | HIGH | 7.5 | Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3. | Jul 23, 2026 |
| CVE-2026-65706 | HIGH | 7.8 | FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a … | Jul 23, 2026 |
| CVE-2026-65705 | HIGH | 7.8 | FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a … | Jul 23, 2026 |
| CVE-2026-65704 | HIGH | 7.8 | FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe … | Jul 23, 2026 |
| CVE-2026-65703 | HIGH | 7.8 | FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying … | Jul 23, 2026 |
| CVE-2026-64785 | UNKNOWN | — | SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's … | Jul 23, 2026 |
| CVE-2026-63359 | CRITICAL | 9.8 | The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access … | Jul 23, 2026 |
| CVE-2026-60122 | HIGH | 7.8 | gpsd through release-3.27.5, fixed at commit 4c06658, contains a code injection vulnerability in the gpsprof utility that allows an attacker who controls GPS input data … | Jul 23, 2026 |
| CVE-2026-48013 | MEDIUM | 4.1 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the `/api/_action/media/external-link` endpoint allows authenticated admin users to make server-side HTTP HEAD requests to … | Jul 23, 2026 |
| CVE-2026-48012 | MEDIUM | 4.3 | Shopware is an open commerce platform. Versions 6.7.3.0 through 6.7.10.0 have an open redirect in Shopware's public SSO entry point at `GET /api/oauth/sso/auth`. When the … | Jul 23, 2026 |
| CVE-2026-47722 | UNKNOWN | — | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, `internal/configgen/generator.go:86,108,119` interpolates the operator-supplied `ListenHost` and `TunDevice` fields … | Jul 23, 2026 |
| CVE-2026-47670 | UNKNOWN | — | DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute … | Jul 23, 2026 |
| CVE-2026-47669 | UNKNOWN | — | DbGate is cross-platform database manager. In versions 7.1.8 and prior, the `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted file paths stay … | Jul 23, 2026 |
| CVE-2026-25800 | HIGH | 7.5 | Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Starting in version 0.1.0 and prior to version 0.11.15, the `Assembler` component that … | Jul 23, 2026 |
| CVE-2026-15212 | HIGH | 8.8 | The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the … | Jul 23, 2026 |
| CVE-2026-12353 | MEDIUM | 5.3 | An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TLS … | Jul 23, 2026 |
| CVE-2026-65010 | MEDIUM | 6.6 | Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract() that allows local attackers to write arbitrary files by pre-planting symlinks at … | Jul 23, 2026 |