Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51620
Total
4095
Critical
15305
High
14964
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-63765 | HIGH | 8.2 | Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant … | Jul 23, 2026 |
| CVE-2026-16756 | HIGH | 7.5 | Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-server might allow remote attackers to … | Jul 23, 2026 |
| CVE-2026-15687 | LOW | 2.4 | A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations … | Jul 23, 2026 |
| CVE-2026-6516 | CRITICAL | 10.0 | Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API. | Jul 23, 2026 |
| CVE-2026-65920 | MEDIUM | 4.3 | Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _get_checkpoint_shard_files function that allows attackers to read arbitrary files by supplying … | Jul 23, 2026 |
| CVE-2026-65919 | HIGH | 7.5 | Meshery before 1.0.57 contains an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints that pass user-supplied file parameters directly to os.Open without … | Jul 23, 2026 |
| CVE-2026-65918 | HIGH | 7.1 | PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains an out-of-bounds heap read vulnerability in the GIF decoder's read_from_tensor callback that passes unclamped length to … | Jul 23, 2026 |
| CVE-2026-65763 | UNKNOWN | — | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability. | Jul 23, 2026 |
| CVE-2026-65762 | UNKNOWN | — | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability. | Jul 23, 2026 |
| CVE-2026-65702 | HIGH | 8.6 | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated remote attackers to write attacker-controlled JSON files to arbitrary … | Jul 23, 2026 |
| CVE-2026-65701 | CRITICAL | 9.1 | SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read … | Jul 23, 2026 |
| CVE-2026-65700 | CRITICAL | 9.8 | h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files … | Jul 23, 2026 |
| CVE-2026-65699 | MEDIUM | 4.2 | AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying … | Jul 23, 2026 |
| CVE-2026-47769 | MEDIUM | 5.3 | APIFold reads an OpenAPI 3.x or Swagger 2.x specification and generates a live, production-ready MCP server endpoint. Prior to commit 7f19b52280f414f57af2b79a95333d1c8fbeece5, the `/webhooks/:serverSlug/:eventName` endpoint accepts … | Jul 23, 2026 |
| CVE-2026-47755 | MEDIUM | 6.5 | ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials … | Jul 23, 2026 |
| CVE-2026-47752 | CRITICAL | 9.9 | Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection (SSTI) in the notification … | Jul 23, 2026 |
| CVE-2026-47743 | HIGH | 8.7 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored … | Jul 23, 2026 |
| CVE-2026-47668 | CRITICAL | 10.0 | DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execution via code injection in the … | Jul 23, 2026 |
| CVE-2026-44210 | UNKNOWN | — | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Versions prior to 3.31.0 … | Jul 23, 2026 |
| CVE-2026-65761 | UNKNOWN | — | Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection … | Jul 23, 2026 |
| CVE-2026-65760 | UNKNOWN | — | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to … | Jul 23, 2026 |
| CVE-2026-65759 | UNKNOWN | — | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client … | Jul 23, 2026 |
| CVE-2026-65698 | MEDIUM | 5.3 | Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrary host files outside the … | Jul 23, 2026 |
| CVE-2026-65697 | MEDIUM | 6.1 | Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into … | Jul 23, 2026 |
| CVE-2026-65696 | MEDIUM | 5.4 | Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete … | Jul 23, 2026 |