Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51620
Total
4095
Critical
15305
High
14964
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-8287 | MEDIUM | 4.3 | Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation. This issue affects … | Jul 23, 2026 |
| CVE-2026-65914 | UNKNOWN | — | DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, … | Jul 23, 2026 |
| CVE-2026-65913 | MEDIUM | 6.1 | DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set … | Jul 23, 2026 |
| CVE-2026-65912 | MEDIUM | 6.1 | DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that … | Jul 23, 2026 |
| CVE-2026-65911 | MEDIUM | 6.1 | In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same … | Jul 23, 2026 |
| CVE-2026-65904 | MEDIUM | 4.7 | DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A … | Jul 23, 2026 |
| CVE-2026-65903 | MEDIUM | 6.1 | DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input … | Jul 23, 2026 |
| CVE-2026-65902 | MEDIUM | 6.1 | DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags … | Jul 23, 2026 |
| CVE-2026-65901 | MEDIUM | 6.1 | DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM … | Jul 23, 2026 |
| CVE-2026-65900 | MEDIUM | 6.1 | DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions … | Jul 23, 2026 |
| CVE-2026-65899 | MEDIUM | 6.1 | DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundaries stays … | Jul 23, 2026 |
| CVE-2026-65898 | HIGH | 7.2 | DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared … | Jul 23, 2026 |
| CVE-2026-65690 | HIGH | 8.8 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its file upload functionality that allows authenticated attackers to traverse outside … | Jul 23, 2026 |
| CVE-2026-65689 | CRITICAL | 9.8 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its database download feature that allows unauthenticated attackers to read arbitrary … | Jul 23, 2026 |
| CVE-2026-65688 | CRITICAL | 9.8 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its font processing feature that allows unauthenticated attackers to read arbitrary … | Jul 23, 2026 |
| CVE-2026-65687 | CRITICAL | 9.8 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary … | Jul 23, 2026 |
| CVE-2026-16735 | MEDIUM | 5.3 | A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog … | Jul 23, 2026 |
| CVE-2026-16733 | MEDIUM | 5.3 | A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component … | Jul 23, 2026 |
| CVE-2026-14257 | HIGH | 7.5 | brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default … | Jul 23, 2026 |
| CVE-2026-65908 | HIGH | 8.6 | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open | Jul 23, 2026 |
| CVE-2026-65907 | CRITICAL | 9.1 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible | Jul 23, 2026 |
| CVE-2026-65906 | HIGH | 8.8 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible | Jul 23, 2026 |
| CVE-2026-15037 | UNKNOWN | — | Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an … | Jul 23, 2026 |
| CVE-2026-65897 | HIGH | 8.8 | Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that … | Jul 23, 2026 |
| CVE-2026-65896 | HIGH | 7.1 | Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only … | Jul 23, 2026 |