Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51667
Total
4097
Critical
15338
High
14987
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-14586 | MEDIUM | 5.9 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic … | Jul 22, 2026 |
| CVE-2026-13192 | MEDIUM | 6.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker … | Jul 22, 2026 |
| CVE-2026-13190 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which … | Jul 22, 2026 |
| CVE-2026-13189 | HIGH | 7.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to … | Jul 22, 2026 |
| CVE-2026-13188 | MEDIUM | 5.9 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation. | Jul 22, 2026 |
| CVE-2026-13187 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation. | Jul 22, 2026 |
| CVE-2026-13186 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage … | Jul 22, 2026 |
| CVE-2026-13185 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code … | Jul 22, 2026 |
| CVE-2026-13184 | HIGH | 7.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall … | Jul 22, 2026 |
| CVE-2026-13183 | HIGH | 7.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to … | Jul 22, 2026 |
| CVE-2026-13182 | HIGH | 7.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals … | Jul 22, 2026 |
| CVE-2026-13181 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code … | Jul 22, 2026 |
| CVE-2026-8152 | UNKNOWN | — | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, … | Jul 22, 2026 |
| CVE-2026-44191 | HIGH | 7.8 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and … | Jul 22, 2026 |
| CVE-2026-16270 | UNKNOWN | — | Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When … | Jul 22, 2026 |
| CVE-2026-65603 | HIGH | 8.8 | The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the … | Jul 22, 2026 |
| CVE-2026-65602 | UNKNOWN | — | Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for … | Jul 22, 2026 |
| CVE-2026-65601 | UNKNOWN | — | Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace … | Jul 22, 2026 |
| CVE-2026-65600 | UNKNOWN | — | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When … | Jul 22, 2026 |
| CVE-2026-65599 | UNKNOWN | — | n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key … | Jul 22, 2026 |
| CVE-2026-65598 | UNKNOWN | — | n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions … | Jul 22, 2026 |
| CVE-2026-65597 | UNKNOWN | — | n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an … | Jul 22, 2026 |
| CVE-2026-65596 | UNKNOWN | — | n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) … | Jul 22, 2026 |
| CVE-2026-65595 | UNKNOWN | — | n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. … | Jul 22, 2026 |
| CVE-2026-65594 | UNKNOWN | — | n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the … | Jul 22, 2026 |