Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51698
Total
4098
Critical
15338
High
14987
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-40691 | HIGH | 7.5 | In Unbound 1.9.0 up to and including 1.25.1, when a DNSCrypt query is received over TCP, the routine that encrypts the reply in place fails … | Jul 22, 2026 |
| CVE-2026-32665 | HIGH | 7.5 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC (DoQ) is enabled, the first two bidirectional streams on a new QUIC … | Jul 22, 2026 |
| CVE-2026-16560 | MEDIUM | 5.3 | A heap-buffer-overflow flaw was found in Directory Server (389-ds-base). When a DN contains a legacy-quoted value, the server won't close the heap allocation allowing another … | Jul 22, 2026 |
| CVE-2026-16232 | CRITICAL | 9.1 | An authentication bypass vulnerability in the Check Point SmartConsole login process allows an unauthenticated remote attacker to obtain an application login token and use it … | Jul 22, 2026 |
| CVE-2026-14932 | MEDIUM | 6.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension … | Jul 22, 2026 |
| CVE-2026-14865 | MEDIUM | 5.3 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service … | Jul 22, 2026 |
| CVE-2026-14586 | MEDIUM | 5.9 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic … | Jul 22, 2026 |
| CVE-2026-13192 | MEDIUM | 6.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker … | Jul 22, 2026 |
| CVE-2026-13190 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which … | Jul 22, 2026 |
| CVE-2026-13189 | HIGH | 7.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to … | Jul 22, 2026 |
| CVE-2026-13188 | MEDIUM | 5.9 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation. | Jul 22, 2026 |
| CVE-2026-13187 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation. | Jul 22, 2026 |
| CVE-2026-13186 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage … | Jul 22, 2026 |
| CVE-2026-13185 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code … | Jul 22, 2026 |
| CVE-2026-13184 | HIGH | 7.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall … | Jul 22, 2026 |
| CVE-2026-13183 | HIGH | 7.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to … | Jul 22, 2026 |
| CVE-2026-13182 | HIGH | 7.5 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals … | Jul 22, 2026 |
| CVE-2026-13181 | HIGH | 8.1 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code … | Jul 22, 2026 |
| CVE-2026-8152 | UNKNOWN | — | Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, … | Jul 22, 2026 |
| CVE-2026-44191 | HIGH | 7.8 | A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptions and … | Jul 22, 2026 |
| CVE-2026-16270 | UNKNOWN | — | Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When … | Jul 22, 2026 |
| CVE-2026-65603 | HIGH | 8.8 | The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike the … | Jul 22, 2026 |
| CVE-2026-65602 | UNKNOWN | — | Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for … | Jul 22, 2026 |
| CVE-2026-65601 | UNKNOWN | — | Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Traefik used the backend Service namespace … | Jul 22, 2026 |
| CVE-2026-65600 | UNKNOWN | — | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When … | Jul 22, 2026 |