Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51856
Total
4111
Critical
15381
High
15070
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-53994 | HIGH | 7.5 | ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endian SFTP packet length without … | Jul 18, 2026 |
| CVE-2026-16151 | MEDIUM | 6.3 | A vulnerability has been found in CartoDB carto-api-client 0.5.29. This impacts the function addFilter of the file src/filters.ts. Such manipulation of the argument column leads … | Jul 18, 2026 |
| CVE-2026-16150 | MEDIUM | 6.3 | A vulnerability was found in RobinHerbots Inputmask up to 5.0.9. Affected by this issue is the function extendDefaults/extendDefinitions/extendAliases in the library lib/dependencyLibs/extend.js of the component … | Jul 18, 2026 |
| CVE-2026-16133 | MEDIUM | 5.0 | A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manipulation can … | Jul 18, 2026 |
| CVE-2026-16131 | MEDIUM | 6.3 | A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrecord.php. This manipulation of the argument … | Jul 18, 2026 |
| CVE-2026-16130 | MEDIUM | 4.4 | A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/builtin/path_utils.rs of the component write_file. … | Jul 18, 2026 |
| CVE-2026-16129 | MEDIUM | 5.3 | A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/actions/shell.py of the component Built-in … | Jul 18, 2026 |
| CVE-2026-16128 | HIGH | 7.3 | A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_request. … | Jul 18, 2026 |
| CVE-2026-16127 | HIGH | 7.3 | A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/tool_net.c of the component http_request. Such manipulation … | Jul 18, 2026 |
| CVE-2026-16126 | HIGH | 7.3 | A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the component Swarm … | Jul 18, 2026 |
| CVE-2026-16125 | HIGH | 7.3 | A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the component http_request. … | Jul 18, 2026 |
| CVE-2026-16124 | MEDIUM | 6.3 | A security vulnerability has been detected in nextlevelbuilder GoClaw up to 3.15.0-beta.32. This affects the function CheckSSRF/isPrivateIP of the file internal/tools/web_shared.go of the component web_fetch. … | Jul 18, 2026 |
| CVE-2026-16123 | MEDIUM | 6.3 | A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file internal/http/tools_invoke.go of the … | Jul 18, 2026 |
| CVE-2026-16122 | MEDIUM | 4.3 | A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of the file internal/tools/exec_approval.go. The … | Jul 18, 2026 |
| CVE-2026-16121 | MEDIUM | 6.3 | A vulnerability was identified in nextlevelbuilder GoClaw up to 3.13.2. Affected is the function isSafeBin of the file internal/tools/exec_approval.go. The manipulation leads to improper authorization. … | Jul 18, 2026 |
| CVE-2026-9323 | HIGH | 8.1 | The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which … | Jul 18, 2026 |
| CVE-2026-16120 | MEDIUM | 6.3 | A vulnerability was determined in nextlevelbuilder GoClaw up to 3.13.3-beta.3. This impacts the function matchesAllowlist/extractBin of the file internal/tools/exec_approval.go. Executing a manipulation can lead to … | Jul 18, 2026 |
| CVE-2026-16119 | MEDIUM | 6.3 | A vulnerability was found in nextlevelbuilder GoClaw up to 3.13.2. This affects the function RequestApproval of the file internal/tools/exec_approval.go of the component WebSocket Approval Endpoint. … | Jul 18, 2026 |
| CVE-2026-16117 | CRITICAL | 10.0 | Impact: @fastify/http-proxy versions up to and including 11.5.0 fail to rewrite the request prefix when the prefix segment is URL-encoded. Fastify's router URL-decodes paths for … | Jul 18, 2026 |
| CVE-2026-11826 | HIGH | 8.8 | OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a caller-supplied buffer with no size … | Jul 18, 2026 |
| CVE-2025-71398 | UNKNOWN | — | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers … | Jul 18, 2026 |
| CVE-2025-71397 | UNKNOWN | — | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root, namespace, or database level) … | Jul 18, 2026 |
| CVE-2025-71396 | UNKNOWN | — | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scripting … | Jul 18, 2026 |
| CVE-2025-71395 | UNKNOWN | — | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An … | Jul 18, 2026 |
| CVE-2025-71394 | UNKNOWN | — | SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the … | Jul 18, 2026 |