Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
52066
Total
4132
Critical
15433
High
15137
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-63089 | CRITICAL | 9.3 | WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard … | Jul 16, 2026 |
| CVE-2026-62994 | LOW | 3.7 | CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can … | Jul 16, 2026 |
| CVE-2026-62963 | UNKNOWN | — | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uni_websocket.compression enabled enforced uni_websocket.message_size_limit against compressed wire-frame length in … | Jul 16, 2026 |
| CVE-2026-62309 | HIGH | 7.5 | CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin … | Jul 16, 2026 |
| CVE-2026-62299 | MEDIUM | 5.3 | CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and … | Jul 16, 2026 |
| CVE-2026-62290 | HIGH | 7.3 | cert-manager adds certificates and certificate issuers as resource types in Kubernetes clusters, and simplifies the process of obtaining, renewing and using those certificates. From 1.18.0 … | Jul 16, 2026 |
| CVE-2026-61718 | MEDIUM | 5.4 | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ … | Jul 16, 2026 |
| CVE-2026-61389 | HIGH | 7.0 | An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in … | Jul 16, 2026 |
| CVE-2026-60140 | MEDIUM | 6.1 | An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a crafted IOCTL request. This can … | Jul 16, 2026 |
| CVE-2026-60063 | HIGH | 7.0 | An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in … | Jul 16, 2026 |
| CVE-2026-55629 | UNKNOWN | — | Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMP_FILES_PATH only … | Jul 16, 2026 |
| CVE-2026-54728 | UNKNOWN | — | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb … | Jul 16, 2026 |
| CVE-2026-49998 | HIGH | 8.2 | Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.1, Centrifugo dynamic JWKS endpoint verification could reuse a key for one allowed issuer to … | Jul 16, 2026 |
| CVE-2026-44982 | HIGH | 7.2 | CrowdSec offers crowdsourced protection against malicious IPs. From 1.5.0 until 1.7.8, pkg/appsec/request.go NewParsedRequestFromRequest allocated a request body buffer from max(r.ContentLength, 0), so HTTP/1.1 requests using … | Jul 16, 2026 |
| CVE-2026-44981 | UNKNOWN | — | CrowdSec offers crowdsourced protection against malicious IPs. From 1.7.0 until 1.7.8, the LAPI router used gin-contrib/gzip with DefaultDecompressHandle globally in pkg/apiserver/controllers/controller.go, causing /v1/watchers and /v1/watchers/login … | Jul 16, 2026 |
| CVE-2026-15449 | UNKNOWN | — | A time-of-check to time-of-use (TOCTOU) flaw in the illumos data-link pseudo-driver (dld) affects handling of the DLDIOC_GETMACPROP and DLDIOC_SETMACPROP ioctls on /dev/dld. drv_ioc_prop_common() in usr/src/uts/common/io/dld/dld_drv.c … | Jul 16, 2026 |
| CVE-2026-15422 | UNKNOWN | — | The illumos SCTP inbound path performs association lookup for INIT ACK chunks without adequately validating the address parameters carried in the chunk. Since this lookup … | Jul 16, 2026 |
| CVE-2026-15352 | HIGH | 7.5 | A vulnerability exists in the Health & Safety (HS) application of NASA's Core Flight System (cFS). The flaw allows the application to crash via segmentation … | Jul 16, 2026 |
| CVE-2026-54526 | UNKNOWN | — | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6, the allow-list fix for CVE-2026-31892 … | Jul 16, 2026 |
| CVE-2026-53536 | UNKNOWN | — | Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /v1/step-files/signed download endpoint verified the supplied JWT against the shared signing secret … | Jul 16, 2026 |
| CVE-2026-53535 | UNKNOWN | — | Activepieces is an open source AI workflow automation platform. Prior to 0.82.0, the git-sync feature clones a user-configured Git repository into a temporary directory on … | Jul 16, 2026 |
| CVE-2026-47089 | MEDIUM | 4.3 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call … | Jul 16, 2026 |
| CVE-2026-47088 | LOW | 3.1 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could … | Jul 16, 2026 |
| CVE-2026-47087 | LOW | 3.5 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer … | Jul 16, 2026 |
| CVE-2026-47086 | LOW | 3.5 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via … | Jul 16, 2026 |