Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
52841
Total
4211
Critical
15646
High
15361
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-56329 | MEDIUM | 6.4 | Capgo before 12.128.2 contains a cross-tenant preview namespace collision vulnerability caused by non-bijective decoding of double underscores to dots in preview hostname parsing. Attackers can … | Jul 10, 2026 |
| CVE-2026-56312 | MEDIUM | 6.5 | Capgo before 12.128.2 contains an improper validation vulnerability in the accept_invitation endpoint that creates user accounts before captcha validation is enforced. Attackers can bypass captcha … | Jul 10, 2026 |
| CVE-2026-56309 | MEDIUM | 5.4 | Capgo before 12.128.2 fails to enforce plan/quota restrictions on the /files/upload/attachments endpoint, allowing plan-blocked apps to create publicly readable R2 objects. Attackers can upload arbitrary … | Jul 10, 2026 |
| CVE-2026-56305 | HIGH | 8.3 | Capgo before 12.128.2 contains an authentication bypass vulnerability in the password change endpoint that allows attackers to change user passwords without requiring current password confirmation. … | Jul 10, 2026 |
| CVE-2026-56279 | HIGH | 7.5 | Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can … | Jul 10, 2026 |
| CVE-2026-56261 | HIGH | 8.6 | Crawl4AI before 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination … | Jul 10, 2026 |
| CVE-2026-56254 | HIGH | 7.0 | In @capgo/capacitor-updater (Cap-go/capgo) before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can … | Jul 10, 2026 |
| CVE-2026-38059 | HIGH | 7.5 | The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including … | Jul 10, 2026 |
| CVE-2026-38057 | HIGH | 8.1 | The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session … | Jul 10, 2026 |
| CVE-2026-29519 | HIGH | 8.2 | Lucee CFML Server versions across the 5.3.x, 6.1.x, 6.2.x, and 7.0.x release lines contain a reflected cross-site scripting vulnerability in URL path parsing that allows … | Jul 10, 2026 |
| CVE-2026-22660 | HIGH | 7.2 | FlaskBB through 2.2.0, fixed in commit a5da9a5, contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups by exploiting a … | Jul 10, 2026 |
| CVE-2026-22659 | HIGH | 8.1 | FlaskBB through 2.2.0, fixed in commit acc88cf, contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they … | Jul 10, 2026 |
| CVE-2025-12127 | UNKNOWN | — | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this … | Jul 10, 2026 |
| CVE-2026-56813 | UNKNOWN | — | Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds … | Jul 10, 2026 |
| CVE-2026-54470 | MEDIUM | 5.3 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior contain(s) an Improper Restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access … | Jul 10, 2026 |
| CVE-2026-54469 | HIGH | 8.8 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a Deserialization of Untrusted Data vulnerability. A low privileged attacker with remote access could potentially exploit … | Jul 10, 2026 |
| CVE-2026-56814 | UNKNOWN | — | Plug.Parsers.MULTIPART, the multipart request-body parser used to handle file uploads and multipart forms, does not enforce its :length budget against all consumed resources, allowing an … | Jul 10, 2026 |
| CVE-2026-56690 | HIGH | 8.5 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged … | Jul 10, 2026 |
| CVE-2026-56689 | HIGH | 7.7 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged … | Jul 10, 2026 |
| CVE-2026-56688 | CRITICAL | 9.1 | Dell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high … | Jul 10, 2026 |
| CVE-2026-54468 | MEDIUM | 6.5 | Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, contain(s) a path traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability … | Jul 10, 2026 |
| CVE-2026-53363 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: preserve shared-frag marker in iptfs_consume_frags() iptfs_consume_frags() transfers paged fragments from one socket buffer … | Jul 10, 2026 |
| CVE-2026-58225 | UNKNOWN | — | SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the reconnect replay query, causing … | Jul 10, 2026 |
| CVE-2026-14461 | UNKNOWN | — | mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this … | Jul 10, 2026 |
| CVE-2026-9857 | MEDIUM | 4.3 | The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not … | Jul 10, 2026 |