Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
23813
Total
1705
Critical
7468
High
7599
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-13769 | MEDIUM | 5.5 | Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict … | Jul 01, 2026 |
| CVE-2026-13760 | HIGH | 7.3 | OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version … | Jul 01, 2026 |
| CVE-2026-5051 | MEDIUM | 4.4 | HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path … | Jul 01, 2026 |
| CVE-2026-58521 | UNKNOWN | — | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This … | Jul 01, 2026 |
| CVE-2026-58520 | UNKNOWN | — | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener … | Jul 01, 2026 |
| CVE-2026-57737 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme allows DOM-Based XSS. This … | Jul 01, 2026 |
| CVE-2026-57736 | HIGH | 7.4 | Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51. | Jul 01, 2026 |
| CVE-2026-57723 | HIGH | 7.4 | Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: … | Jul 01, 2026 |
| CVE-2026-57722 | MEDIUM | 5.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This issue affects Enable Media Replace: … | Jul 01, 2026 |
| CVE-2026-54428 | HIGH | 7.5 | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote … | Jul 01, 2026 |
| CVE-2026-51946 | MEDIUM | 6.5 | SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type … | Jul 01, 2026 |
| CVE-2026-49091 | HIGH | 8.0 | Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that … | Jul 01, 2026 |
| CVE-2026-49090 | MEDIUM | 6.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted … | Jul 01, 2026 |
| CVE-2026-46680 | UNKNOWN | — | containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be … | Jul 01, 2026 |
| CVE-2026-58454 | HIGH | 7.5 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing … | Jul 01, 2026 |
| CVE-2026-58453 | CRITICAL | 9.8 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default … | Jul 01, 2026 |
| CVE-2026-58452 | HIGH | 8.8 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by supplying … | Jul 01, 2026 |
| CVE-2026-57721 | MEDIUM | 5.3 | Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ApplyOnline: from n/a through 2.6.7.6. | Jul 01, 2026 |
| CVE-2026-57720 | MEDIUM | 4.3 | Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ThumbPress: from n/a through 6.3.2. | Jul 01, 2026 |
| CVE-2026-57516 | HIGH | 8.8 | Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious … | Jul 01, 2026 |
| CVE-2026-56152 | MEDIUM | 5.3 | Incorrect Authorization (CWE-863) in Elastic Defend can lead to unauthorized information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Under certain conditions, a … | Jul 01, 2026 |
| CVE-2026-56151 | MEDIUM | 6.5 | Improper Input Validation (CWE-20) in Kibana can lead to a denial of service via Input Data Manipulation (CAPEC-153). An authenticated user can submit a specially … | Jul 01, 2026 |
| CVE-2026-56150 | MEDIUM | 6.5 | Allocation of Resources Without Limits or Throttling (CWE-770) in Fleet Server can lead to a denial of service via Excessive Allocation (CAPEC-130). An attacker can … | Jul 01, 2026 |
| CVE-2026-56149 | MEDIUM | 4.9 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). A user with elevated … | Jul 01, 2026 |
| CVE-2026-56148 | MEDIUM | 6.5 | Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted query … | Jul 01, 2026 |