Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
26383
Total
1955
Critical
7969
High
8219
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-12863 | UNKNOWN | — | An unvalidated redirect was contained in Venueless' social login functionality and could be exploited for phishing using trusted domains. | Jun 22, 2026 |
| CVE-2026-12862 | UNKNOWN | — | Untrusted user data was passed verbatim to Excel exports for administrators. This allowed formula injection which can be used to compromise the environment of the … | Jun 22, 2026 |
| CVE-2026-12581 | HIGH | 7.5 | EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID for a user, they can gain … | Jun 22, 2026 |
| CVE-2026-12580 | MEDIUM | 5.4 | EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon … | Jun 22, 2026 |
| CVE-2025-4994 | UNKNOWN | — | The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows attackers to bypass authentication … | Jun 22, 2026 |
| CVE-2023-45796 | HIGH | 8.1 | A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged … | Jun 22, 2026 |
| CVE-2023-45795 | HIGH | 7.8 | A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full … | Jun 22, 2026 |
| CVE-2026-54665 | UNKNOWN | — | Apache NiFi 0.0.1 through 2.9.0 support building qualified URLs from one of several HTTP request headers that provide an alternative to the standard Host header … | Jun 22, 2026 |
| CVE-2026-44914 | UNKNOWN | — | Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions based on the Restricted annotation. … | Jun 22, 2026 |
| CVE-2026-44913 | UNKNOWN | — | Improper escaping of database table names in the CaptureChangeMySQL Processor included with Apache NiFi 1.2.0 through 2.9.0 allows for injecting SQL commands using crafted naming. … | Jun 22, 2026 |
| CVE-2026-44911 | UNKNOWN | — | Authorization handling for component configuration verification requests in Apache NiFi 1.15.0 through 2.9.0 allows clients with read access to submit proposed configuration properties. The proposed … | Jun 22, 2026 |
| CVE-2025-66336 | UNKNOWN | — | Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, … | Jun 22, 2026 |
| CVE-2025-62198 | UNKNOWN | — | An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which fixes … | Jun 22, 2026 |
| CVE-2026-8157 | UNKNOWN | — | The Vitepos WordPress plugin before 3.4.2 does not properly restrict the roles that can be assigned when creating new users via one of its REST … | Jun 22, 2026 |
| CVE-2026-7859 | UNKNOWN | — | The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers to modify … | Jun 22, 2026 |
| CVE-2026-6858 | UNKNOWN | — | The Transbank Webpay WordPress plugin before 1.14.0 does not sanitize and escape logs to be displayed, allowing unauthenticated users to perform Stored XSS attacks against … | Jun 22, 2026 |
| CVE-2026-4259 | UNKNOWN | — | The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site … | Jun 22, 2026 |
| CVE-2026-4110 | UNKNOWN | — | The ultimate-woocommerce-auction-pro WordPress plugin through 2.4.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site … | Jun 22, 2026 |
| CVE-2026-10530 | UNKNOWN | — | The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, allowing unauthenticated attackers to predict a … | Jun 22, 2026 |
| CVE-2026-6645 | UNKNOWN | — | An insecure process execution vulnerability exists in the pc-printer-updater.exe component of the PaperCut Print Deploy Client for Windows. The application, which typically operates with high-level … | Jun 22, 2026 |
| CVE-2026-8918 | UNKNOWN | — | A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash … | Jun 22, 2026 |
| CVE-2026-11748 | UNKNOWN | — | A vulnerability has been identified in centraldogma-server-auth-shiro versions prior to 0.84.0, where the SearchFirstActiveDirectoryRealm substitutes the login username into an LDAP search filter without neutralizing … | Jun 22, 2026 |
| CVE-2026-11746 | UNKNOWN | — | A vulnerability has been identified in centraldogma-server versions prior to 0.84.0, where enabling ZooKeeper replication without setting replication.secret causes the server to silently fall back … | Jun 22, 2026 |
| CVE-2026-11745 | UNKNOWN | — | A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// … | Jun 22, 2026 |
| CVE-2026-12823 | LOW | 3.3 | A security flaw has been discovered in Browserbase up to 20260526. This impacts an unknown function of the component Autobrowse Trace Artifact Handler. The manipulation … | Jun 22, 2026 |