Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
45339
Total
3649
Critical
13458
High
13386
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-71879 | UNKNOWN | — | Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain … | Aug 18, 2026 |
| CVE-2026-71878 | UNKNOWN | — | Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers … | Aug 18, 2026 |
| CVE-2026-71551 | HIGH | 7.8 | Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. Prior to 18.13.0, the EXEC IPC handler in electron/ipc-handlers/exec.ts accepts … | Aug 18, 2026 |
| CVE-2026-69160 | MEDIUM | 6.5 | OpenList a file list program that supports multiple storage. Prior to 4.2.4, the share creation and update checks in server/handles/sharing.go use strings.HasPrefix(requested_path, user.BasePath) without enforcing … | Aug 18, 2026 |
| CVE-2026-68927 | LOW | 3.0 | MobSF is a mobile application security testing tool used. Prior to 4.5.1, get_browsable_activities in mobsf/StaticAnalyzer/views/android/manifest_analysis.py validates only an Android manifest android:host value with valid_host before … | Aug 18, 2026 |
| CVE-2026-68924 | MEDIUM | 4.9 | MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is … | Aug 18, 2026 |
| CVE-2026-68923 | MEDIUM | 6.5 | MobSF is a mobile application security testing tool used. Prior to 4.5.1, mobsf/MobSF/settings.py places django.middleware.csrf.CsrfViewMiddleware only in the deprecated MIDDLEWARE_CLASSES setting and omits it from … | Aug 18, 2026 |
| CVE-2026-68922 | MEDIUM | 5.5 | MobSF is a mobile application security testing tool used. Prior to 4.5.1, find_icon_path_zip in mobsf/StaticAnalyzer/views/android/icon_analysis.py uses the Android manifest android:icon value to construct paths under … | Aug 18, 2026 |
| CVE-2026-67921 | UNKNOWN | — | Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker … | Aug 18, 2026 |
| CVE-2026-67920 | UNKNOWN | — | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components | Aug 18, 2026 |
| CVE-2026-67846 | UNKNOWN | — | Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates … | Aug 18, 2026 |
| CVE-2026-67262 | HIGH | 8.1 | Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to … | Aug 18, 2026 |
| CVE-2026-66780 | CRITICAL | 9.9 | A flaw was found in the submariner-operator component. The `submariner-k8s-broker-cluster` Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster … | Aug 18, 2026 |
| CVE-2026-63643 | UNKNOWN | — | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR handler in defaultmodules/calendar/node_helper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert … | Aug 18, 2026 |
| CVE-2026-63642 | UNKNOWN | — | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed … | Aug 18, 2026 |
| CVE-2026-63641 | UNKNOWN | — | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, MagicMirror applies ipWhitelist only as Express middleware, while the Socket.IO server in js/server.js … | Aug 18, 2026 |
| CVE-2026-63640 | MEDIUM | 4.3 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound … | Aug 18, 2026 |
| CVE-2026-61696 | MEDIUM | 6.3 | Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[message] is stored without sanitization and rendered … | Aug 18, 2026 |
| CVE-2026-54570 | MEDIUM | 6.9 | AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point … | Aug 18, 2026 |
| CVE-2026-54552 | HIGH | 7.9 | sh provides Python process launching. Prior to 2.2.4, the _uid option in sh.py performs an incomplete privilege drop on Linux and Unix-like systems. When sh … | Aug 18, 2026 |
| CVE-2026-53533 | UNKNOWN | — | aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.1, SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied addresses without rejecting embedded CR … | Aug 18, 2026 |
| CVE-2026-52610 | UNKNOWN | — | An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the … | Aug 18, 2026 |
| CVE-2026-52609 | MEDIUM | 6.1 | A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by … | Aug 18, 2026 |
| CVE-2026-52608 | UNKNOWN | — | An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report … | Aug 18, 2026 |
| CVE-2026-52607 | UNKNOWN | — | A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the … | Aug 18, 2026 |