Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
45502
Total
3651
Critical
13471
High
13397
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-75080 | HIGH | 7.3 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_subject1.php. The … | Aug 18, 2026 |
| CVE-2026-75079 | HIGH | 7.3 | A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /edit_subject2.php. Executing a manipulation … | Aug 18, 2026 |
| CVE-2026-9693 | LOW | 3.5 | Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, … | Aug 17, 2026 |
| CVE-2026-75587 | LOW | 3.6 | Mattermost Desktop App versions <=6.2 6.2.2.0 fail to redact the pre-auth secret when generating a diagnostics report, which allows a local attacker with access to … | Aug 17, 2026 |
| CVE-2026-75078 | MEDIUM | 4.3 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a … | Aug 17, 2026 |
| CVE-2026-67961 | HIGH | 7.8 | An issue in O2OA v.10.0.2 allows a local attacker to execute arbitrary code via the the sandbox mechanism of the Invoke script execution. | Aug 17, 2026 |
| CVE-2026-67919 | CRITICAL | 9.8 | An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components | Aug 17, 2026 |
| CVE-2026-42164 | CRITICAL | 9.8 | Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to … | Aug 17, 2026 |
| CVE-2026-42162 | CRITICAL | 9.1 | Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a … | Aug 17, 2026 |
| CVE-2026-38165 | CRITICAL | 9.8 | A Server-Side Template Injection (SSTI) vulnerability in the Velocity template engine configuration of xdocreport v0.9.2 to v2.2.0 allows attackers to execute arbitrary code via a … | Aug 17, 2026 |
| CVE-2026-9859 | MEDIUM | 6.5 | Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows … | Aug 17, 2026 |
| CVE-2026-9816 | HIGH | 8.3 | Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a … | Aug 17, 2026 |
| CVE-2026-75077 | MEDIUM | 4.3 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such … | Aug 17, 2026 |
| CVE-2026-71424 | CRITICAL | 9.6 | Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header … | Aug 17, 2026 |
| CVE-2026-69148 | HIGH | 7.1 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or … | Aug 17, 2026 |
| CVE-2026-69146 | MEDIUM | 6.5 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from … | Aug 17, 2026 |
| CVE-2026-67960 | CRITICAL | 9.8 | An issue in PbootCMS v.3.2.15 allows an attacker to execute arbitrary code via the MemberController.php, UserController.php, CommentController.php, ContentController.php, and helper.php components | Aug 17, 2026 |
| CVE-2026-67918 | HIGH | 7.5 | Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint | Aug 17, 2026 |
| CVE-2026-67868 | CRITICAL | 9.8 | A heap-based out-of-bounds write vulnerability exists in S2OPC 1.7.3 in server-side EventFilter handling during CreateMonitoredItems processing. This allows a remote attacker to execute arbitrary code. | Aug 17, 2026 |
| CVE-2026-67854 | CRITICAL | 9.8 | SQL Injection vulnerability in Qcms v.6.0.6 allows a remote attacker to execute arbitrary code | Aug 17, 2026 |
| CVE-2026-65351 | MEDIUM | 4.3 | This issue was addressed through improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web … | Aug 17, 2026 |
| CVE-2026-65349 | MEDIUM | 6.6 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may … | Aug 17, 2026 |
| CVE-2026-65347 | MEDIUM | 6.5 | The issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead … | Aug 17, 2026 |
| CVE-2026-65346 | HIGH | 8.8 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image … | Aug 17, 2026 |
| CVE-2026-65343 | HIGH | 7.5 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. A … | Aug 17, 2026 |