Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
47587
Total
3849
Critical
14223
High
13906
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-19826 | HIGH | 7.3 | A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The … | Aug 14, 2026 |
| CVE-2026-19825 | HIGH | 7.3 | A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_service. The … | Aug 14, 2026 |
| CVE-2026-19824 | HIGH | 8.8 | A weakness has been identified in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the … | Aug 14, 2026 |
| CVE-2026-19823 | HIGH | 8.8 | A security flaw has been discovered in Tenda W20E 15.11.0.6(1068_1546_841)_CN_TDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. … | Aug 14, 2026 |
| CVE-2026-73630 | MEDIUM | 5.8 | SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never … | Aug 14, 2026 |
| CVE-2026-73051 | UNKNOWN | — | actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated … | Aug 14, 2026 |
| CVE-2026-73049 | MEDIUM | 5.8 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when … | Aug 14, 2026 |
| CVE-2026-73048 | MEDIUM | 5.8 | SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can … | Aug 14, 2026 |
| CVE-2026-72859 | HIGH | 7.7 | Budibase versions 3.39.4 before 3.40.0 contain an authorization regression in the S3 attachment upload endpoint that allows BASIC users to obtain S3 PutObject presigned URLs … | Aug 14, 2026 |
| CVE-2026-72838 | MEDIUM | 6.5 | FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. … | Aug 14, 2026 |
| CVE-2026-72837 | HIGH | 8.8 | File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, … | Aug 14, 2026 |
| CVE-2026-72836 | HIGH | 8.1 | FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root … | Aug 14, 2026 |
| CVE-2026-72835 | MEDIUM | 6.8 | filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. … | Aug 14, 2026 |
| CVE-2026-72834 | MEDIUM | 4.3 | filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksum=) branch of resourceGetHandler reads the entire file to compute a digest … | Aug 14, 2026 |
| CVE-2026-72833 | HIGH | 8.8 | The Grav API plugin (getgrav/grav-plugin-api) versions >= 1.0.6 and <= 1.0.11 contain a privilege escalation vulnerability. A scoped API key minted on a super-admin account … | Aug 14, 2026 |
| CVE-2026-72832 | MEDIUM | 5.4 | Grav versions from 1.5.2 through 2.0.12 contain a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). The event-handler scan is anchored at `<` and … | Aug 14, 2026 |
| CVE-2026-72831 | HIGH | 8.8 | The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general … | Aug 14, 2026 |
| CVE-2026-72830 | CRITICAL | 9.8 | Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers … | Aug 14, 2026 |
| CVE-2026-72829 | CRITICAL | 9.8 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope-cap bypass in UsersController's create() and update() methods. These methods enforce the scope cap only … | Aug 14, 2026 |
| CVE-2026-72828 | HIGH | 7.2 | Grav Plugin API (getgrav/grav-plugin-api) before 1.0.13 fails to enforce API-key scope caps in InvitationsController. The strip-super and accept-groups decisions are gated on a bare isSuperAdmin() … | Aug 14, 2026 |
| CVE-2026-72827 | HIGH | 8.8 | Grav CMS before 2.0.13 contains a server-side template injection vulnerability in email-action parameters that allows low-privileged page editors to execute arbitrary operating-system commands. Attackers can … | Aug 14, 2026 |
| CVE-2026-72826 | CRITICAL | 9.8 | The getgrav/grav-plugin-api plugin before 1.0.13 fails to validate that the scopes of a newly created API key are a subset of the caller's scopes in … | Aug 14, 2026 |
| CVE-2026-72825 | HIGH | 7.6 | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare … | Aug 14, 2026 |
| CVE-2026-72824 | CRITICAL | 9.8 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API key scope-cap bypass in PagesController::guardTwigContent(). The Twig-toggle check uses a bare isSuperAdmin() gate that does … | Aug 14, 2026 |
| CVE-2026-72823 | MEDIUM | 5.4 | The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before … | Aug 14, 2026 |