Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
48821
Total
3921
Critical
14470
High
14211
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-16627 | HIGH | 7.7 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user … | Aug 12, 2026 |
| CVE-2026-15423 | HIGH | 8.5 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain … | Aug 12, 2026 |
| CVE-2026-73297 | UNKNOWN | — | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, … | Aug 12, 2026 |
| CVE-2026-73296 | CRITICAL | 9.4 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP services on … | Aug 12, 2026 |
| CVE-2026-73295 | MEDIUM | 5.4 | Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based … | Aug 12, 2026 |
| CVE-2026-73240 | CRITICAL | 9.8 | Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to … | Aug 12, 2026 |
| CVE-2026-73239 | MEDIUM | 6.5 | Insecure Direct Object Reference (IDOR) due to missing permission checks for multiple Artifact types in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users … | Aug 12, 2026 |
| CVE-2026-73238 | MEDIUM | 6.1 | XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes … | Aug 12, 2026 |
| CVE-2026-73237 | MEDIUM | 6.1 | XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, … | Aug 12, 2026 |
| CVE-2026-48554 | HIGH | 7.5 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to authenticated remote code execution via unfiltered NOTIFICATION-family macro substitution through the com_data parameter. … | Aug 12, 2026 |
| CVE-2026-48553 | HIGH | 7.5 | Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 are vulnerable to authenticated remote code execution via custom-variable macro injection through the Nagios Remote Data … | Aug 12, 2026 |
| CVE-2026-48552 | MEDIUM | 5.4 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields … | Aug 12, 2026 |
| CVE-2026-48551 | HIGH | 7.4 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 contain a cross-site request forgery protection bypass via a self-supplied double-submit cookie. An attacker can supply … | Aug 12, 2026 |
| CVE-2026-48550 | MEDIUM | 6.1 | Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to reflected cross-site scripting in cmd.cgi via the NagFormId parameter. An unauthenticated remote attacker … | Aug 12, 2026 |
| CVE-2026-18847 | HIGH | 8.8 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i. | Aug 12, 2026 |
| CVE-2026-18683 | HIGH | 8.8 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to privilege escalation via Navigator for i. An authenticated user could elevate privileges to a root … | Aug 12, 2026 |
| CVE-2026-18499 | HIGH | 8.1 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives. | Aug 12, 2026 |
| CVE-2026-18246 | LOW | 3.0 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to an interpretation conflict in the multipart … | Aug 12, 2026 |
| CVE-2026-18144 | MEDIUM | 4.3 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization. | Aug 12, 2026 |
| CVE-2026-18106 | MEDIUM | 4.3 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied path input. | Aug 12, 2026 |
| CVE-2026-18098 | HIGH | 8.1 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML … | Aug 12, 2026 |
| CVE-2026-17095 | HIGH | 8.3 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to unsafe reflection. | Aug 12, 2026 |
| CVE-2026-17094 | MEDIUM | 4.3 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and manipulate files due to a path traversal … | Aug 12, 2026 |
| CVE-2026-16694 | MEDIUM | 6.4 | IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in … | Aug 12, 2026 |
| CVE-2026-73325 | HIGH | 7.8 | Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as … | Aug 12, 2026 |