Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
49165
Total
3939
Critical
14577
High
14341
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-68090 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 … | Aug 10, 2026 |
| CVE-2026-68089 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: iio: core: fix uninitialized data in debugfs If *ppos is non-zero then simple_write_to_buffer() will not … | Aug 10, 2026 |
| CVE-2026-68088 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength … | Aug 10, 2026 |
| CVE-2026-68087 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: use GFP_ATOMIC in wacom_wac_queue_flush() wacom_wac_queue_flush() is called via the .raw_event callback (wacom_raw_event → … | Aug 10, 2026 |
| CVE-2026-68086 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: write all dirty file folios when collapsing [There is no upstream commit, as this … | Aug 10, 2026 |
| CVE-2026-68085 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled HCI_UART_SENDING bit in tx_state means write_work is … | Aug 10, 2026 |
| CVE-2026-68084 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: fix location monitor leak in tsi148 bridge tsi148_probe() allocates a location monitor resource … | Aug 10, 2026 |
| CVE-2026-68083 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbd_vfs_kern_path_create The SMB2 open lookup is rooted at the share … | Aug 10, 2026 |
| CVE-2026-64941 | UNKNOWN | — | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in phoenixframework phoenix_live_view allows an attacker to send a victim's browser to an origin of the attacker's … | Aug 10, 2026 |
| CVE-2026-59088 | MEDIUM | 5.5 | A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to … | Aug 10, 2026 |
| CVE-2026-72594 | HIGH | 7.6 | A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a … | Aug 10, 2026 |
| CVE-2026-72593 | CRITICAL | 9.8 | A missing authentication vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to access the full file manager functionality including reading, writing, deleting, and … | Aug 10, 2026 |
| CVE-2026-72592 | CRITICAL | 9.8 | An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships … | Aug 10, 2026 |
| CVE-2026-72591 | HIGH | 7.7 | A server-side request forgery (SSRF) vulnerability in gabehf/Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or … | Aug 10, 2026 |
| CVE-2026-72590 | CRITICAL | 9.8 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to inject arbitrary cron job entries by sending a crafted GET … | Aug 10, 2026 |
| CVE-2026-72589 | CRITICAL | 9.8 | An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database … | Aug 10, 2026 |
| CVE-2026-72588 | MEDIUM | 5.3 | A user enumeration vulnerability in bluewave-labs/Checkmate through 2.1.0 allows an unauthenticated remote attacker to determine whether a given email address is registered. The POST /api/v1/auth/recovery/request … | Aug 10, 2026 |
| CVE-2026-72587 | MEDIUM | 6.1 | A cache poisoning vulnerability in CoreBunch/Instatic through 0.0.14 allows an unauthenticated remote attacker to poison the shared process-wide render cache by manipulating the u query … | Aug 10, 2026 |
| CVE-2026-72586 | HIGH | 7.5 | A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When … | Aug 10, 2026 |
| CVE-2026-72585 | MEDIUM | 6.5 | An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission. | Aug 10, 2026 |
| CVE-2026-72584 | HIGH | 7.4 | A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, … | Aug 10, 2026 |
| CVE-2026-72583 | MEDIUM | 5.4 | A stored cross-site scripting (XSS) vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing … | Aug 10, 2026 |
| CVE-2026-72582 | HIGH | 7.5 | A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The … | Aug 10, 2026 |
| CVE-2026-72581 | HIGH | 8.6 | A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to … | Aug 10, 2026 |
| CVE-2026-72580 | CRITICAL | 9.8 | An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the … | Aug 10, 2026 |