Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
49358
Total
3967
Critical
14633
High
14397
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-66370 | UNKNOWN | — | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already … | Aug 06, 2026 |
| CVE-2026-5423 | UNKNOWN | — | @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, … | Aug 06, 2026 |
| CVE-2026-53985 | HIGH | 7.5 | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly … | Aug 06, 2026 |
| CVE-2026-53977 | HIGH | 7.5 | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown … | Aug 06, 2026 |
| CVE-2026-43622 | HIGH | 7.8 | llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using malloc() while free_1batch() deallocates it … | Aug 06, 2026 |
| CVE-2026-3430 | HIGH | 8.6 | The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an … | Aug 06, 2026 |
| CVE-2026-19047 | MEDIUM | 5.3 | A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a … | Aug 06, 2026 |
| CVE-2026-19046 | LOW | 3.3 | A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted element is an unknown function of the file src/tools/ludusEnvironmentGuidesSearch.ts of the … | Aug 06, 2026 |
| CVE-2026-18427 | HIGH | 7.5 | @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it … | Aug 06, 2026 |
| CVE-2026-18359 | HIGH | 8.5 | Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server … | Aug 06, 2026 |
| CVE-2026-18277 | HIGH | 7.1 | Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another … | Aug 06, 2026 |
| CVE-2026-18276 | MEDIUM | 4.3 | Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe … | Aug 06, 2026 |
| CVE-2026-18275 | MEDIUM | 6.5 | Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against … | Aug 06, 2026 |
| CVE-2026-18258 | HIGH | 8.8 | Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and … | Aug 06, 2026 |
| CVE-2026-70646 | HIGH | 7.5 | aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. … | Aug 06, 2026 |
| CVE-2026-70637 | MEDIUM | 5.9 | LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands … | Aug 06, 2026 |
| CVE-2026-67261 | CRITICAL | 9.8 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated … | Aug 06, 2026 |
| CVE-2026-66712 | HIGH | 7.5 | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. | Aug 06, 2026 |
| CVE-2026-66711 | HIGH | 7.1 | Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. | Aug 06, 2026 |
| CVE-2026-66710 | HIGH | 8.1 | Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. | Aug 06, 2026 |
| CVE-2026-66709 | CRITICAL | 9.1 | Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. | Aug 06, 2026 |
| CVE-2026-66708 | HIGH | 8.2 | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. | Aug 06, 2026 |
| CVE-2026-66707 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions. | Aug 06, 2026 |
| CVE-2026-66706 | MEDIUM | 5.9 | Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions. | Aug 06, 2026 |
| CVE-2026-66705 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions. | Aug 06, 2026 |