Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
49732
Total
4014
Critical
14766
High
14490
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-71249 | MEDIUM | 6.1 | 299Ko's public contact form (plugin/contact/controllers/ContactController.php, home()) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's … | Aug 05, 2026 |
| CVE-2026-71248 | CRITICAL | 9.8 | Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: $sql = "select * from user where email = '$email' and … | Aug 05, 2026 |
| CVE-2026-71247 | MEDIUM | 6.5 | Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed … | Aug 05, 2026 |
| CVE-2026-71246 | MEDIUM | 4.3 | Pixelfed's SearchController (behind the auth middleware) accepts a URL via its remote-search parameters and fetches it server-side through ActivityPubFetchService, whose validateUrl() only blocks the literal … | Aug 05, 2026 |
| CVE-2026-71245 | HIGH | 7.1 | Mautic's getLeadIdsByFieldValueAction (LeadBundle/Controller/AjaxController.php) reads a field parameter from the request, sanitizes it only with InputHelper::clean() (which HTML-entity-encodes quotes and angle brackets but does not restrict … | Aug 05, 2026 |
| CVE-2026-71244 | MEDIUM | 6.5 | Paperless-ngx's MailAccountViewSet.test() action, when called with an existing account's ID and a masked password field, reuses the stored password, account_type, refresh_token, and expiration from that … | Aug 05, 2026 |
| CVE-2026-71243 | HIGH | 8.8 | The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " … | Aug 05, 2026 |
| CVE-2026-71242 | HIGH | 8.3 | Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify $user->hasCompany($model->company_id). … | Aug 05, 2026 |
| CVE-2026-71241 | HIGH | 7.5 | Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. … | Aug 05, 2026 |
| CVE-2026-71240 | MEDIUM | 4.3 | DjangoCRM's toggle_default_sorting view is the only route in common/urls.py that is not wrapped in login_required or staff_member_required, and it redirects to a caller-supplied next_url GET … | Aug 05, 2026 |
| CVE-2026-71239 | HIGH | 8.1 | DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template() constructor with no sanitization, in at least three locations: message_previews.py builds an f-string … | Aug 05, 2026 |
| CVE-2026-71238 | CRITICAL | 9.1 | DjangoCRM ships with its Django SECRET_KEY hardcoded directly in the committed webcrm/settings.py rather than read from an environment variable. Since this key is used for … | Aug 05, 2026 |
| CVE-2026-71237 | CRITICAL | 9.8 | Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from $_POST['pwd'] with no sanitization and concatenates it into a raw SQL string: … | Aug 05, 2026 |
| CVE-2026-71236 | HIGH | 8.7 | Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing <, >, … | Aug 05, 2026 |
| CVE-2026-71235 | HIGH | 8.8 | Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine … | Aug 05, 2026 |
| CVE-2026-71234 | HIGH | 7.5 | Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a `secure` query parameter and grants access whenever the … | Aug 05, 2026 |
| CVE-2026-71233 | HIGH | 8.7 | InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! $entity->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no … | Aug 05, 2026 |
| CVE-2026-71232 | HIGH | 7.2 | MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, … | Aug 05, 2026 |
| CVE-2026-71231 | CRITICAL | 9.8 | IOTSmartHome's gui/login.php checkCookie() function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode(), … | Aug 05, 2026 |
| CVE-2026-66747 | CRITICAL | 9.8 | Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built … | Aug 05, 2026 |
| CVE-2026-60009 | HIGH | 8.8 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute … | Aug 05, 2026 |
| CVE-2026-17578 | UNKNOWN | — | Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limit for AES-GCM encryption … | Aug 05, 2026 |
| CVE-2026-14574 | UNKNOWN | — | In Eclipse Theia versions 0.7.0 and up until including 1.73.1, the `PreferenceUtils.merge` function in `@theia/core` recursively merges preference values without rejecting prototype-related keys (`__proto__`, `constructor`, … | Aug 05, 2026 |
| CVE-2026-14304 | UNKNOWN | — | In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to … | Aug 05, 2026 |
| CVE-2026-12609 | HIGH | 7.5 | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend exposes the `/hostedPlugin/:pluginId/:path(*)` HTTP endpoint, which resolves the requested file path with … | Aug 05, 2026 |