Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50089
Total
4047
Critical
14897
High
14637
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-67616 | MEDIUM | 4.3 | Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-privileged user to create … | Aug 03, 2026 |
| CVE-2026-48115 | UNKNOWN | — | Misskey is an open source, federated social media platform. All Misskey servers running versions 2024.5.0 and later, but prior to 2026.5.4, contain a vulnerability in … | Aug 03, 2026 |
| CVE-2026-47746 | UNKNOWN | — | Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, are vulnerable to timing attacks during JSON-LD signature … | Aug 03, 2026 |
| CVE-2026-46714 | UNKNOWN | — | Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey … | Aug 03, 2026 |
| CVE-2026-46713 | UNKNOWN | — | Misskey is an open source, federated social media platform. Versions 12.37.0 and later, but prior to 2026.5.4, contain a vulnerability in the JSON-LD signature validation … | Aug 03, 2026 |
| CVE-2026-46712 | UNKNOWN | — | Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper … | Aug 03, 2026 |
| CVE-2026-18682 | LOW | 3.1 | A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload … | Aug 03, 2026 |
| CVE-2026-10849 | HIGH | 8.2 | The hawkBit device management client in subsys/mgmt/hawkbit accumulates the body of an HTTP response from the update server into a heap buffer in response_json_cb() (subsys/mgmt/hawkbit/hawkbit.c). … | Aug 03, 2026 |
| CVE-2026-69246 | HIGH | 7.2 | Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, Guzzle gives a transport the request URI as text and supplies the Host … | Aug 03, 2026 |
| CVE-2026-69245 | MEDIUM | 6.5 | Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetCookie::matchesDomain() recognizes … | Aug 03, 2026 |
| CVE-2026-69244 | UNKNOWN | — | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.3, an out-of-bounds heap read could occur in the C response parser … | Aug 03, 2026 |
| CVE-2026-69243 | UNKNOWN | — | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating … | Aug 03, 2026 |
| CVE-2026-69240 | CRITICAL | 9.8 | Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function … | Aug 03, 2026 |
| CVE-2026-67976 | UNKNOWN | — | The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS) via … | Aug 03, 2026 |
| CVE-2026-67972 | UNKNOWN | — | An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to contrl where received content and data is stored, possibly leading to an … | Aug 03, 2026 |
| CVE-2026-66065 | UNKNOWN | — | Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. Versions prior to 0.42.1 have … | Aug 03, 2026 |
| CVE-2026-52521 | UNKNOWN | — | A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature. | Aug 03, 2026 |
| CVE-2026-52520 | UNKNOWN | — | Emlog CMS <= 2.6.14 contains a stored cross-site scripting (XSS) vulnerability in the article publishing module (/admin/article.php). A remote authenticated attacker can inject arbitrary JavaScript … | Aug 03, 2026 |
| CVE-2026-52102 | UNKNOWN | — | An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters. | Aug 03, 2026 |
| CVE-2026-51775 | UNKNOWN | — | SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows an attacker to exectue arbitrary code via the application/common/controller/Backend.php component | Aug 03, 2026 |
| CVE-2026-51190 | UNKNOWN | — | The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the … | Aug 03, 2026 |
| CVE-2026-49132 | MEDIUM | 5.4 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate … | Aug 03, 2026 |
| CVE-2026-49131 | MEDIUM | 5.4 | OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers with firewall rule management privileges to inject arbitrary HTML or JavaScript by … | Aug 03, 2026 |
| CVE-2026-48113 | UNKNOWN | — | Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and … | Aug 03, 2026 |
| CVE-2026-48063 | UNKNOWN | — | Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious … | Aug 03, 2026 |