Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50129
Total
4051
Critical
14904
High
14658
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-69198 | UNKNOWN | — | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on … | Aug 03, 2026 |
| CVE-2026-69192 | UNKNOWN | — | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.3.1, Address4 accepts an octet written with a leading … | Aug 03, 2026 |
| CVE-2026-69185 | HIGH | 7.5 | Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait … | Aug 03, 2026 |
| CVE-2026-68981 | UNKNOWN | — | Apache NiFi 1.5.0 through 2.10.0 support gzip-encoded HTTP requests for the application REST API using a Jersey encoding filter. The framework enforced a configurable maximum … | Aug 03, 2026 |
| CVE-2026-68980 | UNKNOWN | — | Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against … | Aug 03, 2026 |
| CVE-2026-68979 | UNKNOWN | — | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating … | Aug 03, 2026 |
| CVE-2026-67599 | HIGH | 7.2 | ClearOS 7.9 contains an OS command injection vulnerability in the Log Viewer component that allows authenticated attackers to execute arbitrary commands by submitting unsanitized input … | Aug 03, 2026 |
| CVE-2026-67598 | HIGH | 7.4 | Emlog Pro through 2.6.23 contains a disabled TLS certificate validation vulnerability in include/service/ai.php that allows network-adjacent attackers to intercept outbound HTTPS requests to configured LLM … | Aug 03, 2026 |
| CVE-2026-66296 | UNKNOWN | — | Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.format_reason/4 and … | Aug 03, 2026 |
| CVE-2026-62354 | UNKNOWN | — | Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed … | Aug 03, 2026 |
| CVE-2026-58139 | MEDIUM | 6.5 | The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS … | Aug 03, 2026 |
| CVE-2026-48031 | CRITICAL | 9.1 | go-base is a Go RESTful API Boilerplate template with JWT Authentication, backed by PostgreSQL. In versions prior to 2026-05-18, the JWT signing secret is hardcoded … | Aug 03, 2026 |
| CVE-2026-47211 | UNKNOWN | — | Ouroboros is a local-first runtime for AI coding agents that records their actions and applies user-defined policies to constrain behavior. In versions prior to 0.39.0, … | Aug 03, 2026 |
| CVE-2026-18655 | MEDIUM | 6.5 | Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 may allow a remote unauthenticated … | Aug 03, 2026 |
| CVE-2026-18654 | MEDIUM | 6.8 | Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow … | Aug 03, 2026 |
| CVE-2026-18644 | MEDIUM | 5.4 | A vulnerability was identified in danpros HTMLy up to 3.1.1. Affected by this issue is the function unlink of the file /system/htmly.php of the component … | Aug 03, 2026 |
| CVE-2026-18641 | HIGH | 7.3 | A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.13. Affected by this vulnerability is the function com.sbr.fort.foreignDP.DpLoginController of the … | Aug 03, 2026 |
| CVE-2026-18632 | MEDIUM | 6.3 | A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinja2_transformer.py of the component … | Aug 03, 2026 |
| CVE-2026-18631 | MEDIUM | 6.3 | A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. … | Aug 03, 2026 |
| CVE-2026-59913 | HIGH | 7.8 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain a Missing Authentication for Critical Function vulnerability. A low privileged attacker with local … | Aug 03, 2026 |
| CVE-2026-59912 | HIGH | 7.8 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3.0.1005, contain an Improper Access Control vulnerability. A low privileged attacker with local access could … | Aug 03, 2026 |
| CVE-2026-38447 | CRITICAL | 9.8 | osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current … | Aug 03, 2026 |
| CVE-2026-38446 | MEDIUM | 6.1 | A stored cross-site scripting (XSS) vulnerability exists in osTicket 1.18.3 due to improper sanitization of the thread entry title field. User-controlled input in the title … | Aug 03, 2026 |
| CVE-2026-38444 | MEDIUM | 6.1 | osTicket v1.18.3 is vulnerable to Stored Cross-Site Scripting (XSS) via the email From-header display name. The value is extracted without sanitization in include/class.mailparse.php and stored … | Aug 03, 2026 |
| CVE-2026-18616 | CRITICAL | 9.8 | A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.set_peer of the file /cgi-bin/glc of the component wg-server.so … | Aug 03, 2026 |