Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50129
Total
4051
Critical
14904
High
14658
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-59646 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, DTLS handshake reassembler allocates buffer from unchecked 24-bit length. This issue also affects Bouncy Castle for Java LTS … | Aug 03, 2026 |
| CVE-2026-59645 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This issue also affects Bouncy Castle for … | Aug 03, 2026 |
| CVE-2026-59644 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender. | Aug 03, 2026 |
| CVE-2026-59643 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips … | Aug 03, 2026 |
| CVE-2026-59642 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content not bound to MAC when authAttrs present. This issue also affects Bouncy Castle for Java … | Aug 03, 2026 |
| CVE-2026-59641 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, S/MIME validator trusts signer-asserted signingTime for path validation. This issue also affects Bouncy Castle for Java LTS before … | Aug 03, 2026 |
| CVE-2026-59640 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before … | Aug 03, 2026 |
| CVE-2026-59639 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS … | Aug 03, 2026 |
| CVE-2026-59638 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, JSSE hostname verifier CN-fallback enabled by default despite documented opt-in. This issue also affects Bouncy Castle for Java … | Aug 03, 2026 |
| CVE-2026-18581 | LOW | 3.3 | A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja … | Aug 03, 2026 |
| CVE-2026-15055 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honour unbounded KDF cost from input. This issue also affects Bouncy Castle for Java … | Aug 03, 2026 |
| CVE-2026-12185 | UNKNOWN | — | In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This issue also affects Bouncy Castle for Java LTS … | Aug 03, 2026 |
| CVE-2026-3245 | HIGH | 7.5 | A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. | Aug 03, 2026 |
| CVE-2026-18577 | UNKNOWN | — | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 | Aug 02, 2026 |
| CVE-2026-10848 | HIGH | 7.0 | The OCPP 1.6 client in subsys/net/lib/ocpp parsed inbound WAMP RPC frames in parse_rpc_msg() (subsys/net/lib/ocpp/ocpp_j.c) using a hand-rolled helper, extract_string_field(), that copied the message's uid and … | Aug 02, 2026 |
| CVE-2026-9856 | HIGH | 7.1 | A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrained()` methods of … | Aug 02, 2026 |
| CVE-2026-65321 | CRITICAL | 9.8 | PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultParameterFormatter.format(), which routes … | Aug 02, 2026 |
| CVE-2026-10774 | LOW | 2.4 | Zephyr's Bluetooth Mesh subnet key management leaks one PSA Crypto key slot on every subnet-key teardown. In subsys/bluetooth/mesh/subnet.c, net_keys_create() imports the Private Beacon Key into … | Aug 02, 2026 |
| CVE-2026-68583 | MEDIUM | 5.4 | luci-app-adblock-fast before 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field that allows lower-privileged users to inject active HTML. When an administrator … | Aug 02, 2026 |
| CVE-2026-68582 | MEDIUM | 6.5 | Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the task-collection endpoint (GET /api/v1/projects/{project}/views/{view}/tasks). The endpoint loads the … | Aug 02, 2026 |
| CVE-2026-68581 | HIGH | 8.1 | Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. Because user IDs and link-share IDs are independent numeric sequences … | Aug 02, 2026 |
| CVE-2026-68580 | HIGH | 7.5 | FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to … | Aug 02, 2026 |
| CVE-2026-68579 | CRITICAL | 9.6 | FreeRDP before 3.30.0 (<= 3.29.0) contains a heap-based buffer overflow in the Windows clipboard client's CliprdrStream_Read function (client/Windows/wf_cliprdr.c). When an OLE paste consumer (e.g. explorer.exe) … | Aug 02, 2026 |
| CVE-2026-68578 | HIGH | 7.5 | ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. … | Aug 02, 2026 |
| CVE-2026-67357 | HIGH | 7.5 | ArcadeDB versions before 26.7.3 contain an information disclosure vulnerability in the MCP get_server_settings tool that leaks the arcadedb.ha.clusterToken in cleartext. Attackers with MCP access can … | Aug 02, 2026 |