Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50353
Total
4061
Critical
14946
High
14711
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-51953 | UNKNOWN | — | An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler components | Jul 31, 2026 |
| CVE-2026-45086 | MEDIUM | 5.4 | Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demographics/questions/edit_questions and reach the demographics … | Jul 31, 2026 |
| CVE-2026-68770 | CRITICAL | 9.8 | sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the import_module_class helper within … | Jul 31, 2026 |
| CVE-2026-65981 | HIGH | 7.1 | Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH request with … | Jul 31, 2026 |
| CVE-2026-51785 | UNKNOWN | — | An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request | Jul 31, 2026 |
| CVE-2026-50986 | UNKNOWN | — | PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF token. An attacker can confirm an … | Jul 31, 2026 |
| CVE-2026-38713 | UNKNOWN | — | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command … | Jul 31, 2026 |
| CVE-2026-38710 | UNKNOWN | — | TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands … | Jul 31, 2026 |
| CVE-2026-38708 | UNKNOWN | — | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command … | Jul 31, 2026 |
| CVE-2025-69948 | UNKNOWN | — | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. | Jul 31, 2026 |
| CVE-2025-69946 | UNKNOWN | — | SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_id, and ward_id. | Jul 31, 2026 |
| CVE-2026-65841 | UNKNOWN | — | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign … | Jul 31, 2026 |
| CVE-2026-62999 | HIGH | 7.5 | Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template … | Jul 31, 2026 |
| CVE-2026-62959 | UNKNOWN | — | Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and exposes … | Jul 31, 2026 |
| CVE-2026-62324 | MEDIUM | 5.4 | Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to … | Jul 31, 2026 |
| CVE-2026-55825 | LOW | 3.1 | Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier … | Jul 31, 2026 |
| CVE-2026-53599 | HIGH | 7.5 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP … | Jul 31, 2026 |
| CVE-2026-53551 | UNKNOWN | — | free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field … | Jul 31, 2026 |
| CVE-2026-53510 | HIGH | 8.1 | Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby … | Jul 31, 2026 |
| CVE-2026-38711 | UNKNOWN | — | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command … | Jul 31, 2026 |
| CVE-2026-18394 | HIGH | 7.4 | Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTP_REQUEST_TOKEN_CONFIG by influencing the … | Jul 31, 2026 |
| CVE-2026-57232 | LOW | 3.1 | Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs … | Jul 31, 2026 |
| CVE-2026-55824 | LOW | 2.6 | Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler … | Jul 31, 2026 |
| CVE-2026-53505 | HIGH | 7.5 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an upper bound on <value> and runs … | Jul 31, 2026 |
| CVE-2026-53504 | HIGH | 7.5 | Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtracking on crafted repeated numeric input, … | Jul 31, 2026 |