Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50353
Total
4061
Critical
14946
High
14711
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-66364 | MEDIUM | 6.5 | The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. … | Jul 30, 2026 |
| CVE-2026-66360 | HIGH | 7.5 | The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of … | Jul 30, 2026 |
| CVE-2026-66349 | MEDIUM | 6.5 | The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER … | Jul 30, 2026 |
| CVE-2026-65423 | HIGH | 8.8 | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write. | Jul 30, 2026 |
| CVE-2026-65421 | MEDIUM | 6.5 | The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the … | Jul 30, 2026 |
| CVE-2026-63550 | MEDIUM | 6.5 | The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over … | Jul 30, 2026 |
| CVE-2026-63362 | MEDIUM | 5.9 | An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a … | Jul 30, 2026 |
| CVE-2026-63035 | HIGH | 8.1 | A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary … | Jul 30, 2026 |
| CVE-2026-63033 | MEDIUM | 6.5 | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the … | Jul 30, 2026 |
| CVE-2026-61893 | MEDIUM | 6.5 | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the … | Jul 30, 2026 |
| CVE-2026-56758 | MEDIUM | 6.5 | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, … | Jul 30, 2026 |
| CVE-2026-10031 | MEDIUM | 4.2 | SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted … | Jul 30, 2026 |
| CVE-2026-68563 | MEDIUM | 5.5 | A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup … | Jul 30, 2026 |
| CVE-2026-68562 | MEDIUM | 6.2 | A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator … | Jul 30, 2026 |
| CVE-2026-64816 | MEDIUM | 6.5 | RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in … | Jul 30, 2026 |
| CVE-2026-63559 | HIGH | 7.5 | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information. | Jul 30, 2026 |
| CVE-2026-62845 | MEDIUM | 4.7 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied … | Jul 30, 2026 |
| CVE-2026-62246 | HIGH | 8.5 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from … | Jul 30, 2026 |
| CVE-2026-5846 | MEDIUM | 5.7 | The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's … | Jul 30, 2026 |
| CVE-2026-38709 | CRITICAL | 9.8 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command … | Jul 30, 2026 |
| CVE-2026-18064 | HIGH | 7.5 | An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in … | Jul 30, 2026 |
| CVE-2026-12562 | HIGH | 8.8 | The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. … | Jul 30, 2026 |
| CVE-2026-68503 | CRITICAL | 9.8 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and … | Jul 30, 2026 |
| CVE-2026-68502 | CRITICAL | 9.8 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches … | Jul 30, 2026 |
| CVE-2026-68501 | MEDIUM | 6.5 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code … | Jul 30, 2026 |