Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50353
Total
4061
Critical
14946
High
14711
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-68500 | HIGH | 7.5 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled … | Jul 30, 2026 |
| CVE-2026-68499 | MEDIUM | 6.2 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the … | Jul 30, 2026 |
| CVE-2026-66803 | CRITICAL | 10.0 | Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. | Jul 30, 2026 |
| CVE-2026-66418 | CRITICAL | 9.3 | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted … | Jul 30, 2026 |
| CVE-2026-61526 | MEDIUM | 6.1 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message … | Jul 30, 2026 |
| CVE-2026-55777 | UNKNOWN | — | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, … | Jul 30, 2026 |
| CVE-2026-55768 | UNKNOWN | — | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version … | Jul 30, 2026 |
| CVE-2026-54715 | UNKNOWN | — | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, … | Jul 30, 2026 |
| CVE-2026-52539 | CRITICAL | 9.1 | Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default … | Jul 30, 2026 |
| CVE-2026-35847 | UNKNOWN | — | An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file | Jul 30, 2026 |
| CVE-2025-69947 | CRITICAL | 9.8 | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1. | Jul 30, 2026 |
| CVE-2025-69941 | CRITICAL | 9.8 | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1. | Jul 30, 2026 |
| CVE-2025-69938 | CRITICAL | 9.8 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. | Jul 30, 2026 |
| CVE-2025-69937 | CRITICAL | 9.8 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id. | Jul 30, 2026 |
| CVE-2025-69936 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. | Jul 30, 2026 |
| CVE-2025-69935 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter. | Jul 30, 2026 |
| CVE-2025-69934 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1. | Jul 30, 2026 |
| CVE-2025-69933 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. | Jul 30, 2026 |
| CVE-2025-69931 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1. | Jul 30, 2026 |
| CVE-2025-69930 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1. | Jul 30, 2026 |
| CVE-2025-65342 | UNKNOWN | — | code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. | Jul 30, 2026 |
| CVE-2025-65341 | UNKNOWN | — | Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php. | Jul 30, 2026 |
| CVE-2025-65336 | UNKNOWN | — | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. | Jul 30, 2026 |
| CVE-2026-67594 | CRITICAL | 9.8 | Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, … | Jul 30, 2026 |
| CVE-2026-67550 | MEDIUM | 5.7 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but … | Jul 30, 2026 |