Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50353
Total
4061
Critical
14946
High
14711
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-15978 | UNKNOWN | — | SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to … | Jul 30, 2026 |
| CVE-2026-15977 | UNKNOWN | — | SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured. | Jul 30, 2026 |
| CVE-2026-15976 | UNKNOWN | — | SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle … | Jul 30, 2026 |
| CVE-2026-15974 | UNKNOWN | — | SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and … | Jul 30, 2026 |
| CVE-2026-15971 | UNKNOWN | — | SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on … | Jul 30, 2026 |
| CVE-2026-15969 | UNKNOWN | — | SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads. | Jul 30, 2026 |
| CVE-2026-14227 | MEDIUM | 4.9 | An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions … | Jul 30, 2026 |
| CVE-2026-13444 | HIGH | 8.1 | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma … | Jul 30, 2026 |
| CVE-2026-13435 | CRITICAL | 9.9 | IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation. | Jul 30, 2026 |
| CVE-2026-12943 | CRITICAL | 9.8 | IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user … | Jul 30, 2026 |
| CVE-2026-12942 | HIGH | 7.5 | IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL … | Jul 30, 2026 |
| CVE-2026-12733 | HIGH | 7.5 | IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations. | Jul 30, 2026 |
| CVE-2026-12118 | CRITICAL | 9.8 | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of … | Jul 30, 2026 |
| CVE-2026-11904 | MEDIUM | 5.3 | IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and … | Jul 30, 2026 |
| CVE-2026-10700 | MEDIUM | 6.5 | IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/{flow_id}/{file_name} … | Jul 30, 2026 |
| CVE-2026-10695 | MEDIUM | 6.2 | IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries. | Jul 30, 2026 |
| CVE-2026-10545 | HIGH | 7.5 | IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via … | Jul 30, 2026 |
| CVE-2026-10535 | HIGH | 8.4 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc. | Jul 30, 2026 |
| CVE-2025-36374 | MEDIUM | 5.5 | IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to … | Jul 30, 2026 |
| CVE-2025-0152 | MEDIUM | 6.1 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an … | Jul 30, 2026 |
| CVE-2024-40683 | MEDIUM | 6.3 | IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session … | Jul 30, 2026 |
| CVE-2024-25039 | HIGH | 7.5 | IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which … | Jul 30, 2026 |
| CVE-2026-9322 | HIGH | 7.5 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via … | Jul 30, 2026 |
| CVE-2026-66414 | MEDIUM | 6.1 | Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating … | Jul 30, 2026 |
| CVE-2026-62663 | HIGH | 7.5 | Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks … | Jul 30, 2026 |