Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-18157 | HIGH | 7.8 | A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. … | Jul 31, 2026 |
| CVE-2026-14541 | UNKNOWN | — | An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized … | Jul 31, 2026 |
| CVE-2026-14540 | UNKNOWN | — | A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox … | Jul 31, 2026 |
| CVE-2026-14539 | UNKNOWN | — | An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker … | Jul 31, 2026 |
| CVE-2026-14538 | UNKNOWN | — | An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass … | Jul 31, 2026 |
| CVE-2026-14537 | UNKNOWN | — | Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected … | Jul 31, 2026 |
| CVE-2026-58039 | LOW | 3.3 | A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of … | Jul 31, 2026 |
| CVE-2026-66720 | MEDIUM | 6.5 | The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame … | Jul 30, 2026 |
| CVE-2026-66421 | CRITICAL | 9.3 | OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML … | Jul 30, 2026 |
| CVE-2026-66420 | HIGH | 8.8 | MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early … | Jul 30, 2026 |
| CVE-2026-66369 | MEDIUM | 6.5 | The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific … | Jul 30, 2026 |
| CVE-2026-66364 | MEDIUM | 6.5 | The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. … | Jul 30, 2026 |
| CVE-2026-66360 | HIGH | 7.5 | The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of … | Jul 30, 2026 |
| CVE-2026-66349 | MEDIUM | 6.5 | The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER … | Jul 30, 2026 |
| CVE-2026-65423 | HIGH | 8.8 | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write. | Jul 30, 2026 |
| CVE-2026-65421 | MEDIUM | 6.5 | The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the … | Jul 30, 2026 |
| CVE-2026-63550 | MEDIUM | 6.5 | The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over … | Jul 30, 2026 |
| CVE-2026-63362 | MEDIUM | 5.9 | An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a … | Jul 30, 2026 |
| CVE-2026-63035 | HIGH | 8.1 | A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary … | Jul 30, 2026 |
| CVE-2026-63033 | MEDIUM | 6.5 | A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the … | Jul 30, 2026 |
| CVE-2026-61893 | MEDIUM | 6.5 | A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the … | Jul 30, 2026 |
| CVE-2026-56758 | MEDIUM | 6.5 | The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, … | Jul 30, 2026 |
| CVE-2026-10031 | MEDIUM | 4.2 | SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted … | Jul 30, 2026 |
| CVE-2026-68563 | MEDIUM | 5.5 | A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup … | Jul 30, 2026 |
| CVE-2026-68562 | MEDIUM | 6.2 | A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator … | Jul 30, 2026 |