Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-64816 | MEDIUM | 6.5 | RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in … | Jul 30, 2026 |
| CVE-2026-63559 | HIGH | 7.5 | An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information. | Jul 30, 2026 |
| CVE-2026-62845 | MEDIUM | 4.7 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied … | Jul 30, 2026 |
| CVE-2026-62246 | HIGH | 8.5 | Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from … | Jul 30, 2026 |
| CVE-2026-5846 | MEDIUM | 5.7 | The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the controller's … | Jul 30, 2026 |
| CVE-2026-38709 | CRITICAL | 9.8 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command … | Jul 30, 2026 |
| CVE-2026-18064 | HIGH | 7.5 | An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in … | Jul 30, 2026 |
| CVE-2026-12562 | HIGH | 8.8 | The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. … | Jul 30, 2026 |
| CVE-2026-68503 | CRITICAL | 9.8 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and … | Jul 30, 2026 |
| CVE-2026-68502 | CRITICAL | 9.8 | LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches … | Jul 30, 2026 |
| CVE-2026-68501 | MEDIUM | 6.5 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code … | Jul 30, 2026 |
| CVE-2026-68500 | HIGH | 7.5 | Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled … | Jul 30, 2026 |
| CVE-2026-68499 | MEDIUM | 6.2 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the … | Jul 30, 2026 |
| CVE-2026-66803 | CRITICAL | 10.0 | Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network. | Jul 30, 2026 |
| CVE-2026-66418 | CRITICAL | 9.3 | OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted … | Jul 30, 2026 |
| CVE-2026-61526 | MEDIUM | 6.1 | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. In versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2, the error.message … | Jul 30, 2026 |
| CVE-2026-55777 | UNKNOWN | — | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, … | Jul 30, 2026 |
| CVE-2026-55768 | UNKNOWN | — | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version … | Jul 30, 2026 |
| CVE-2026-54715 | UNKNOWN | — | GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. In version 1.10.2, … | Jul 30, 2026 |
| CVE-2026-52539 | CRITICAL | 9.1 | Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret. When the OST_TOKEN_SECRET environment variable is not set, the application falls back to the default … | Jul 30, 2026 |
| CVE-2026-35847 | UNKNOWN | — | An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file | Jul 30, 2026 |
| CVE-2025-69947 | CRITICAL | 9.8 | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1. | Jul 30, 2026 |
| CVE-2025-69941 | CRITICAL | 9.8 | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1. | Jul 30, 2026 |
| CVE-2025-69938 | CRITICAL | 9.8 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. | Jul 30, 2026 |
| CVE-2025-69937 | CRITICAL | 9.8 | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id. | Jul 30, 2026 |