Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2025-69936 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. | Jul 30, 2026 |
| CVE-2025-69935 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter. | Jul 30, 2026 |
| CVE-2025-69934 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1. | Jul 30, 2026 |
| CVE-2025-69933 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. | Jul 30, 2026 |
| CVE-2025-69931 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1. | Jul 30, 2026 |
| CVE-2025-69930 | UNKNOWN | — | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1. | Jul 30, 2026 |
| CVE-2025-65342 | UNKNOWN | — | code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. | Jul 30, 2026 |
| CVE-2025-65341 | UNKNOWN | — | Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php. | Jul 30, 2026 |
| CVE-2025-65336 | UNKNOWN | — | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php. | Jul 30, 2026 |
| CVE-2026-67594 | CRITICAL | 9.8 | Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware, … | Jul 30, 2026 |
| CVE-2026-67550 | MEDIUM | 5.7 | re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but … | Jul 30, 2026 |
| CVE-2026-67530 | MEDIUM | 6.4 | WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts allowed an … | Jul 30, 2026 |
| CVE-2026-67529 | MEDIUM | 4.3 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/costs/lib/api/v3/time_entries/time_entry_representer.rb and modules/costs/lib/api/v3/cost_entries/cost_entry_representer.rb … | Jul 30, 2026 |
| CVE-2026-67528 | MEDIUM | 4.3 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and GroupCustomField options … | Jul 30, 2026 |
| CVE-2026-67527 | HIGH | 7.6 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve … | Jul 30, 2026 |
| CVE-2026-67208 | CRITICAL | 9.8 | Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 … | Jul 30, 2026 |
| CVE-2026-67207 | HIGH | 8.8 | Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to a PHP … | Jul 30, 2026 |
| CVE-2026-67206 | HIGH | 8.8 | Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file … | Jul 30, 2026 |
| CVE-2026-66756 | UNKNOWN | — | Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version … | Jul 30, 2026 |
| CVE-2026-66755 | UNKNOWN | — | Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place … | Jul 30, 2026 |
| CVE-2026-65835 | MEDIUM | 6.6 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers/resources/collect.go, including … | Jul 30, 2026 |
| CVE-2026-65834 | MEDIUM | 6.8 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.ForbiddenAnnotations.Regex were not validated by the configuration admission webhook, allowing a … | Jul 30, 2026 |
| CVE-2026-12946 | CRITICAL | 9.9 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user … | Jul 30, 2026 |
| CVE-2026-11536 | HIGH | 8.5 | IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. | Jul 30, 2026 |
| CVE-2026-10569 | MEDIUM | 4.3 | IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through … | Jul 30, 2026 |