Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2025-51684 | UNKNOWN | — | CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into … | Jul 30, 2026 |
| CVE-2026-66416 | HIGH | 8.8 | Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel … | Jul 30, 2026 |
| CVE-2026-66415 | HIGH | 8.5 | Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames … | Jul 30, 2026 |
| CVE-2026-66066 | UNKNOWN | — | Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable … | Jul 30, 2026 |
| CVE-2026-64870 | UNKNOWN | — | MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.update_tool passes caller-supplied download_url and download_callback_url values to requests.get without equivalent trusted-host … | Jul 30, 2026 |
| CVE-2026-61536 | HIGH | 7.5 | Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of … | Jul 30, 2026 |
| CVE-2026-59881 | UNKNOWN | — | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit … | Jul 30, 2026 |
| CVE-2026-51272 | UNKNOWN | — | Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not … | Jul 30, 2026 |
| CVE-2026-48499 | UNKNOWN | — | Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated … | Jul 30, 2026 |
| CVE-2026-18245 | CRITICAL | 9.0 | Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, … | Jul 30, 2026 |
| CVE-2026-18140 | HIGH | 7.5 | Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated struct deserializer, … | Jul 30, 2026 |
| CVE-2026-15978 | UNKNOWN | — | SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to … | Jul 30, 2026 |
| CVE-2026-15977 | UNKNOWN | — | SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is configured. | Jul 30, 2026 |
| CVE-2026-15976 | UNKNOWN | — | SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.load(..., weights_only=False) fallback enables pickle … | Jul 30, 2026 |
| CVE-2026-15974 | UNKNOWN | — | SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and … | Jul 30, 2026 |
| CVE-2026-15971 | UNKNOWN | — | SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution on … | Jul 30, 2026 |
| CVE-2026-15969 | UNKNOWN | — | SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads. | Jul 30, 2026 |
| CVE-2026-14227 | MEDIUM | 4.9 | An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions … | Jul 30, 2026 |
| CVE-2026-13444 | HIGH | 8.1 | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma … | Jul 30, 2026 |
| CVE-2026-13435 | CRITICAL | 9.9 | IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation. | Jul 30, 2026 |
| CVE-2026-12943 | CRITICAL | 9.8 | IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user … | Jul 30, 2026 |
| CVE-2026-12942 | HIGH | 7.5 | IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL … | Jul 30, 2026 |
| CVE-2026-12733 | HIGH | 7.5 | IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations. | Jul 30, 2026 |
| CVE-2026-12118 | CRITICAL | 9.8 | IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of … | Jul 30, 2026 |
| CVE-2026-11904 | MEDIUM | 5.3 | IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and … | Jul 30, 2026 |