Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-11885 | HIGH | 8.4 | IBM PowerVM Hypervisor FW1110.00 through FW1110.20, FW1060.00 through FW1060.71, and FW950.00 through FW950.H1 A carefully crafted OS hypervisor call can cause the PowerVM hypervisor to … | Jul 30, 2026 |
| CVE-2026-11771 | UNKNOWN | — | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a … | Jul 30, 2026 |
| CVE-2026-67596 | MEDIUM | 6.2 | CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 contains a weak encryption vulnerability that allows unauthenticated attackers to recover all stored secrets in plaintext … | Jul 30, 2026 |
| CVE-2026-58222 | HIGH | 8.8 | A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare … | Jul 30, 2026 |
| CVE-2026-58216 | MEDIUM | 5.3 | An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, … | Jul 30, 2026 |
| CVE-2026-57862 | HIGH | 8.5 | Kanboard 1.2.52 and prior contains a server-side request forgery vulnerability that allows authenticated users to bypass SSRF protections by supplying hexadecimal IP address notation in … | Jul 30, 2026 |
| CVE-2026-52680 | UNKNOWN | — | Apache Kyuubi REST batch multipart upload handling uses the client-supplied multipart filename when creating a temporary uploaded resource. A remote attacker who can access the … | Jul 30, 2026 |
| CVE-2026-4978 | CRITICAL | 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in UMAI Vision Traffic Analysis System allows SQL Injection. This issue affects … | Jul 30, 2026 |
| CVE-2026-48910 | MEDIUM | 6.5 | A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker … | Jul 30, 2026 |
| CVE-2026-44617 | UNKNOWN | — | LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing LDAP search filters instead of RFC 4515 filter escaping, leaving … | Jul 30, 2026 |
| CVE-2026-44616 | UNKNOWN | — | LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping user-controlled input, allowing an authenticated attacker to inject LDAP filter syntax through … | Jul 30, 2026 |
| CVE-2026-44613 | UNKNOWN | — | Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state-changing requests and accepted text/plain request bodies, allowing an attacker who … | Jul 30, 2026 |
| CVE-2026-28814 | UNKNOWN | — | Arbitrary Wiki Markup rendering due to lack of authentication in Apache JSPWiki up to 2.12.3 allows attacker to obtain sensitive data stored in JSPWiki variables. … | Jul 30, 2026 |
| CVE-2026-28813 | UNKNOWN | — | Apache JSPWiki, up to 2.12.3, is vulnerable to JSON Hijacking, which leads to csrf vulnerabilities. Users are recommended to upgrade to version 2.12.4, which fixes … | Jul 30, 2026 |
| CVE-2026-28812 | UNKNOWN | — | UserManager lack of checks allows impersonation in Apache JSPWiki up to 2.12.3 which may allow attackers to escalate privileges. Users are recommended to upgrade to … | Jul 30, 2026 |
| CVE-2026-28811 | UNKNOWN | — | Debug Messages Revealing Unnecessary Information in Apache JSPWiki up to 2.12.3. Users are recommended to upgrade to version 2.12.4, which fixes this issue. | Jul 30, 2026 |
| CVE-2026-28323 | CRITICAL | 9.8 | SolarWinds Web Help Desk is found to be affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled. | Jul 30, 2026 |
| CVE-2026-23985 | UNKNOWN | — | A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically … | Jul 30, 2026 |
| CVE-2026-23981 | UNKNOWN | — | An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When … | Jul 30, 2026 |
| CVE-2026-15658 | UNKNOWN | — | A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without … | Jul 30, 2026 |
| CVE-2026-15657 | UNKNOWN | — | A vulnerability in the foreUP customer REST API allows any authenticated user to read cleartext payment-processor merchant credentials in the response body. | Jul 30, 2026 |
| CVE-2026-10842 | HIGH | 7.5 | IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker … | Jul 30, 2026 |
| CVE-2026-6540 | UNKNOWN | — | Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using … | Jul 30, 2026 |
| CVE-2026-67349 | HIGH | 7.5 | OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN … | Jul 30, 2026 |
| CVE-2026-67348 | HIGH | 8.1 | Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply … | Jul 30, 2026 |