Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-67347 | MEDIUM | 6.8 | Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify … | Jul 30, 2026 |
| CVE-2026-67346 | HIGH | 8.6 | Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, … | Jul 30, 2026 |
| CVE-2026-67345 | HIGH | 8.1 | MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.0 authorization … | Jul 30, 2026 |
| CVE-2026-65635 | UNKNOWN | — | Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration … | Jul 30, 2026 |
| CVE-2026-54885 | UNKNOWN | — | Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chosen … | Jul 30, 2026 |
| CVE-2026-53431 | UNKNOWN | — | Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing … | Jul 30, 2026 |
| CVE-2026-41187 | UNKNOWN | — | Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is not … | Jul 30, 2026 |
| CVE-2026-41186 | UNKNOWN | — | When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without … | Jul 30, 2026 |
| CVE-2026-16308 | HIGH | 7.5 | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service … | Jul 30, 2026 |
| CVE-2026-15435 | CRITICAL | 9.8 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could … | Jul 30, 2026 |
| CVE-2026-14980 | HIGH | 8.3 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with … | Jul 30, 2026 |
| CVE-2026-14522 | HIGH | 8.8 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of … | Jul 30, 2026 |
| CVE-2026-14519 | HIGH | 7.5 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal … | Jul 30, 2026 |
| CVE-2026-12947 | HIGH | 7.5 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local … | Jul 30, 2026 |
| CVE-2026-11980 | HIGH | 7.3 | IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. | Jul 30, 2026 |
| CVE-2026-11897 | HIGH | 7.5 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote … | Jul 30, 2026 |
| CVE-2026-11707 | CRITICAL | 9.3 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page. | Jul 30, 2026 |
| CVE-2026-11383 | MEDIUM | 5.4 | IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console. | Jul 30, 2026 |
| CVE-2025-36431 | MEDIUM | 5.4 | IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated … | Jul 30, 2026 |
| CVE-2025-36298 | MEDIUM | 5.4 | IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.1.2.0 through 6.1.2.7_2, … | Jul 30, 2026 |
| CVE-2026-67351 | HIGH | 8.8 | Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. … | Jul 30, 2026 |
| CVE-2026-60075 | UNKNOWN | — | Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _parse_time removes a time from anywhere … | Jul 30, 2026 |
| CVE-2026-60074 | UNKNOWN | — | Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse regexes capture … | Jul 30, 2026 |
| CVE-2026-5219 | HIGH | 8.3 | Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: through … | Jul 30, 2026 |
| CVE-2026-58218 | MEDIUM | 5.3 | A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A … | Jul 30, 2026 |