Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-44094 | HIGH | 8.6 | An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow … | Jul 30, 2026 |
| CVE-2026-44093 | HIGH | 7.8 | A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system … | Jul 30, 2026 |
| CVE-2026-44092 | CRITICAL | 9.1 | An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may … | Jul 30, 2026 |
| CVE-2026-44091 | CRITICAL | 9.1 | An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system … | Jul 30, 2026 |
| CVE-2026-44090 | CRITICAL | 9.8 | Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may … | Jul 30, 2026 |
| CVE-2026-13584 | UNKNOWN | — | Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, … | Jul 30, 2026 |
| CVE-2026-64635 | MEDIUM | 5.3 | Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of … | Jul 30, 2026 |
| CVE-2026-59328 | MEDIUM | 4.2 | Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised … | Jul 30, 2026 |
| CVE-2026-59327 | MEDIUM | 4.4 | Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. … | Jul 30, 2026 |
| CVE-2026-59326 | LOW | 3.3 | The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment variable at INFO level whenever it creates an outbound HTTP client and … | Jul 30, 2026 |
| CVE-2026-58066 | CRITICAL | 9.8 | Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature … | Jul 30, 2026 |
| CVE-2026-58046 | CRITICAL | 9.9 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, … | Jul 30, 2026 |
| CVE-2026-58043 | HIGH | 7.5 | A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one … | Jul 30, 2026 |
| CVE-2026-58040 | MEDIUM | 6.3 | An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability … | Jul 30, 2026 |
| CVE-2026-56850 | MEDIUM | 4.1 | A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests … | Jul 30, 2026 |
| CVE-2026-56847 | LOW | 3.3 | A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended … | Jul 30, 2026 |
| CVE-2026-47882 | HIGH | 8.3 | When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tools Boot … | Jul 30, 2026 |
| CVE-2026-47873 | HIGH | 8.0 | The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than restricting them to … | Jul 30, 2026 |
| CVE-2026-47858 | HIGH | 8.0 | Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-based remote code execution. Affected … | Jul 30, 2026 |
| CVE-2026-16531 | MEDIUM | 5.3 | An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and … | Jul 30, 2026 |
| CVE-2026-16530 | MEDIUM | 6.5 | A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a … | Jul 30, 2026 |
| CVE-2026-16529 | HIGH | 7.5 | A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds … | Jul 30, 2026 |
| CVE-2026-16527 | HIGH | 7.3 | An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any … | Jul 30, 2026 |
| CVE-2026-16526 | HIGH | 8.8 | A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and … | Jul 30, 2026 |
| CVE-2026-16524 | HIGH | 7.8 | A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as … | Jul 30, 2026 |