Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50855
Total
4075
Critical
15116
High
14809
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-58163 | HIGH | 7.5 | Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from … | Jul 29, 2026 |
| CVE-2026-58162 | CRITICAL | 10.0 | The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 … | Jul 29, 2026 |
| CVE-2026-58161 | HIGH | 7.5 | Apache Traffic Server can crash from null dereferences and dangling references in TLS and SNI handling. This issue affects Apache Traffic Server: from 8.0.0 through … | Jul 29, 2026 |
| CVE-2026-58160 | MEDIUM | 6.5 | Apache Traffic Server reads out of bounds while parsing DNS answers. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, … | Jul 29, 2026 |
| CVE-2026-58159 | HIGH | 8.2 | Apache Traffic Server can bypass IP access controls on UDS listeners and through ACL matching errors. This issue affects Apache Traffic Server: from 8.0.0 through … | Jul 29, 2026 |
| CVE-2026-58158 | MEDIUM | 5.9 | Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 … | Jul 29, 2026 |
| CVE-2026-58157 | HIGH | 8.7 | Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, … | Jul 29, 2026 |
| CVE-2026-50622 | HIGH | 8.8 | Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to … | Jul 29, 2026 |
| CVE-2026-23904 | HIGH | 7.3 | Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network … | Jul 29, 2026 |
| CVE-2026-18207 | MEDIUM | 6.5 | A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of … | Jul 29, 2026 |
| CVE-2026-18201 | MEDIUM | 5.5 | Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage … | Jul 29, 2026 |
| CVE-2025-10656 | CRITICAL | 9.8 | The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and … | Jul 29, 2026 |
| CVE-2026-9720 | MEDIUM | 4.3 | The Facturación Electrónica Costa Rica plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due … | Jul 29, 2026 |
| CVE-2026-65325 | MEDIUM | 4.8 | Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from … | Jul 29, 2026 |
| CVE-2026-65324 | HIGH | 7.5 | Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This issue affects Apache … | Jul 29, 2026 |
| CVE-2026-64557 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_sock_new_connection_cb() returned l2cap_pi(sk)->chan after release_sock(parent). Once the parent lock … | Jul 29, 2026 |
| CVE-2026-64556 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec() removes events by calling perf_event_exit_event(). For top-level events, … | Jul 29, 2026 |
| CVE-2026-58156 | MEDIUM | 4.9 | Apache Traffic Server mis-parses ports in URLs and userinfo, allowing port-based access-control bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 … | Jul 29, 2026 |
| CVE-2026-58155 | CRITICAL | 9.3 | Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, … | Jul 29, 2026 |
| CVE-2026-58154 | HIGH | 8.9 | Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: from 8.0.0 … | Jul 29, 2026 |
| CVE-2026-58153 | HIGH | 8.3 | Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue affects Apache Traffic Server: … | Jul 29, 2026 |
| CVE-2026-58152 | MEDIUM | 5.9 | Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, … | Jul 29, 2026 |
| CVE-2026-58151 | HIGH | 7.5 | Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic Server: from 8.0.0 … | Jul 29, 2026 |
| CVE-2026-13425 | HIGH | 7.2 | The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, … | Jul 29, 2026 |
| CVE-2026-11973 | MEDIUM | 4.9 | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, … | Jul 29, 2026 |