Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51181
Total
4084
Critical
15175
High
14817
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-17570 | MEDIUM | 4.3 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API … | Jul 27, 2026 |
| CVE-2026-17569 | MEDIUM | 4.3 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API … | Jul 27, 2026 |
| CVE-2026-17568 | HIGH | 8.8 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate … | Jul 27, 2026 |
| CVE-2026-17552 | CRITICAL | 9.1 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain … | Jul 27, 2026 |
| CVE-2026-66731 | HIGH | 7.5 | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by … | Jul 27, 2026 |
| CVE-2026-66730 | HIGH | 7.5 | facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at … | Jul 27, 2026 |
| CVE-2026-66729 | HIGH | 7.5 | facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process … | Jul 27, 2026 |
| CVE-2026-66391 | MEDIUM | 6.5 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. … | Jul 27, 2026 |
| CVE-2026-66390 | MEDIUM | 6.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 … | Jul 27, 2026 |
| CVE-2026-63077 | CRITICAL | 9.8 | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol | Jul 27, 2026 |
| CVE-2026-24252 | HIGH | 7.8 | NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead to code … | Jul 27, 2026 |
| CVE-2026-17531 | MEDIUM | 5.0 | A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the … | Jul 27, 2026 |
| CVE-2026-17192 | HIGH | 8.5 | A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are … | Jul 27, 2026 |
| CVE-2026-17191 | CRITICAL | 9.1 | An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may … | Jul 27, 2026 |
| CVE-2026-66399 | MEDIUM | 6.5 | phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required … | Jul 27, 2026 |
| CVE-2026-66398 | UNKNOWN | — | phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary … | Jul 27, 2026 |
| CVE-2026-66397 | UNKNOWN | — | phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting … | Jul 27, 2026 |
| CVE-2026-66396 | HIGH | 8.4 | SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped … | Jul 27, 2026 |
| CVE-2026-66395 | CRITICAL | 9.6 | SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting … | Jul 27, 2026 |
| CVE-2026-66394 | HIGH | 8.7 | SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based … | Jul 27, 2026 |
| CVE-2026-59251 | UNKNOWN | — | Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted … | Jul 27, 2026 |
| CVE-2026-59250 | UNKNOWN | — | Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and potentially achieve remote … | Jul 27, 2026 |
| CVE-2026-58227 | UNKNOWN | — | The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl_certificate:handle_incomplete_chain/5, the received … | Jul 27, 2026 |
| CVE-2026-55953 | UNKNOWN | — | The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among … | Jul 27, 2026 |
| CVE-2026-55737 | UNKNOWN | — | Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format … | Jul 27, 2026 |