Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51249
Total
4085
Critical
15181
High
14833
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-48145 | HIGH | 7.5 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade … | Jul 27, 2026 |
| CVE-2026-48144 | CRITICAL | 9.1 | Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade … | Jul 27, 2026 |
| CVE-2026-45112 | HIGH | 7.5 | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended … | Jul 27, 2026 |
| CVE-2026-43871 | HIGH | 7.5 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings.This issue affects Apache Thrift: before 0.24.0. Users are … | Jul 27, 2026 |
| CVE-2026-41608 | HIGH | 7.5 | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to … | Jul 27, 2026 |
| CVE-2026-14856 | UNKNOWN | — | A stored Cross-Site Scripting (XSS) vulnerability in the file upload functionality of the Media Manager in TastyIgniter v4.3.0, caused by insufficient validation and sanitization of … | Jul 27, 2026 |
| CVE-2026-12495 | UNKNOWN | — | Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit … | Jul 27, 2026 |
| CVE-2026-40000 | LOW | 1.8 | The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity within ZTE File Manager is designed to preview compressed files. Third-party applications can launch this Activity and supply arbitrary file paths (e.g., … | Jul 27, 2026 |
| CVE-2026-17534 | MEDIUM | 5.5 | Kimi Code (@moonshot-ai/kimi-code) before 0.27.0 implements FetchURL SSRF hardening as a static hostname and IP-literal denylist in assertSafeFetchTarget, without resolving DNS or re-validating hosts after … | Jul 27, 2026 |
| CVE-2026-17527 | HIGH | 7.7 | In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's … | Jul 27, 2026 |
| CVE-2026-17523 | HIGH | 7.8 | A flaw was found in the kernel. An unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to … | Jul 27, 2026 |
| CVE-2026-65765 | UNKNOWN | — | Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path … | Jul 27, 2026 |
| CVE-2026-65764 | UNKNOWN | — | Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability. | Jul 27, 2026 |
| CVE-2026-16554 | UNKNOWN | — | cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, a 32-bit size_t, can wrap … | Jul 27, 2026 |
| CVE-2026-15799 | UNKNOWN | — | Rejected reason: This is a duplicate. | Jul 27, 2026 |
| CVE-2026-65894 | UNKNOWN | — | This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerability by conducting … | Jul 27, 2026 |
| CVE-2026-65893 | UNKNOWN | — | This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could … | Jul 27, 2026 |
| CVE-2026-64536 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over … | Jul 27, 2026 |
| CVE-2026-64535 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When data … | Jul 27, 2026 |
| CVE-2026-64534 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest … | Jul 27, 2026 |
| CVE-2026-64533 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying … | Jul 27, 2026 |
| CVE-2026-64532 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the … | Jul 27, 2026 |
| CVE-2026-64531 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, … | Jul 27, 2026 |
| CVE-2026-14837 | HIGH | 7.8 | Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the … | Jul 27, 2026 |
| CVE-2026-9830 | HIGH | 8.2 | The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without … | Jul 27, 2026 |