Browse CVEs

HIGH 7.3 CVE-2026-65948 UnixAuth lacks brute-force protection in Apache Ranger versions <= 2.8.0.  Note:  UnixAuth is NOT a recommended option for production deployments.  U… Ranger 2.9.0+ Fix from $1,9502026-08-10 MEDIUM 6.5 CVE-2026-65945 Logs contain replayable JWT tokens in Apache Ranger versions <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. Ranger 2.9.0+ Fix from $1,6002026-08-10 HIGH 7.5 CVE-2026-65942 TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes thi… Ranger 2.9.0+ Fix from $1,9502026-08-10 HIGH 7.5 CVE-2026-61899 Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Us… Tapestry 5.9.1+ Fix from $1,9502026-08-10 CRITICAL 9.8 CVE-2026-55799 Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fi… Ranger 2.9.0+ Fix from $2,3002026-08-10 CRITICAL 9.8 CVE-2026-44416 Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgra… Ranger 2.9.0+ Fix from $2,3002026-08-10 CRITICAL 9.8 CVE-2026-42537 Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue. Ranger 2.9.0+ Fix from $2,3002026-08-10 CRITICAL 9.8 CVE-2026-40920 Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixe… Ranger 2.9.0+ Fix from $2,3002026-08-10 CRITICAL 9.8 CVE-2026-32227 SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the… Ranger 2.9.0+ Fix from $2,3002026-08-10 HIGH 7.8 CVE-2026-59087 A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this … Enterprise Linux No fix yet Fix from $1,9502026-08-10 HIGH 7.5 CVE-2026-55814 Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. Ranger 2.9.0+ Fix from $1,9502026-08-10 CRITICAL 9.8 CVE-2026-28672 Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger… Ranger after 2.8.0 Fix from $2,3002026-08-10 CRITICAL 10.0 CVE-2026-66915 Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.6.9 - An unauthenticated attacker could execute arbitrary code by using the aja… No fix yet Fix from $2,3002026-08-10 HIGH 7.5 CVE-2026-44630 Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sen… No fix yet Fix from $1,9502026-08-10 MEDIUM 6.5 CVE-2026-19404 A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization … No fix yet Fix from $1,6002026-08-10 MEDIUM 5.3 CVE-2026-66411 DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may conne… No fix yet Fix from $1,6002026-08-10 MEDIUM 5.3 CVE-2026-66409 DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to… No fix yet Fix from $1,6002026-08-10 HIGH 8.1 CVE-2026-66407 DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved throug… No fix yet Fix from $1,9502026-08-10 HIGH 8.8 CVE-2026-66405 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products. No fix yet Fix from $1,9502026-08-10 MEDIUM 6.5 CVE-2026-66404 DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affecte… No fix yet Fix from $1,6002026-08-10 HIGH 7.5 CVE-2026-66403 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected prod… No fix yet Fix from $1,9502026-08-10 MEDIUM 6.9 CVE-2026-21084 Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information. No fix yet Fix from $1,6002026-08-10 MEDIUM 6.5 CVE-2026-21083 Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. Smart Switch 3.7.72.6+ Fix from $1,6002026-08-10 MEDIUM 6.5 CVE-2026-21078 Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof dev… Smart Switch 3.7.72.6+ Fix from $1,6002026-08-10 MEDIUM 5.5 CVE-2026-21082 Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. Health 7.0.0+ Fix from $1,6002026-08-10 MEDIUM 5.1 CVE-2026-21081 Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive informa… No fix yet Fix from $1,6002026-08-10 MEDIUM 6.5 CVE-2026-21080 Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. Smart Switch 3.7.72.6+ Fix from $1,6002026-08-10 MEDIUM 6.5 CVE-2026-21079 Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. Smart Switch 3.7.72.6+ Fix from $1,6002026-08-10 MEDIUM 5.5 CVE-2026-21077 Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. Health 7.0.0+ Fix from $1,6002026-08-10 MEDIUM 5.5 CVE-2026-21076 Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. Health 7.0.0+ Fix from $1,6002026-08-10