Browse CVEs

MEDIUM 6.1 CVE-2026-68747 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_s… Htmlsanitizeex 1.5.4+ Fix from $1,6002026-08-06 HIGH 7.5 CVE-2026-68750 Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenticated remote attacker to exha… Htmlsanitizeex 1.5.3+ Fix from $1,9502026-08-06 HIGH 7.5 CVE-2026-68749 Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to e… Htmlsanitizeex 1.5.3+ Fix from $1,9502026-08-06 MEDIUM 6.1 CVE-2026-66843 Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to l… Htmlsanitizeex 1.5.3+ Fix from $1,6002026-08-06 MEDIUM 6.1 CVE-2026-66829 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to force … Htmlsanitizeex 1.5.3+ Fix from $1,6002026-08-06 MEDIUM 6.1 CVE-2026-66370 URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote a… Htmlsanitizeex 1.5.3+ Fix from $1,6002026-08-06 HIGH 8.2 CVE-2026-5423 @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL su… No fix yet Fix from $1,9502026-08-06 HIGH 7.5 CVE-2026-53985 Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler tha… Patch available Fix from $1,9502026-08-06 HIGH 7.5 CVE-2026-53977 OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by se… Patch available Fix from $1,9502026-08-06 HIGH 7.8 CVE-2026-43622 llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1batch() allocates memory using m… Patch available Fix from $1,9502026-08-06 HIGH 8.6 CVE-2026-3430 The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unaut… No fix yet Fix from $1,9502026-08-06 MEDIUM 5.3 CVE-2026-19047 A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src… No fix yet Fix from $1,6002026-08-06 HIGH 7.5 CVE-2026-18427 @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent dire… No fix yet Fix from $1,9502026-08-06 HIGH 8.5 CVE-2026-18359 Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to ma… Escriptorium after 26.04.1 Fix from $1,9502026-08-06 HIGH 7.1 CVE-2026-18277 Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to gran… Escriptorium after 26.04.1 Fix from $1,9502026-08-06 MEDIUM 6.5 CVE-2026-18275 Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to… Escriptorium after 26.04.1 Fix from $1,6002026-08-06 HIGH 8.8 CVE-2026-18258 Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows … Escriptorium after 26.04.1 Fix from $1,9502026-08-06 HIGH 7.5 CVE-2026-70646 aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire reques… Patch available Fix from $1,9502026-08-06 MEDIUM 5.9 CVE-2026-70637 LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing L… No fix yet Fix from $1,6002026-08-06 CRITICAL 9.8 CVE-2026-67261 Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI … Virtual Storage Integrator 10.11.1.0+ Fix from $2,3002026-08-06 HIGH 7.5 CVE-2026-66712 Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. No fix yet Fix from $1,9502026-08-06 HIGH 7.1 CVE-2026-66711 Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. No fix yet Fix from $1,9502026-08-06 HIGH 8.1 CVE-2026-66710 Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. No fix yet Fix from $1,9502026-08-06 CRITICAL 9.1 CVE-2026-66709 Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. No fix yet Fix from $2,3002026-08-06 HIGH 8.2 CVE-2026-66708 Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. No fix yet Fix from $1,9502026-08-06 HIGH 7.1 CVE-2026-66707 Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions. No fix yet Fix from $1,9502026-08-06 MEDIUM 5.9 CVE-2026-66706 Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions. No fix yet Fix from $1,6002026-08-06 HIGH 7.1 CVE-2026-66705 Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions. No fix yet Fix from $1,9502026-08-06 MEDIUM 6.5 CVE-2026-66703 Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions. No fix yet Fix from $1,6002026-08-06 HIGH 7.1 CVE-2026-66702 Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions. No fix yet Fix from $1,9502026-08-06