Browse CVEs

MEDIUM 6.9 CVE-2026-54768 WPGraphQL provides a GraphQL API for WordPress sites. From 2.0.0 until 2.15.1, the deprecated user field on SendPasswordResetEmailPayload lets an una… No fix yet Fix from $1,6002026-07-31 MEDIUM 6.5 CVE-2026-45377 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal download_… Patch available Fix from $1,6002026-07-31 MEDIUM 5.5 CVE-2026-45376 Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organ… Patch available Fix from $1,6002026-07-31 HIGH 7.8 CVE-2026-34641 Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Ex… Premiere 25.6.6 / 26.3+ Fix from $1,9502026-07-31 CRITICAL 9.8 CVE-2026-68771 ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node that allows unauthenticated remote attackers to exec… Patch available Fix from $2,3002026-07-31 MEDIUM 6.5 CVE-2026-52371 A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resource… No fix yet Fix from $1,6002026-07-31 MEDIUM 6.1 CVE-2026-52232 A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to e… No fix yet Fix from $1,6002026-07-31 CRITICAL 9.8 CVE-2026-52134 An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a captured G… No fix yet Fix from $2,3002026-07-31 HIGH 7.4 CVE-2026-51953 An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handler compon… No fix yet Fix from $1,9502026-07-31 MEDIUM 5.4 CVE-2026-45086 Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin… Patch available Fix from $1,6002026-07-31 CRITICAL 9.8 CVE-2026-68770 sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logi… Patch available Fix from $2,3002026-07-31 CRITICAL 9.8 CVE-2026-51785 An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request No fix yet Fix from $2,3002026-07-31 HIGH 8.8 CVE-2026-50986 PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment validation controller has no CSRF … No fix yet Fix from $1,9502026-07-31 HIGH 7.1 CVE-2026-65981 Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.15.0, a server using --mobility authenticates a resumed REFRESH reque… Patch available Fix from $1,9502026-07-31 CRITICAL 9.8 CVE-2026-38713 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 wer… No fix yet Fix from $2,3002026-07-31 HIGH 7.2 CVE-2026-38710 TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability a… No fix yet Fix from $1,9502026-07-31 CRITICAL 9.8 CVE-2026-38708 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 wer… Mitigation only Fix from $2,3002026-07-31 CRITICAL 9.8 CVE-2025-69948 SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. No fix yet Fix from $2,3002026-07-31 CRITICAL 9.8 CVE-2025-69946 SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id, region_… No fix yet Fix from $2,3002026-07-31 MEDIUM 5.3 CVE-2026-65841 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize … Patch available Fix from $1,6002026-07-31 HIGH 7.5 CVE-2026-62999 Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path… Patch available Fix from $1,9502026-07-31 HIGH 8.2 CVE-2026-62959 Coturn is a free open source implementation of TURN and STUN Server. From 4.5.2 through 4.14.0, when Coturn is started with --acme-redirect <URL> and… Patch available Fix from $1,9502026-07-31 MEDIUM 5.4 CVE-2026-62324 Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDan… Patch available Fix from $1,6002026-07-31 HIGH 7.5 CVE-2026-53599 REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/media… Patch available Fix from $1,9502026-07-31 MEDIUM 6.9 CVE-2026-53551 free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate … Patch available Fix from $1,6002026-07-31 HIGH 8.1 CVE-2026-53510 Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby so… Patch available Fix from $1,9502026-07-31 CRITICAL 9.8 CVE-2026-38711 TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 wer… No fix yet Fix from $2,3002026-07-31 HIGH 7.4 CVE-2026-18394 Incorrect authorization in the http_request tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured v… No fix yet Fix from $1,9502026-07-31 HIGH 7.5 CVE-2026-53505 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion(<value>) filter does not enforce an uppe… Patch available Fix from $1,9502026-07-31 HIGH 7.5 CVE-2026-53504 Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the convolution filter regular expression performs exponential backtr… Patch available Fix from $1,9502026-07-31