Browse CVEs

MEDIUM 6.8 CVE-2026-67347 Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.se… Patch available Fix from $1,6002026-07-30 HIGH 8.6 CVE-2026-67346 Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to valida… Patch available Fix from $1,9502026-07-30 HIGH 8.1 CVE-2026-67345 MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches… Patch available Fix from $1,9502026-07-30 HIGH 8.3 CVE-2026-65635 Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connec… Patch available Fix from $1,9502026-07-30 MEDIUM 6.9 CVE-2026-54885 Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization serve… Patch available Fix from $1,6002026-07-30 CRITICAL 9.1 CVE-2026-53431 Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion… Patch available Fix from $2,3002026-07-30 MEDIUM 6.5 CVE-2026-41187 Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy,… Calico 3.21.7 / 3.22.4+ Fix from $1,6002026-07-30 HIGH 7.5 CVE-2026-41186 When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug lis… Calico 3.21.7 / 3.22.4+ Fix from $1,9502026-07-30 HIGH 7.5 CVE-2026-16308 IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial… No fix yet Fix from $1,9502026-07-30 CRITICAL 9.8 CVE-2026-15435 IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the sy… App Connect Enterprise 12.0.12.28 / 13.0.8.0+ Fix from $2,3002026-07-30 HIGH 8.8 CVE-2026-14980 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to per… Websphere Application Server 26.0.0.9+ Fix from $1,9502026-07-30 CRITICAL 9.8 CVE-2026-14522 IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due… App Connect Enterprise 12.0.12.28 / 13.0.8.0+ Fix from $2,3002026-07-30 HIGH 7.5 CVE-2026-14519 IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a … App Connect Enterprise 12.0.12.28 / 13.0.8.0+ Fix from $1,9502026-07-30 HIGH 7.5 CVE-2026-12947 IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that coul… App Connect Enterprise 12.0.12.28 / 13.0.8.0+ Fix from $1,9502026-07-30 HIGH 7.3 CVE-2026-11980 IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up. Aspera after 1.0.19 Fix from $1,9502026-07-30 HIGH 7.5 CVE-2026-11897 IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted requ… Websphere Application Server 26.0.0.8+ Fix from $1,9502026-07-30 CRITICAL 9.3 CVE-2026-11707 IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the … Websphere Application Server 8.5.5.30 / 9.0.5.29+ Fix from $2,3002026-07-30 MEDIUM 5.4 CVE-2026-11383 IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative C… Websphere Application Server 8.5.5.30 / 9.0.5.29+ Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2025-36431 IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.0_1 is vulnerable to cross-site scripting. … Sterling B2b Integrator after 6.2.2.0_1 Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2025-36298 IBM Sterling B2B Integrator 6.1.2.0 through 6.1.2.7_2, 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM St… Sterling B2b Integrator after 6.2.2.0_1 Fix from $1,6002026-07-30 HIGH 8.8 CVE-2026-67351 Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independent… Mitigation only Fix from $1,9502026-07-30 HIGH 7.5 CVE-2026-60075 Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time. _pars… Patch available Fix from $1,9502026-07-30 HIGH 7.5 CVE-2026-60074 Date::Manip versions through 6.99 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check. The parse… Patch available Fix from $1,9502026-07-30 HIGH 8.3 CVE-2026-5219 Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. T… No fix yet Fix from $1,9502026-07-30 MEDIUM 5.3 CVE-2026-58218 A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejec… No fix yet Fix from $1,6002026-07-30 HIGH 7.5 CVE-2026-57859 e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band d… Patch available Fix from $1,9502026-07-30 HIGH 8.1 CVE-2026-56428 The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuratio… No fix yet Fix from $1,9502026-07-30 HIGH 8.2 CVE-2026-12722 Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. … No fix yet Fix from $1,9502026-07-30 CRITICAL 9.8 CVE-2026-59310 KEV VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this i… Vcenter Server 8.0 / 9.0.2.0100+ Fix from $2,3002026-07-30 CRITICAL 9.8 CVE-2026-59309 VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service. A malicious actor with network access to vCenter may … No fix yet Fix from $2,3002026-07-30