Browse CVEs

HIGH 8.8 CVE-2026-54368 CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx() and SearchExUnder() that allows authenticated attackers to e… Mitigation only Fix from $1,9502026-07-30 HIGH 8.6 CVE-2026-54367 CentreStack before 17.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to read, write, or delete arbitrary acc… No fix yet Fix from $1,9502026-07-30 HIGH 7.5 CVE-2026-54366 CentreStack before 17.4 contains an XML external entity (XXE) injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary f… No fix yet Fix from $1,9502026-07-30 HIGH 7.5 CVE-2026-54365 CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create … No fix yet Fix from $1,9502026-07-30 MEDIUM 6.5 CVE-2026-54364 CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variabl… No fix yet Fix from $1,6002026-07-30 CRITICAL 9.1 CVE-2026-54363 CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted token… No fix yet Fix from $2,3002026-07-30 CRITICAL 9.3 CVE-2026-47876 VMware ESX contains an out-of-bounds write vulnerability in the VMXNET3 virtual network adapter. A malicious actor with local administrative privileg… No fix yet Fix from $2,3002026-07-30 HIGH 7.6 CVE-2026-41703 VMware ESX, Workstation, and Fusion contain an out-of-bounds read vulnerability. A malicious actor with VM deployment privileges could trigger an out… No fix yet Fix from $1,9502026-07-30 MEDIUM 5.5 CVE-2026-7260 Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from… PHP 8.2.33 / 8.3.33+ Fix from $1,6002026-07-30 MEDIUM 6.8 CVE-2026-18382 A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an… Cost Management Metrics Operator No fix yet Fix from $1,6002026-07-30 HIGH 7.6 CVE-2026-18381 A flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to… Cost Management Metrics Operator No fix yet Fix from $1,9502026-07-30 MEDIUM 6.8 CVE-2026-18378 A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an a… Cost Management Metrics Operator No fix yet Fix from $1,6002026-07-30 CRITICAL 9.8 CVE-2026-17544 Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and… PHP 8.4.24 / 8.5.9+ Fix from $2,3002026-07-30 CRITICAL 9.8 CVE-2026-17543 Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from… PHP 8.2.33 / 8.3.33+ Fix from $2,3002026-07-30 HIGH 7.2 CVE-2026-15397 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is du… No fix yet Fix from $1,9502026-07-30 HIGH 8.8 CVE-2026-22622 Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to … No fix yet Fix from $1,9502026-07-30 HIGH 8.3 CVE-2026-22621 Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administ… No fix yet Fix from $1,9502026-07-30 HIGH 8.6 CVE-2026-22620 Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker t… No fix yet Fix from $1,9502026-07-30 MEDIUM 5.8 CVE-2026-18369 A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP… No fix yet Fix from $1,6002026-07-30 CRITICAL 9.1 CVE-2026-18363 A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the pas… No fix yet Fix from $2,3002026-07-30 MEDIUM 5.9 CVE-2026-18362 The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. No fix yet Fix from $1,6002026-07-30 HIGH 7.6 CVE-2026-18361 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. No fix yet Fix from $1,9502026-07-30 HIGH 7.6 CVE-2026-18360 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. No fix yet Fix from $1,9502026-07-30 MEDIUM 5.9 CVE-2026-16971 The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. No fix yet Fix from $1,6002026-07-30 HIGH 7.6 CVE-2026-16969 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. No fix yet Fix from $1,9502026-07-30 HIGH 8.8 CVE-2026-18353 PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlp… No fix yet Fix from $1,9502026-07-30 CRITICAL 9.8 CVE-2026-7849 Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration whic… No fix yet Fix from $2,3002026-07-30 CRITICAL 9.8 CVE-2026-44108 Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a tempor… No fix yet Fix from $2,3002026-07-30 HIGH 7.5 CVE-2026-44107 A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by op… No fix yet Fix from $1,9502026-07-30 HIGH 7.8 CVE-2026-44106 A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as roo… No fix yet Fix from $1,9502026-07-30