Browse CVEs

MEDIUM 5.9 CVE-2026-58158 Apache Traffic Server mishandles PROXY protocol input, truncating ports and overflowing the stack. This issue affects Apache Traffic Server: from 8.… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 HIGH 8.7 CVE-2026-58157 Apache Traffic Server can reuse server sessions and tunnels improperly, exposing data across client connections. This issue affects Apache Traffic S… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 HIGH 8.8 CVE-2026-50622 Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated … Atlas 2.6.0+ Fix from $1,9502026-07-29 HIGH 7.3 CVE-2026-23904 Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote requester with network a… Kyuubi 1.12.0+ Fix from $1,9502026-07-29 MEDIUM 6.5 CVE-2026-18207 A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of … Build Of Keycloak No fix yet Fix from $1,6002026-07-29 MEDIUM 5.5 CVE-2026-18201 Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator w… Build Of Keycloak No fix yet Fix from $1,6002026-07-29 CRITICAL 9.8 CVE-2025-10656 The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions u… No fix yet Fix from $2,3002026-07-29 HIGH 8.8 CVE-2026-64557 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_so… Mitigation only Fix from $1,9502026-07-29 HIGH 7.8 CVE-2026-64556 In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec(… No fix yet Fix from $1,9502026-07-29 HIGH 7.5 CVE-2026-65324 Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This … Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 CRITICAL 9.3 CVE-2026-58155 Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Tr… Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 HIGH 8.9 CVE-2026-58154 Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. This issue affects Apache Traffic Server: fr… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 HIGH 8.3 CVE-2026-58153 Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. This issue … Traffic Server 10.1.4+ Fix from $1,9502026-07-29 MEDIUM 5.9 CVE-2026-58152 Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 HIGH 7.5 CVE-2026-58151 Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. This issue affects Apache Traffic … Traffic Server 9.2.15 / 10.1.4+ Fix from $1,9502026-07-29 HIGH 7.2 CVE-2026-13425 The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and includi… No fix yet Fix from $1,9502026-07-29 CRITICAL 10.0 CVE-2026-58150 Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic … Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 CRITICAL 10.0 CVE-2026-57834 Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9… Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 CRITICAL 9.3 CVE-2026-41920 Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 thr… Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 MEDIUM 6.5 CVE-2026-35226 An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malfor… No fix yet Fix from $1,6002026-07-29 MEDIUM 5.9 CVE-2026-33930 Apache Traffic Server copies the client Host header into a fixed-size stack buffer without a bound during redirect handling, so an over-long Host hea… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 CRITICAL 9.1 CVE-2026-33267 Improper Input Validation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.14, from 10.1.0 t… Traffic Server 9.2.15 / 10.1.4+ Fix from $2,3002026-07-29 MEDIUM 5.3 CVE-2026-24033 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Traffic Server. This issue affects Apache T… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 MEDIUM 5.3 CVE-2026-22068 Regular Expression without Anchors vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.X through 10.1.3, fro… Traffic Server 9.2.15 / 10.1.4+ Fix from $1,6002026-07-29 MEDIUM 6.1 CVE-2026-18197 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS).… Link Library 7.9.4+ Fix from $1,6002026-07-29 MEDIUM 6.5 CVE-2026-18192 VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversa… No fix yet Fix from $1,6002026-07-29 CRITICAL 9.8 CVE-2026-18191 VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden fu… Mitigation only Fix from $2,3002026-07-29 MEDIUM 5.4 CVE-2026-63239 A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing s… No fix yet Fix from $1,6002026-07-29 MEDIUM 6.5 CVE-2026-63238 An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts,… No fix yet Fix from $1,6002026-07-29 CRITICAL 9.9 CVE-2026-63234 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessmen… No fix yet Fix from $2,3002026-07-29