Browse CVEs

HIGH 7.7 CVE-2026-28896 The issue was addressed with improved memory handling. This issue is fixed in iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, ma… macOS 14.8.8 / 15.7.8+ Fix from $1,9502026-07-27 MEDIUM 5.5 CVE-2026-28849 The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A maliciously crafted ZIP archive may… macOS 14.8.8 / 15.7.8+ Fix from $1,6002026-07-27 MEDIUM 5.5 CVE-2026-20672 An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS… macOS 14.8.8 / 15.7.8+ Fix from $1,6002026-07-27 MEDIUM 5.2 CVE-2026-12001 A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & A… No fix yet Fix from $1,6002026-07-27 MEDIUM 6.5 CVE-2026-66018 Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repos… Artifactory 7.146.34 / 7.161.15+ Fix from $1,6002026-07-27 HIGH 7.2 CVE-2026-66015 An authenticated privilege-escalation vulnerability in JFrog Platform may be exploited under admin-provisioned account conditions. Successful exploit… Artifactory 7.146.34 / 7.161.15+ Fix from $1,9502026-07-27 CRITICAL 9.8 CVE-2026-66014 JFrog Artifactory contains an authentication handling weakness in internal request processing that, under specific conditions, may allow an attacker … Artifactory 7.111.18 / 7.117.25+ Fix from $2,3002026-07-27 MEDIUM 6.5 CVE-2026-65925 A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response. Artifactory 7.111.18 / 7.117.25+ Fix from $1,6002026-07-27 MEDIUM 6.5 CVE-2026-65924 JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user … Artifactory 7.111.18 / 7.117.25+ Fix from $1,6002026-07-27 MEDIUM 6.8 CVE-2026-65923 A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause … Artifactory 7.111.18 / 7.117.25+ Fix from $1,6002026-07-27 MEDIUM 5.4 CVE-2026-65922 An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted in… Artifactory 7.111.18 / 7.117.25+ Fix from $1,6002026-07-27 HIGH 8.8 CVE-2026-65921 A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build arti… Artifactory 7.111.18 / 7.117.25+ Fix from $1,9502026-07-27 MEDIUM 6.5 CVE-2026-65618 Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifacto… Artifactory 7.133.6+ Fix from $1,6002026-07-27 HIGH 8.8 CVE-2026-65617 A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availabi… Artifactory 7.111.18 / 7.117.25+ Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-65616 Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. Artifactory 7.146.27+ Fix from $1,9502026-07-27 MEDIUM 6.5 CVE-2026-64649 Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server A… Next.js 15.5.21 / 16.2.11+ Fix from $1,6002026-07-27 MEDIUM 5.4 CVE-2026-64648 Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side … Next.js 15.5.21 / 16.2.11+ Fix from $1,6002026-07-27 MEDIUM 5.1 CVE-2026-59729 Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in rende… Patch available Fix from $1,6002026-07-27 HIGH 8.8 CVE-2026-56748 Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack i… Cribl Stream 4.18.2+ Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-56747 Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker … Cribl Stream 4.18.2+ Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-42017 An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions. Artifactory 7.133.21 / 7.146.8+ Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-42016 JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signa… Artifactory 7.133.11+ Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-66759 A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data… Enterprise Linux No fix yet Fix from $1,9502026-07-27 HIGH 7.8 CVE-2026-66758 A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bi… Enterprise Linux No fix yet Fix from $1,9502026-07-27 MEDIUM 5.5 CVE-2026-66757 A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image … Enterprise Linux No fix yet Fix from $1,6002026-07-27 MEDIUM 5.4 CVE-2026-66031 Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject… No fix yet Fix from $1,6002026-07-27 MEDIUM 5.4 CVE-2026-64647 Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side f… Next.js 15.5.21 / 16.2.11+ Fix from $1,6002026-07-27 MEDIUM 5.3 CVE-2026-64646 Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests target… Next.js 15.5.21 / 16.2.11+ Fix from $1,6002026-07-27 HIGH 7.5 CVE-2026-51244 schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackFrameHeader(). Multiple attacker-controlled index parameters are used … No fix yet Fix from $1,9502026-07-27 MEDIUM 6.9 CVE-2026-17612 Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vuln… No fix yet Fix from $1,6002026-07-27