Browse CVEs

HIGH 8.4 CVE-2026-16481 A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-… Patch available Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-12383 A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowA… No fix yet Fix from $1,9502026-07-27 HIGH 7.8 CVE-2026-10682 The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the … Zephyr 4.5.0+ Fix from $1,9502026-07-27 MEDIUM 5.4 CVE-2026-66030 Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to injec… No fix yet Fix from $1,6002026-07-27 MEDIUM 5.4 CVE-2026-66029 Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject… No fix yet Fix from $1,6002026-07-27 MEDIUM 6.7 CVE-2026-66028 Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to cr… No fix yet Fix from $1,6002026-07-27 MEDIUM 6.1 CVE-2026-64645 Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() o… Next.js 15.5.21 / 16.2.11+ Fix from $1,6002026-07-27 MEDIUM 5.3 CVE-2026-64644 Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosti… Next.js 15.5.21 / 16.2.11+ Fix from $1,6002026-07-27 MEDIUM 5.3 CVE-2026-64643 Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applica… Next.js 15.5.21 / 16.2.11+ Fix from $1,6002026-07-27 HIGH 8.2 CVE-2026-64642 Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applica… Next.js 16.2.11+ Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-64641 Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted request… Next.js 15.5.21 / 16.2.11+ Fix from $1,9502026-07-27 HIGH 8.6 CVE-2026-59239 Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user … Patch available Fix from $1,9502026-07-27 CRITICAL 9.8 CVE-2026-55579 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default… No fix yet Fix from $2,3002026-07-27 HIGH 8.8 CVE-2026-55578 Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses a… No fix yet Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-54540 Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass… No fix yet Fix from $1,9502026-07-27 MEDIUM 6.9 CVE-2026-54272 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF thr… No fix yet Fix from $1,6002026-07-27 HIGH 8.8 CVE-2026-51235 LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and fuji_rotate() function (src/decoders/fuji.cpp). No fix yet Fix from $1,9502026-07-27 MEDIUM 5.4 CVE-2026-48052 Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organizatio… Patch available Fix from $1,6002026-07-27 CRITICAL 9.9 CVE-2026-48030EPSS 5% Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability i… No fix yet Fix from $2,3002026-07-27 CRITICAL 9.1 CVE-2026-45623 PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.… Postcss 8.5.12+ Fix from $2,3002026-07-27 HIGH 8.8 CVE-2026-17568 Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the … Devolutions Server 2026.1.24.0 / 2026.2.14.0+ Fix from $1,9502026-07-27 CRITICAL 9.1 CVE-2026-17552 Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewr… Patch available Fix from $2,3002026-07-27 HIGH 7.5 CVE-2026-66731 facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated … No fix yet Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-66730 facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker t… No fix yet Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-66729 facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attacke… No fix yet Fix from $1,9502026-07-27 MEDIUM 6.5 CVE-2026-66391 Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 throu… Wicket 10.10.0+ Fix from $1,6002026-07-27 MEDIUM 6.1 CVE-2026-66390 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicke… Wicket 10.10.0+ Fix from $1,6002026-07-27 CRITICAL 9.8 CVE-2026-63077 KEVEPSS 12% In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol Teamcity 2025.11.7 / 2026.1.3+ Fix from $2,3002026-07-27 HIGH 7.8 CVE-2026-24252 NVIDIA NeMo for Linux contains a vulnerability where an attacker may cause OS command injection. A successful exploit of this vulnerability may lead … No fix yet Fix from $1,9502026-07-27 MEDIUM 5.0 CVE-2026-17531 A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/route… No fix yet Fix from $1,6002026-07-27