Browse CVEs

HIGH 8.5 CVE-2026-17192 A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to intern… No fix yet Fix from $1,9502026-07-27 CRITICAL 9.1 CVE-2026-17191 An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend q… No fix yet Fix from $2,3002026-07-27 MEDIUM 6.5 CVE-2026-66399 phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-ma… No fix yet Fix from $1,6002026-07-27 CRITICAL 9.4 CVE-2026-66398 phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGUR… No fix yet Fix from $2,3002026-07-27 HIGH 8.6 CVE-2026-66397 phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attacker… No fix yet Fix from $1,9502026-07-27 HIGH 8.4 CVE-2026-66396 SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cr… Mitigation only Fix from $1,9502026-07-27 CRITICAL 9.6 CVE-2026-66395 SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to exe… No fix yet Fix from $2,3002026-07-27 HIGH 8.7 CVE-2026-66394 SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to ex… No fix yet Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-59251 Allocation of resources without limits in Erlang/OTP public_key certificate path validation allows a remote unauthenticated attacker to cause denial … Erlang\/otp 1.17.1.5 / 1.20.3.4+ Fix from $1,9502026-07-27 HIGH 8.3 CVE-2026-59250 Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and p… Patch available Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-58227 The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl… Erlang\/otp 11.2.12.11 / 11.6.0.4+ Fix from $1,9502026-07-27 HIGH 7.4 CVE-2026-55953 The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the su… Erlang\/otp 11.2.12.11 / 11.6.0.4+ Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-55737 Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang exter… Erlang\/otp 15.2.7.11 / 16.4.0.4+ Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-54890 Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Ov… Erlang\/otp 15.2.7.11 / 16.4.0.4+ Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-51302 SQLite 3.41 has a use-after-free vulnerability exists in the expression evaluation logic. The sqlite3ReleaseTempReg function improperly releases temp… SQLite No fix yet Fix from $1,9502026-07-27 CRITICAL 9.1 CVE-2026-51300 A use-after-free vulnerability exists in the expression parsing and memory management logic of SQLite 3.41. After invoking sqlite3ExprDelete to relea… Mitigation only Fix from $2,3002026-07-27 HIGH 7.5 CVE-2026-51304 sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprLi… SQLite No fix yet Fix from $1,9502026-07-27 CRITICAL 9.8 CVE-2026-51303 A use-after-free (UAF) vulnerability was discovered in the core parsing component of SQLite 3.41. The flaw occurs because the program frees an ExprLi… No fix yet Fix from $2,3002026-07-27 MEDIUM 6.2 CVE-2026-51298 sqlite 3.41 is vulnerable to use after free in the JSON extraction function. After releasing JsonParse object memory via jsonParseFree(), the program… SQLite No fix yet Fix from $1,6002026-07-27 HIGH 7.5 CVE-2026-51296 SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575… SQLite Patch available Fix from $1,9502026-07-27 HIGH 8.8 CVE-2026-51297 sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free … SQLite Mitigation only Fix from $1,9502026-07-27 HIGH 7.5 CVE-2026-42792 Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminat… Erlang\/otp 15.2.7.11 / 16.4.0.4+ Fix from $1,9502026-07-27 MEDIUM 5.5 CVE-2026-17573 A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack … Hdf5 2.2.0+ Fix from $1,6002026-07-27 MEDIUM 5.5 CVE-2026-17574 HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length dataty… Hdf5 2.1.1+ Fix from $1,6002026-07-27 MEDIUM 5.5 CVE-2026-17572 Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of s… Hdf5 2.2.0+ Fix from $1,6002026-07-27 MEDIUM 6.3 CVE-2026-17530 A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the… Patch available Fix from $1,6002026-07-27 MEDIUM 6.3 CVE-2026-17529 A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The … Patch available Fix from $1,6002026-07-27 CRITICAL 10.0 CVE-2026-16812 KEV VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality an… Velocloud Orchestrator 5.2.3.14 / 6.1.3.4+ Fix from $2,3002026-07-27 CRITICAL 9.1 CVE-2025-50455 SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vuln… No fix yet Fix from $2,3002026-07-27 MEDIUM 5.3 CVE-2026-66477 Unauthenticated Broken Access Control in Gillion <= 4.13 versions. No fix yet Fix from $1,6002026-07-27