Browse CVEs

HIGH 8.7 CVE-2026-55730 Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to exec… No fix yet Fix from $1,9502026-07-24 HIGH 7.7 CVE-2026-55729 Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthentica… No fix yet Fix from $1,9502026-07-24 MEDIUM 6.5 CVE-2026-49326 Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, f… Hbase 2.5.15 / 2.6.6+ Fix from $1,6002026-07-24 MEDIUM 6.5 CVE-2026-17059 A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access managem… Build Of Keycloak No fix yet Fix from $1,6002026-07-24 MEDIUM 6.5 CVE-2026-16802 Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor wit… Powershell Universal 2026.2.3.0+ Fix from $1,6002026-07-24 HIGH 8.8 CVE-2026-16801 Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an… Powershell Universal 2026.2.3.0+ Fix from $1,9502026-07-24 HIGH 8.8 CVE-2026-16800 Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an … Powershell Universal 2026.2.3.0+ Fix from $1,9502026-07-24 MEDIUM 5.0 CVE-2026-16799 Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticat… Powershell Universal 2026.2.3.0+ Fix from $1,6002026-07-24 MEDIUM 6.5 CVE-2026-16798 Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authe… Powershell Universal 2026.2.3.0+ Fix from $1,6002026-07-24 HIGH 8.4 CVE-2026-12504 Improper Authentication (CWE-287) in the PAM configuration in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 … No fix yet Fix from $1,9502026-07-24 CRITICAL 9.2 CVE-2026-12503 Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter` in Loytec L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on LINX-A6… No fix yet Fix from $2,3002026-07-24 HIGH 8.4 CVE-2026-12502 Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.1… No fix yet Fix from $1,9502026-07-24 HIGH 8.7 CVE-2026-12496 Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD t… No fix yet Fix from $1,9502026-07-24 MEDIUM 5.5 CVE-2026-17048 A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requ… No fix yet Fix from $1,6002026-07-24 HIGH 7.1 CVE-2026-9765 Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can acce… No fix yet Fix from $1,9502026-07-24 MEDIUM 5.3 CVE-2026-7484 External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Cons… No fix yet Fix from $1,6002026-07-24 HIGH 7.5 CVE-2026-66144 Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of … Neethi 3.2.3+ Fix from $1,9502026-07-24 HIGH 7.5 CVE-2026-66143 It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies… Neethi No fix yet Fix from $1,9502026-07-24 HIGH 7.5 CVE-2026-66142 Apache Neethi is vulnerable to uncontrolled recursion when parsing policies that lack policy Ids or with deeply nested structures, which may lead to … Neethi 3.2.3+ Fix from $1,9502026-07-24 MEDIUM 6.1 CVE-2026-66010 DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing at… Dompurify 3.4.12+ Fix from $1,6002026-07-24 MEDIUM 6.3 CVE-2026-66009 Parse Server versions >= 9.0.0 before 9.10.0-alpha.5 and >= 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom in… No fix yet Fix from $1,6002026-07-24 MEDIUM 6.3 CVE-2026-66008 Parse Server versions >= 9.0.0 before 9.10.0-alpha.6 and >= 8.2.2 before 8.6.87 disclose Pointer and Relation target class names through GraphQL vali… No fix yet Fix from $1,6002026-07-24 MEDIUM 5.3 CVE-2026-46452 Improper Input Validation vulnerability in Apache NimBLE in Mesh Proxy SAR reassembly could result in passing broken data toward application resultin… Nimble 1.10.0+ Fix from $1,6002026-07-24 HIGH 7.5 CVE-2026-45816 NULL Pointer Dereference vulnerability in Apache NimBLE in LE Long Term Key Request event. This requires disabled asserts (otherwise assert would tr… Nimble 1.10.0+ Fix from $1,9502026-07-24 HIGH 7.5 CVE-2026-45815 Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigge… Nimble 1.10.0+ Fix from $1,9502026-07-24 HIGH 8.8 CVE-2026-45813 Out-of-bounds Write, Integer Underflow (Wrap or Wraparound) vulnerability in Apache NimBLE BASS service. Improper validation when parsing BASS servic… Nimble 1.10.0+ Fix from $1,9502026-07-24 MEDIUM 6.5 CVE-2026-45812 Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertisi… Nimble 1.10.0+ Fix from $1,6002026-07-24 HIGH 7.5 CVE-2026-45811 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. The HCI socket transport did not check whether… Nimble 1.10.0+ Fix from $1,9502026-07-24 MEDIUM 5.5 CVE-2026-16743 A flaw was found in accountsservice. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and pr… No fix yet Fix from $1,6002026-07-24 MEDIUM 5.5 CVE-2026-16730 A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are… No fix yet Fix from $1,6002026-07-24