Browse CVEs

HIGH 8.6 CVE-2026-28698 Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which… No fix yet Fix from $1,9502026-07-23 MEDIUM 6.5 CVE-2026-16767 A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the componen… No fix yet Fix from $1,6002026-07-23 HIGH 7.5 CVE-2026-65694 Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to r… Patch available Fix from $1,9502026-07-23 HIGH 8.2 CVE-2026-65604 Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies… No fix yet Fix from $1,9502026-07-23 CRITICAL 9.9 CVE-2026-63732 9router 0.4.59 (fixed in 0.4.60) contains a chain of vulnerabilities: a hardcoded default password (123456) that authenticates any fresh installation… No fix yet Fix from $2,3002026-07-23 HIGH 8.8 CVE-2026-16807 Out of bounds write in Codecs in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to potentially perform a sandbox escape via a crafte… Chrome 150.0.7871.186+ Fix from $1,9502026-07-23 HIGH 8.8 CVE-2026-16806 Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted … Chrome 150.0.7871.186+ Fix from $1,9502026-07-23 HIGH 8.8 CVE-2026-16805 Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… Chrome 150.0.7871.186+ Fix from $1,9502026-07-23 HIGH 8.3 CVE-2026-16804 Use after free in Input in Google Chrome prior to 150.0.7871.186 allowed a remote attacker who had compromised the renderer process to potentially pe… Chrome 150.0.7871.186+ Fix from $1,9502026-07-23 HIGH 7.7 CVE-2026-63313 9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controll… No fix yet Fix from $1,9502026-07-23 HIGH 7.3 CVE-2026-16765 A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/l… No fix yet Fix from $1,9502026-07-23 MEDIUM 6.3 CVE-2026-16764 A vulnerability was identified in OWASP DefectDojo 2.59.0. This issue affects the function UserSerializer of the file dojo/api_v2/serializers.py of t… Patch available Fix from $1,6002026-07-23 MEDIUM 5.3 CVE-2026-16763 A vulnerability was identified in localstack serverless-localstack up to 1.4.0. The affected element is an unknown function of the file src/index.js … No fix yet Fix from $1,6002026-07-23 CRITICAL 10.0 CVE-2025-71389 Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Serv… Patch available Fix from $2,3002026-07-23 HIGH 8.9 CVE-2024-58355 Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.… Patch available Fix from $1,9502026-07-23 CRITICAL 9.9 CVE-2024-58354 cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow p… Patch available Fix from $2,3002026-07-23 HIGH 8.9 CVE-2024-58353 Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view … Patch available Fix from $1,9502026-07-23 CRITICAL 9.8 CVE-2026-52439 An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism No fix yet Fix from $2,3002026-07-23 HIGH 8.7 CVE-2026-6924 A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code u… No fix yet Fix from $1,9502026-07-23 MEDIUM 6.5 CVE-2026-50103 A NULL pointer dereference in the L2 GOOSE and R-GOOSE shared parser, which may allow a network-adjacent attacker to crash a subscribing application … No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-39155 Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contains a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly. … No fix yet Fix from $1,6002026-07-23 HIGH 7.8 CVE-2026-38764 An issue in Unistal Systems Pvt. Ltd.Protegent 360 v2.0.0.4 allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys No fix yet Fix from $1,9502026-07-23 HIGH 7.5 CVE-2026-50039 The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to cause a memory corruption via a Read Request. No fix yet Fix from $1,9502026-07-23 HIGH 7.5 CVE-2026-50032 A NULL pointer dereference in the MMS Write Named Variable List handler, which may allow a network adjacent attacker to crash the server by sending a… No fix yet Fix from $1,9502026-07-23 HIGH 8.1 CVE-2026-49035 The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) has been demonstra… No fix yet Fix from $1,9502026-07-23 CRITICAL 9.9 CVE-2026-47724 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trust… Patch available Fix from $2,3002026-07-23 HIGH 7.1 CVE-2026-47723 nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in `inte… Patch available Fix from $1,9502026-07-23 HIGH 7.1 CVE-2026-34496 Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1. No fix yet Fix from $1,9502026-07-23 HIGH 8.7 CVE-2026-21655 Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Applic… No fix yet Fix from $1,9502026-07-23 HIGH 7.2 CVE-2026-21653 Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery. This issue affects CCure … No fix yet Fix from $1,9502026-07-23