Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
54305
Total
4306
Critical
16147
High
15838
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-101048 | MEDIUM | 5.4 | Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. … | Sep 27, 2026 |
| CVE-2026-101047 | MEDIUM | 5.3 | Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited … | Sep 27, 2026 |
| CVE-2026-101046 | LOW | 3.1 | Fleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET /api/v1/fleet/hosts/{id}/activities). The deprecated cursor-pagination helper appendListOptionsWithCursorToSQL interpolated the … | Sep 27, 2026 |
| CVE-2026-101045 | HIGH | 8.0 | Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the script generator escaped this metadata … | Sep 27, 2026 |
| CVE-2026-101044 | HIGH | 7.1 | pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile … | Sep 27, 2026 |
| CVE-2026-101043 | HIGH | 7.4 | pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. … | Sep 27, 2026 |
| CVE-2026-88778 | UNKNOWN | — | Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 … | Sep 27, 2026 |
| CVE-2026-88777 | UNKNOWN | — | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before … | Sep 27, 2026 |
| CVE-2026-88776 | UNKNOWN | — | Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before … | Sep 27, 2026 |
| CVE-2026-88775 | CRITICAL | 9.8 | Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 … | Sep 27, 2026 |
| CVE-2026-88774 | HIGH | 7.2 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and … | Sep 27, 2026 |
| CVE-2026-88773 | CRITICAL | 10.0 | Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, … | Sep 27, 2026 |
| CVE-2026-88772 | HIGH | 8.1 | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and … | Sep 27, 2026 |
| CVE-2026-88771 | CRITICAL | 9.8 | Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before … | Sep 27, 2026 |
| CVE-2026-101050 | MEDIUM | 6.5 | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can … | Sep 27, 2026 |
| CVE-2026-101049 | MEDIUM | 6.5 | Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send … | Sep 27, 2026 |
| CVE-2026-101042 | MEDIUM | 6.4 | Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters (GitHub, Google Play … | Sep 27, 2026 |
| CVE-2026-101041 | UNKNOWN | — | The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the consumption of single-use recovery tokens. The … | Sep 27, 2026 |
| CVE-2026-101033 | MEDIUM | 4.3 | KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs … | Sep 27, 2026 |
| CVE-2026-101032 | HIGH | 7.0 | navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell metacharacters through crafted file names … | Sep 27, 2026 |
| CVE-2026-100872 | HIGH | 7.5 | Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. … | Sep 27, 2026 |
| CVE-2026-100871 | HIGH | 8.8 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin and Shop API endpoints. … | Sep 27, 2026 |
| CVE-2026-100870 | HIGH | 8.8 | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect … | Sep 27, 2026 |
| CVE-2026-100869 | MEDIUM | 5.9 | Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. … | Sep 27, 2026 |
| CVE-2026-100868 | MEDIUM | 6.3 | Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can … | Sep 27, 2026 |