Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
20714
Total
1493
Critical
6288
High
6559
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-56779 | MEDIUM | 6.4 | MaxKB before 2.10.0 contains a server-side request forgery vulnerability in tool creation and update endpoints that allows authenticated users to make arbitrary server requests by … | Jun 25, 2026 |
| CVE-2026-56774 | MEDIUM | 5.4 | Kanboard through 1.2.52, fixed in commit 928c68a, UserViewController::removeSession fails to validate the session id parameter before passing it to RememberMeSessionModel::remove, allowing authenticated users to delete … | Jun 25, 2026 |
| CVE-2026-56772 | MEDIUM | 4.3 | NewsBlur before 14.5.0 contains a broken access control vulnerability that allows authenticated users to read private notification feeds by supplying arbitrary user_id values to the … | Jun 25, 2026 |
| CVE-2026-56771 | HIGH | 8.5 | NewsBlur before version 14.5.0 contains a server-side request forgery vulnerability in the add_url endpoint that allows authenticated users to make arbitrary server requests to internal … | Jun 25, 2026 |
| CVE-2026-56770 | HIGH | 7.5 | libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote … | Jun 25, 2026 |
| CVE-2026-56769 | HIGH | 8.5 | Huly Platform through 0.7.423, fixed in commit 68cbf8a contains an authenticated server-side request forgery vulnerability in the /import endpoint of front pod that allows workspace … | Jun 25, 2026 |
| CVE-2026-56768 | HIGH | 8.8 | Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the … | Jun 25, 2026 |
| CVE-2026-56767 | HIGH | 8.8 | Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' … | Jun 25, 2026 |
| CVE-2026-56766 | HIGH | 8.8 | Hydra through 9.7, fixed in commit 9cc84c2, contains a stack buffer overflow in NTLM authentication across SMTP, POP3, IMAP, NNTP, HTTP, HTTP-Proxy, and HTTP-Proxy-Urlenum modules … | Jun 25, 2026 |
| CVE-2026-55667 | HIGH | 8.2 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin … | Jun 25, 2026 |
| CVE-2026-54917 | UNKNOWN | — | SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg … | Jun 25, 2026 |
| CVE-2026-54250 | MEDIUM | 5.8 | K3s is a fully conformant production-ready Kubernetes distribution. Prior to 1.35.3+k3s1, 1.34.6+k3s1, v1.33.10+k3s1, a path traversal vulnerability exists in K3s's etcd snapshot decompression functionality. Zip … | Jun 25, 2026 |
| CVE-2026-54097 | UNKNOWN | — | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated … | Jun 25, 2026 |
| CVE-2026-54096 | HIGH | 8.4 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST /api/share/<path>` accepts … | Jun 25, 2026 |
| CVE-2026-54094 | HIGH | 7.5 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not … | Jun 25, 2026 |
| CVE-2026-54093 | UNKNOWN | — | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, filebrowser builds the … | Jun 25, 2026 |
| CVE-2026-54092 | MEDIUM | 6.5 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unchecked passwords maximums … | Jun 25, 2026 |
| CVE-2026-54091 | HIGH | 7.5 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, File Browser's public … | Jun 25, 2026 |
| CVE-2026-54090 | UNKNOWN | — | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell … | Jun 25, 2026 |
| CVE-2026-54089 | CRITICAL | 9.1 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is … | Jun 25, 2026 |
| CVE-2026-54088 | UNKNOWN | — | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication … | Jun 25, 2026 |
| CVE-2026-53925 | HIGH | 7.8 | Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_popen() function in glances/secure.py interprets > (file redirection), | (pipe), and && … | Jun 25, 2026 |
| CVE-2026-50549 | CRITICAL | 9.8 | Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a … | Jun 25, 2026 |
| CVE-2026-50548 | CRITICAL | 9.8 | Cursor is a code editor built for programming with AI. Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the … | Jun 25, 2026 |
| CVE-2026-4930 | UNKNOWN | — | SYMCRYPTO is the SiXG301's host side hardware engine accessed by PSA crypto library that accelerates symmetric cryptographic operations (AES encryption/decryption and hashing). DPA Countermeasures on … | Jun 25, 2026 |