Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
21839
Total
1559
Critical
6635
High
6967
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-56695 | MEDIUM | 6.5 | OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary session snapshots by ID. … | Jun 23, 2026 |
| CVE-2026-56694 | MEDIUM | 5.4 | NanoClaw before 2.1.0 contains a privilege escalation vulnerability in the channel-registration approval flow where handleChannelApprovalResponse fails to validate admin privileges over target agent groups. Scoped … | Jun 23, 2026 |
| CVE-2026-56693 | MEDIUM | 5.5 | NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the create_agent delivery-action handler that performs privileged central-database writes without host-side authorization checks. Confined agent containers … | Jun 23, 2026 |
| CVE-2026-56692 | MEDIUM | 5.5 | NanoClaw before 2.1.17 contains a symlink following vulnerability in forwardAttachedFiles that allows container-controlled agents to exfiltrate host-readable files. The host validates attachment filenames using only … | Jun 23, 2026 |
| CVE-2026-56402 | MEDIUM | 6.5 | NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization. Attackers with a valid questionId can … | Jun 23, 2026 |
| CVE-2026-55767 | MEDIUM | 5.8 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading … | Jun 23, 2026 |
| CVE-2026-55766 | MEDIUM | 4.8 | guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Prior to 2.12.1, guzzlehttp/psr7 did not reject CR/LF characters in certain first-party HTTP start-line fields: … | Jun 23, 2026 |
| CVE-2026-55568 | MEDIUM | 5.9 | Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in certain configurations, traffic expected to be protected by TLS on the hop to the … | Jun 23, 2026 |
| CVE-2026-54314 | UNKNOWN | — | n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlled archives into memory without enforcing limits on … | Jun 23, 2026 |
| CVE-2026-54313 | UNKNOWN | — | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a malicious filter value in … | Jun 23, 2026 |
| CVE-2026-54312 | UNKNOWN | — | n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows could achieve global prototype … | Jun 23, 2026 |
| CVE-2026-54311 | UNKNOWN | — | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could pollute … | Jun 23, 2026 |
| CVE-2026-54310 | UNKNOWN | — | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply … | Jun 23, 2026 |
| CVE-2026-54309 | UNKNOWN | — | n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts … | Jun 23, 2026 |
| CVE-2026-54303 | UNKNOWN | — | n8n is an open source workflow automation platform. Prior to 2.24.0, an endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter … | Jun 23, 2026 |
| CVE-2026-52673 | MEDIUM | 6.5 | SQL Injection vulnerability in Cboard v.0.4.2 and before allows a remote attacker to execute arbitrary code via the getDimensionsValues component | Jun 23, 2026 |
| CVE-2025-62180 | UNKNOWN | — | Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional data via crafted … | Jun 23, 2026 |
| CVE-2025-55639 | MEDIUM | 6.5 | GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability allows attackers to cause a Denial … | Jun 23, 2026 |
| CVE-2025-15619 | LOW | 3.5 | HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario. | Jun 23, 2026 |
| CVE-2026-56815 | HIGH | 7.4 | pwnlift before d7a9544, in a privileged deployment, contains a symlink following vulnerability in the upload handler in Components/Pages/Home.razor. | Jun 23, 2026 |
| CVE-2026-35019 | HIGH | 8.1 | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authentication bypass vulnerability that allows unauthenticated attackers to gain administrative access by exploiting a hardcoded … | Jun 23, 2026 |
| CVE-2026-35018 | HIGH | 8.8 | NetComm NF20MESH routers running firmware R6B031 and earlier contain an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands as root … | Jun 23, 2026 |
| CVE-2026-28496 | UNKNOWN | — | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 have a Server-Side Template Injection (SSTI) vulnerability in the template rendering … | Jun 23, 2026 |
| CVE-2026-27604 | UNKNOWN | — | FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the API … | Jun 23, 2026 |
| CVE-2026-12969 | MEDIUM | 5.3 | An out-of-bounds read vulnerability exists in dnsmasq's find_soa() function in src/rfc1035.c. When parsing NS section records, extract_name() is called with extrabytes=0, failing to validate that … | Jun 23, 2026 |