Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
20369
Total
1466
Critical
6173
High
6472
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-50160 | CRITICAL | 10.0 | Hoppscotch is an API development ecosystem. In self-hosted deployments of hoppscotch-backend from version 2026.4.1 and earlier, the unauthenticated POST /v1/onboarding/config endpoint is vulnerable to mass … | Jul 01, 2026 |
| CVE-2026-49119 | HIGH | 7.5 | Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by … | Jul 01, 2026 |
| CVE-2026-47262 | UNKNOWN | — | containerd is an open-source container runtime. Versions prior to 1.7.33, 2.0.10, 2.1.9, 2.2.5 and 2.3.2, contain a vulnerability that allows a maliciously crafted image to … | Jul 01, 2026 |
| CVE-2026-41121 | HIGH | 7.3 | Dell Device Management Agent, versions prior to DDMA 26.05, contain an Improper Link Resolution Before File Access ('Link Following’) vulnerability. A low privileged attacker with … | Jul 01, 2026 |
| CVE-2026-38142 | MEDIUM | 6.5 | An unauthenticated command injection vulnerability in the /goform/fast_setting_internet_set endpoint of Tenda AC18 v15.03.05.05 allows attackers to execute arbitrary commands via a crafted payload injected into … | Jul 01, 2026 |
| CVE-2026-14358 | UNKNOWN | — | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue … | Jul 01, 2026 |
| CVE-2026-13769 | MEDIUM | 5.5 | Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict … | Jul 01, 2026 |
| CVE-2026-13760 | HIGH | 7.3 | OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version … | Jul 01, 2026 |
| CVE-2026-5051 | MEDIUM | 4.4 | HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path … | Jul 01, 2026 |
| CVE-2026-58521 | UNKNOWN | — | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This … | Jul 01, 2026 |
| CVE-2026-58520 | UNKNOWN | — | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. This issue affects Mediawiki - UrlShortener … | Jul 01, 2026 |
| CVE-2026-57737 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta LTD Shortcodes and extra features for Phlox theme allows DOM-Based XSS. This … | Jul 01, 2026 |
| CVE-2026-57736 | HIGH | 7.4 | Insertion of Sensitive Information Into Sent Data vulnerability in HubSpot allows Retrieve Embedded Sensitive Data. This issue affects HubSpot: from n/a through 11.3.51. | Jul 01, 2026 |
| CVE-2026-57723 | HIGH | 7.4 | Cross-Site Request Forgery (CSRF) vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS allows Path Traversal. This issue affects VikBooking Hotel Booking Engine & PMS: … | Jul 01, 2026 |
| CVE-2026-57722 | MEDIUM | 5.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This issue affects Enable Media Replace: … | Jul 01, 2026 |
| CVE-2026-54428 | HIGH | 7.5 | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2 and earlier, 5.5-beta1 and earlier) allows an remote … | Jul 01, 2026 |
| CVE-2026-51946 | MEDIUM | 6.5 | SQL Injection vulnerability in GoAdminGroup GoAdmin (last release v1.2.26) allows a remote attacker to execute arbitrary code and obtain sensitive information via the the __sort_type … | Jul 01, 2026 |
| CVE-2026-49091 | HIGH | 8.0 | Improper Output Neutralization for Logs (CWE-117) in Kibana can lead to log injection via Log Injection-Tampering-Forging (CAPEC-93). An attacker can supply specially crafted input that … | Jul 01, 2026 |
| CVE-2026-49090 | MEDIUM | 6.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to a denial of service via Excessive Allocation (CAPEC-130). An authenticated user can submit a specially crafted … | Jul 01, 2026 |
| CVE-2026-46680 | UNKNOWN | — | containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be … | Jul 01, 2026 |
| CVE-2026-58454 | HIGH | 7.5 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a remote code execution vulnerability that allows authenticated attackers to execute arbitrary shell scripts by writing … | Jul 01, 2026 |
| CVE-2026-58453 | CRITICAL | 9.8 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adjacent attackers to gain unauthorized access by using the default … | Jul 01, 2026 |
| CVE-2026-58452 | HIGH | 8.8 | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by supplying … | Jul 01, 2026 |
| CVE-2026-57721 | MEDIUM | 5.3 | Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ApplyOnline: from n/a through 2.6.7.6. | Jul 01, 2026 |
| CVE-2026-57720 | MEDIUM | 4.3 | Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ThumbPress: from n/a through 6.3.2. | Jul 01, 2026 |