Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
56054
Total
4437
Critical
16638
High
16408
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-88746 | HIGH | 7.1 | idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php. | Sep 21, 2026 |
| CVE-2026-88745 | MEDIUM | 6.1 | EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. | Sep 21, 2026 |
| CVE-2026-88467 | UNKNOWN | — | CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information. | Sep 21, 2026 |
| CVE-2026-88412 | MEDIUM | 5.3 | An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via a crafted … | Sep 21, 2026 |
| CVE-2026-88411 | HIGH | 7.5 | Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application. | Sep 21, 2026 |
| CVE-2026-88410 | HIGH | 7.1 | The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application. | Sep 21, 2026 |
| CVE-2026-88409 | HIGH | 8.8 | FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a … | Sep 21, 2026 |
| CVE-2026-88408 | MEDIUM | 6.5 | FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attackers to cause a … | Sep 21, 2026 |
| CVE-2026-88407 | HIGH | 7.5 | An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a … | Sep 21, 2026 |
| CVE-2026-88406 | HIGH | 7.5 | FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a … | Sep 21, 2026 |
| CVE-2026-88405 | UNKNOWN | — | A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload. | Sep 21, 2026 |
| CVE-2026-88404 | CRITICAL | 9.8 | A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload. | Sep 21, 2026 |
| CVE-2026-88403 | MEDIUM | 6.5 | A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request. | Sep 21, 2026 |
| CVE-2026-88402 | CRITICAL | 9.8 | A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements. | Sep 21, 2026 |
| CVE-2026-79919 | MEDIUM | 6.3 | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder … | Sep 21, 2026 |
| CVE-2026-79918 | MEDIUM | 6.3 | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat to prevent subprocess creation … | Sep 21, 2026 |
| CVE-2026-79917 | MEDIUM | 6.5 | MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a conversation exists but does not verify that it … | Sep 21, 2026 |
| CVE-2026-79916 | CRITICAL | 9.1 | MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields … | Sep 21, 2026 |
| CVE-2026-79317 | MEDIUM | 4.8 | A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a … | Sep 21, 2026 |
| CVE-2026-79316 | HIGH | 7.6 | An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger … | Sep 21, 2026 |
| CVE-2026-77525 | MEDIUM | 4.2 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load records using global chat_id … | Sep 21, 2026 |
| CVE-2026-77523 | HIGH | 7.4 | MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but ModelSerializer.ModelParams loads … | Sep 21, 2026 |
| CVE-2026-77522 | MEDIUM | 4.3 | MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's … | Sep 21, 2026 |
| CVE-2026-77521 | CRITICAL | 10.0 | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes … | Sep 21, 2026 |
| CVE-2026-77520 | MEDIUM | 5.4 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id from … | Sep 21, 2026 |