Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
25141
Total
1807
Critical
7694
High
7894
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-36609 | HIGH | 7.3 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 uses a static authentication nonce that does not change between requests from the same source IP. Combined … | Jun 03, 2026 |
| CVE-2026-36608 | HIGH | 8.8 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows UPnP AddPortMapping to forward external ports to the router's own admin interface by accepting its own … | Jun 03, 2026 |
| CVE-2026-36607 | HIGH | 8.8 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint (code=10), which lacks the rate limiting applied … | Jun 03, 2026 |
| CVE-2026-36606 | HIGH | 7.1 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 encrypts configuration backups with a hardcoded DES key using single DES in ECB mode. An attacker who … | Jun 03, 2026 |
| CVE-2026-36605 | MEDIUM | 6.5 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low number of crafted incomplete HTTP requests, … | Jun 03, 2026 |
| CVE-2026-36604 | MEDIUM | 6.5 | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a … | Jun 03, 2026 |
| CVE-2026-36603 | UNKNOWN | — | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 exposes 15 of 18 UPnP IGD actions without authentication on port 1900, including AddPortMapping and GetExternalIPAddress. UPnP … | Jun 03, 2026 |
| CVE-2026-36602 | UNKNOWN | — | Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInfo action. An unauthenticated attacker on the adjacent network can … | Jun 03, 2026 |
| CVE-2026-36460 | UNKNOWN | — | Dovestones Softwares ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript … | Jun 03, 2026 |
| CVE-2026-20233 | MEDIUM | 6.1 | A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. … | Jun 03, 2026 |
| CVE-2026-20230 | HIGH | 8.6 | A vulnerability in Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could allow an unauthenticated, remote … | Jun 03, 2026 |
| CVE-2026-20175 | MEDIUM | 6.1 | A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session on an … | Jun 03, 2026 |
| CVE-2025-71314 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Recover from panthor_gpu_flush_caches() failures We have seen a few cases where the whole memory … | Jun 03, 2026 |
| CVE-2025-71313 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Add missing NULL check for alloc_workqueue() alloc_workqueue() can return NULL on memory allocation … | Jun 03, 2026 |
| CVE-2019-25720 | MEDIUM | 6.5 | Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allows … | Jun 03, 2026 |
| CVE-2026-6657 | MEDIUM | 6.1 | A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used. The issue arises … | Jun 03, 2026 |
| CVE-2026-44281 | UNKNOWN | — | GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with … | Jun 03, 2026 |
| CVE-2026-42321 | UNKNOWN | — | GLPI is a free asset and IT management software package. Starting in version 10.0.4 and prior to version 10.0.25, a technician can store an XSS … | Jun 03, 2026 |
| CVE-2026-42320 | UNKNOWN | — | GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read … | Jun 03, 2026 |
| CVE-2026-42318 | UNKNOWN | — | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with … | Jun 03, 2026 |
| CVE-2026-42317 | UNKNOWN | — | GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete … | Jun 03, 2026 |
| CVE-2026-3276 | UNKNOWN | — | unicodedata.normalize() can take excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This … | Jun 03, 2026 |
| CVE-2026-37462 | HIGH | 7.3 | An integer underflow in the BGPUpdate.DecodeFromBytes function (/bgp/bgp.go) of gobgp v4.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP … | Jun 03, 2026 |
| CVE-2026-36748 | CRITICAL | 9.0 | RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Site Scripting (XSS) via Social Media links in user profile. | Jun 03, 2026 |
| CVE-2026-36576 | CRITICAL | 9.8 | An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to execute arbitrary commands via a crafted … | Jun 03, 2026 |