Total
409 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-55407 | 2026-07-05 | N/A | 7.8 HIGH | ||
| An issue in the DeviceloControl function of ITE Tech. Inc ITE IO Access v1.0.0.0 allows attackers to perform arbitrary port read and write actions via supplying crafted IOCTL requests. | |||||
| CVE-2024-48290 | 2026-07-05 | N/A | 4.3 MEDIUM | ||
| An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ll_terminate_ind packet. | |||||
| CVE-2026-11906 | 4 Ibm, Linux, Microsoft and 1 more | 4 Db2, Linux Kernel, Windows and 1 more | 2026-07-02 | N/A | 6.5 MEDIUM |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns. | |||||
| CVE-2026-57623 | 2026-07-02 | N/A | 9.0 CRITICAL | ||
| Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions. | |||||
| CVE-2026-57053 | 1 Gnu | 1 Libidn | 2026-06-29 | N/A | 4.0 MEDIUM |
| GNU libidn before 1.44 is prone to out-of-bounds reads of uninitialized memory in the ToUnicode APIs because of mishandling in idna_to_unicode_internal. The affected code is not present in libidn2. | |||||
| CVE-2026-12755 | 1 Devolutions | 1 Devolutions Server | 2026-06-29 | N/A | 2.7 LOW |
| Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter. | |||||
| CVE-2026-56035 | 2026-06-26 | N/A | 8.6 HIGH | ||
| Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions. | |||||
| CVE-2026-53540 | 1 Fastapiexpert | 1 Python-multipart | 2026-06-26 | N/A | 3.7 LOW |
| Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31. | |||||
| CVE-2026-9801 | 1 Redhat | 1 Build Of Keycloak | 2026-06-26 | N/A | 4.9 MEDIUM |
| A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could exploit this vulnerability. By sending a malformed LDAP password policy response during a password authentication request, the attacker can trigger an OutOfMemoryError. This causes the Keycloak Java Virtual Machine (JVM) to terminate, leading to a denial of service (DoS) for all realms on the affected node. | |||||
| CVE-2026-9704 | 1 Redhat | 1 Build Of Keycloak | 2026-06-26 | N/A | 6.8 MEDIUM |
| A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized subject_token JSON Web Token (JWT) to the TokenEndpoint. When the token exceeds a 4000-character limit, it is silently dropped, causing the system to fall back to client credentials. This allows the user to gain the permissions of the client's service account, leading to privilege escalation. | |||||
| CVE-2026-54092 | 2026-06-26 | N/A | 6.5 MEDIUM | ||
| File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after testing, crashes, heavily lags any container created, and has even made my docker daemon start to send errors with status code 500 even after the container was destroyed. This vulnerability is fixed in 2.63.6. | |||||
| CVE-2026-57062 | 2026-06-25 | N/A | 2.9 LOW | ||
| CMS (Cryptographic Message Syntax) parsing in gpgsm in GnuPG through 2.5.20 mishandles the CMS format for AES-GCM because aes-ICVlen is supposed to be 12 bytes but 4 bytes is accepted. NOTE: this is related to CVE-2026-34182. | |||||
| CVE-2026-7254 | 1 Ibm | 1 Openbmc | 2026-06-17 | N/A | 5.3 MEDIUM |
| IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users. | |||||
| CVE-2026-6915 | 1 Mongodb | 1 Mongodb | 2026-06-17 | N/A | 6.3 MEDIUM |
| An authorization flaw in the user management command could allow an authenticated user to make limited changes to authentication-related data associated with another user account. This could affect how authentication is performed for the impacted account. | |||||
| CVE-2026-6839 | 1 Samsung | 1 One | 2026-06-17 | N/A | 6.6 MEDIUM |
| Improper validation of STRING tensor offsets could allows malformed string metadata to trigger out of bounds access during constant tensor import in Samsung Open Source ONE Affected version is prior to commit 1.30.0. | |||||
| CVE-2026-49110 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions. | |||||
| CVE-2026-49078 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Unauthenticated Other Vulnerability Type in WP Travel Engine <= 6.7.10 versions. | |||||
| CVE-2026-47329 | 1 Canonical | 1 Ubuntu Linux | 2026-06-17 | N/A | 3.3 LOW |
| Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug can be triggered by an unprivileged local user and could result in handling of crafted responses. | |||||
| CVE-2026-45441 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions. | |||||
| CVE-2026-44826 | 2026-06-17 | N/A | 7.5 HIGH | ||
| Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.2, Vvveb CMS does not validate the sign of the quantity parameter on the cart-add endpoint. Submitting a negative integer is accepted by the server and treated as a normal positive line-item, but with the sign carried through into every downstream computation: line total, sub-total, taxes, and grand total all become negative numbers. The customer-facing cart UI then displays a negative grand total to the user, the checkout flow accepts the negative cart, and the resulting order is persisted in the merchant's database with a negative total column. From the merchant's order management dashboard, this surfaces as a real order with a negative total — an "the merchant owes the customer money" record that no legitimate workflow ever creates. This vulnerability is fixed in 1.0.8.2. | |||||