Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
5.5 MEDIUM
CVE-2026-68563 — Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure …

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup arch…

enterprise_linux enterprise_linux | Information Disclosure
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.2 MEDIUM
CVE-2026-68562 — Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure …

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation …

enterprise_linux enterprise_linux | Remote | Path Traversal
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.1 HIGH
CVE-2026-64816 — RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection t…

Remote | Server-Side Request Forgery
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.7 HIGH
CVE-2026-63559 — o6 Automation open62541 Integer Overflow or Wraparound

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information.

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
4.7 MEDIUM
CVE-2026-62845 — Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/D…

kamaji | Remote | Injection
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.5 HIGH
CVE-2026-62246 — Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL dat…

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-na…

kamaji | Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.6 HIGH
CVE-2026-5846 — Hard-coded Cryptographic Key in Watchfire Signs Controllers

The affected Watchfire Controller Software contains self-signed hard-coded RSA private keys and corresponding X.509 certificates used for authenticating and encrypting HTTPS/TLS connections to the co…

Remote | Cryptography
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2026-38709 — TOTOLINK Devices Command Injection Vulnerability

TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulner…

| Injection
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.2 HIGH
CVE-2026-18064 — NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference

An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attac…

Remote | Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.8 HIGH
CVE-2026-12562 — Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function

The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a ne…

| Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.2 HIGH
CVE-2026-63362 — o6 Automation open62541 Integer Underflow

An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet.

Remote | Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.8 HIGH
CVE-2026-65423 — o6 Automation open62541 Integer Overflow or Wraparound

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write.

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.1 HIGH
CVE-2026-63035 — o6 Automation open62541 Use After Free

A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code.

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.8 HIGH
CVE-2026-66420 — MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Ce…

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting …

Remote | Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.8 CRITICAL
CVE-2026-68503 — LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema…

Remote | Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.8 CRITICAL
CVE-2026-68502 — LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Una…

LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches d…

Remote | Injection
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-68501 — Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAct…

Remote | Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2026-68500 — Sylius Mollie Plugin: Payment status forgery via the payment webhook

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attac…

Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.2 MEDIUM
CVE-2026-68499 — re2: Global `String.prototype.match` with an empty-matchable pattern never advances → inf…

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2's String.prototype.match implementation with a global RE2 pattern that can match the empty string fails …

| Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
10.0 CRITICAL
CVE-2026-66803 — Azure Cosmos DB Remote Code Execution Vulnerability

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
Showing 20 of 10047 Results