Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.9 HIGH
CVE-2026-6540 — L7 policy bypass via unnormalized HTTP path matching

Calico's Application Layer Policy (disabled by default), which enforces HTTP rules through Dikastes, fails to perform URL path normalization. As a result, HTTP requests using path-traversal segments,…

calico_enterprise calico_cloud calico | Remote | Path Traversal
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.7 HIGH
CVE-2026-67349 — OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass

OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMidd…

Remote | Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.6 HIGH
CVE-2026-67348 — Julep Insecure Direct Object Reference via GET /executions/{execution_id}

Julep contains an insecure direct object reference vulnerability in the get_execution_details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply …

Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.8 MEDIUM
CVE-2026-67347 — Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped…

Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.6 HIGH
CVE-2026-67346 — Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass

Swarms through 6.8.1, fixed in commit 8b0fc9e, contains a server-side request forgery vulnerability in the _is_safe_url function that fails to validate hostnames through DNS resolution, allowing atta…

Remote | Server-Side Request Forgery
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.5 HIGH
CVE-2026-67345 — MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft

MaxKey through 4.1.12, fixed in commit ddbb72f, contains an insufficient redirect URI validation vulnerability in DefaultRedirectResolver.hostMatches() that allows remote attackers to hijack OAuth 2.…

Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.3 HIGH
CVE-2026-65635 — Boruta dynamic client registration allows creation of over-privileged OAuth clients

Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through t…

Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.9 MEDIUM
CVE-2026-54885 — Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching

Server-Side Request Forgery vulnerability in malach-it Boruta allows an unauthenticated remote attacker to cause the OAuth/OpenID authorization server to issue outbound HTTP requests to attacker-chos…

Remote | Server-Side Request Forgery
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.1 CRITICAL
CVE-2026-53431 — Boruta accepts expired JWT client assertions due to missing exp claim validation

Authentication Bypass by Capture-replay vulnerability in malach-it Boruta allows an attacker who has obtained a previously valid JWT client assertion to authenticate as the issuing OAuth client after…

Remote | Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.2 MEDIUM
CVE-2026-41187 — Calico Tier Authorization Bypass via DeleteCollection

Calico's apiserver wraps tier-scoped resources so that every operation runs through AuthorizeTierOperation, but the Delete override on NetworkPolicy, GlobalNetworkPolicy, and their staged variants is…

calico_enterprise calico_cloud calico | Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.0 MEDIUM
CVE-2026-41186 — Unauthenticated Go pprof exposure in Calico debug server

When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod w…

calico_enterprise calico_cloud calico | Information Disclosure
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2026-16308 — IBM Enterprise Build of Quarkus is affected by a DoS vulnerability

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multi…

Remote | Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.8 CRITICAL
CVE-2026-15435 — IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted U…

app_connect_enterprise | Remote | Path Traversal
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.3 HIGH
CVE-2026-14980 — IBM WebSphere Application Server Liberty is affected by a cross-site request forgery

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to cross-site request forgery which could allow an attacker to perform SSRF attacks with elevated privileges when th…

websphere_application_server_liberty | Remote | Cross-Site Request Forgery
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.8 HIGH
CVE-2026-14522 — IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes …

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters.

Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2026-14519 — IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes …

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability.

app_connect_enterprise | Remote | Path Traversal
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2026-12947 — IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Conne…

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user.

app_connect_enterprise | Remote | Information Disclosure
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.3 HIGH
CVE-2026-11980 — Code execution in IBM Desktop App

IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.

aspera_desktop_app | Misconfiguration
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2026-11897 — IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability…

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service, caused by sending a specially crafted request. A remote attacker could exploit this vulnerab…

websphere_application_server_liberty | Remote | Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.3 CRITICAL
CVE-2026-11707 — Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Autom…

IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by a cross-site scripting vulnerability in the administrative console login page.

Remote | Cross-Site Scripting
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
Showing 20 of 10022 Results