Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
3.3 LOW
CVE-2026-58039 — Node.js Permission Model File Write Bypass

A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended s…

| Misconfiguration
Jul 31, 2026 Jul 31, 2026
Jul 31, 2026
Jul 31, 2026
6.5 MEDIUM
CVE-2026-66720 — MZ Automation libiec61850 Out-of-bounds Read

The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame contain…

| Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.3 CRITICAL
CVE-2026-66421 — OpenClaw Dashboard Stored XSS via lastMessage Session Field

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injectin…

Remote | Cross-Site Scripting
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.8 HIGH
CVE-2026-66420 — MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Ce…

MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting …

Remote | Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-66369 — MZ Automation libiec61850 Out-of-bounds Read

The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are p…

| Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-66364 — MZ Automation libiec61850 Out-of-bounds Read

The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an …

| Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2026-66360 — MZ Automation libiec61850 Out-of-bounds Read

The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an…

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-66349 — MZ Automation libiec61850 Out-of-bounds Read

The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established ses…

| Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.8 HIGH
CVE-2026-65423 — o6 Automation open62541 Integer Overflow or Wraparound

An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write.

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-65421 — MZ Automation libiec61850 Out-of-bounds Read

The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This lead…

| Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-63550 — MZ Automation libiec61850 Out-of-bounds Read

The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS s…

Remote | Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
5.9 MEDIUM
CVE-2026-63362 — o6 Automation open62541 Integer Underflow

An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet.

Remote | Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.1 HIGH
CVE-2026-63035 — o6 Automation open62541 Use After Free

A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code.

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-63033 — MZ Automation lib60870 Out-of-bounds Read

A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated m…

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-61893 — MZ Automation lib60870 Out-of-bounds Read

A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-56758 — MZ Automation libiec61850 Out-of-bounds Read

The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of ze…

| Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
4.2 MEDIUM
CVE-2026-10031 — SFTPGo 2.7.4 Permission Bypass via Symbolic Link Creation

SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that p…

Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
5.5 MEDIUM
CVE-2026-68563 — Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure …

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup arch…

enterprise_linux enterprise_linux | Information Disclosure
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.2 MEDIUM
CVE-2026-68562 — Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure …

A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation …

enterprise_linux enterprise_linux | Remote | Path Traversal
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-64816 — RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath

RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection t…

Remote | Server-Side Request Forgery
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
Showing 20 of 9614 Results