Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.5 HIGH
CVE-2026-13183 — RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to r…

telerik_ui_for_asp.net_ajax | Remote | Cryptography
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
7.5 HIGH
CVE-2026-13182 — RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.N…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals prote…

telerik_ui_for_asp.net_ajax | Remote | Information Disclosure
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
8.1 HIGH
CVE-2026-13181 — RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NE…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote cod…

telerik_ui_for_asp.net_ajax | Remote | Misconfiguration
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-13321 — DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.…

bind | Misconfiguration
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-13204 — Unexpected exit in certain situations with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while …

bind | Misconfiguration
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-12617 — Record ordering based unexpected exit with CNAME or DNAME

The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A records. Specifically, if a client queries for a DNAME and A re…

bind | Denial of Service
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-48029 — libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordina…

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow. Version…

| Memory Corruption
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-11721 — Cache poisoning possible with label count discrepancy, RRSIG, and wildcards

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes `named` to produce a wildcard …

bind | Misconfiguration
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-11622 — Potential memory usage beyond configured limits

A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage. The attacker needs to be able to send queries faster than the r…

bind | Denial of Service
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-11605 — Unnecessary validation of DNSSEC signed records

The issue is a resource exhaustion vulnerability associated with DNSSEC validation. BIND always validates all RRSIG records in an answer, even if they are not strictly needed. A query to an authorita…

bind | Denial of Service
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-11331 — Potential wildcard CNAME RPZ policy bypass

An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing. This is not …

bind | Denial of Service
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-10822 — Key Record using PRIVATEDNS algorithm may lead to unexpected exit

If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KE…

bind | Denial of Service
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
0.0 NA
CVE-2026-10723 — Incorrect acceptance of NSEC3 records

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0…

bind | Injection
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
9.8 CRITICAL
CVE-2026-2395 — SQLi in Xpoda Türkiye Informatics Technology's No Code Platform

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affe…

Remote | Injection
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
9.3 CRITICAL
CVE-2026-8152 — Unblu Spark Open Redirect leading to DOM-Based XSS

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=…

spark | Remote | Cross-Site Scripting
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
7.8 HIGH
CVE-2026-44191 — Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code executio…

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptio…

Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
6.9 MEDIUM
CVE-2026-16270 — ReDoS in Open Mercato

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS atta…

Remote | Denial of Service
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
8.8 HIGH
CVE-2026-65603 — Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike …

grav | Remote | Authorization
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
5.3 MEDIUM
CVE-2026-65602 — Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for…

Remote | Misconfiguration
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
5.3 MEDIUM
CVE-2026-65601 — Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Tr…

Remote | Authorization
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
Showing 20 of 9718 Results