Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
2.3 LOW
CVE-2026-55555 — Dompdf: File existence oracle via font-face stylesheet declaration

Dompdf is an HTML to PDF converter for PHP. Versions 3.15 and prior are vulnerable to a File Existence Oracle attack through the manipulation of the CSS @font-face directive. By providing malicious H…

dompdf | Remote | Denial of Service
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
2.3 LOW
CVE-2026-55554 — Dompdf: Chroot Validation Bypass

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri() method enforces chroot boundaries with a strpos() prefix check after normalizing paths with  realpath() …

Remote | Path Traversal
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
8.1 HIGH
CVE-2026-48060 — Litestar: HTML Injection Through CSRF Token

Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HT…

litestar | Remote | Cross-Site Scripting
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
4.3 MEDIUM
CVE-2026-3158 — Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due t…

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and…

sterling_b2b_integrator sterling_file_gateway | Remote | Information Disclosure
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
4.3 MEDIUM
CVE-2026-3157 — Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File Gateway due t…

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and…

sterling_b2b_integrator sterling_file_gateway | Remote | Information Disclosure
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
4.9 MEDIUM
CVE-2026-1918 — IBM Sterling B2B Integrator and IBM Sterling File Gateway store sensitive information in …

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and…

sterling_b2b_integrator sterling_file_gateway | Remote | Information Disclosure
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
8.8 HIGH
CVE-2026-16347 — Improper restriction of excessive authentication attempts in MikroTik RouterOS and Cloud …

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, accoun…

routeros routeros | Authentication
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
7.1 HIGH
CVE-2026-16192 — IBM WebSphere Application Server Liberty is affected by a denial of service

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.

websphere_application_server_liberty | Remote | Denial of Service
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
7.0 HIGH
CVE-2026-16184 — IBM WebSphere Application Server is affected by an authentication bypass

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

websphere_application_server | Remote | Authentication
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
5.9 MEDIUM
CVE-2026-16107 — TS4500 CLI tool addresses security vulnerability

IBM TS4500 CLI tool Versions:  0.1.31 through 1.12.0.0 does not validate or improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in…

Remote | Information Disclosure
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
6.3 MEDIUM
CVE-2026-11391 — Tanium addressed a SQL injection vulnerability in Patch.

Tanium addressed a SQL injection vulnerability in Patch.

Remote | Injection
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
8.1 HIGH
CVE-2026-7769 — SQL injection Security Vulnerability in IBM Sterling B2B Integrator and IBM Sterling File…

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and…

Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
4.3 MEDIUM
CVE-2026-7362 — Improper Access Control Security Vulnerability in IBM Sterling B2B Integrator and IBM Ste…

IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an authenticate…

Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
7.5 HIGH
CVE-2026-66745 — Artica Proxy 4.50 Session Fixation via fw.login.php

Artica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setti…

artica_proxy | Remote | Authentication
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
4.9 MEDIUM
CVE-2026-5114 — SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read

The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation (which a…

Remote | Path Traversal
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
7.5 HIGH
CVE-2026-59932 — PhpSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up t…

phpspreadsheet | Remote | Denial of Service
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
7.7 HIGH
CVE-2026-50738 — pglogical Use-After-Free Vulnerability

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycl…

Remote | Memory Corruption
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
9.0 CRITICAL
CVE-2026-50737 — pglogical Privilege Escalation via Default Expression Execution

When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a priv…

Remote | Authentication
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
9.0 CRITICAL
CVE-2026-50736 — pglogical Arbitrary Command Execution Vulnerability

The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the a…

Remote | Injection
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
6.1 MEDIUM
CVE-2026-50735 — pglogical Out-of-Bounds Read Vulnerability

pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting …

Remote | Memory Corruption
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Showing 20 of 9546 Results