Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
4.4 MEDIUM
CVE-2026-47753 — Incus has a Nil-Pointer Dereference Panic via Instance Backup Import (volume omitted)

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateInstanceFromBackup` in `internal/server/storage/backend.go` contains a nil-pointer dereference that …

incus | Denial of Service
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
9.8 CRITICAL
CVE-2026-77806 — SPIP Remote Code Execution Vulnerability

SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to code injection via an X-Spip-Filtre HTTP request head…

Remote | Injection
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
8.2 HIGH
CVE-2026-75946 — OMEN Gaming Hub – Potential Escalation of Privilege & Information Disclosure

A potential security vulnerability has been identified in the OMEN Gaming Hub for versions prior to 1101.2608.0.0. The vulnerability could potentially allow a local attacker to escalate privileges du…

Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
6.9 MEDIUM
CVE-2026-15580 — PassPortal browser extension: vault token disclosure via unvalidated postMessage

vault token disclosure via unvalidated postMessage vulnerability in N-able PassPortal allows Authentication Abuse. This issue affects the PassPortal browser extension: before 3.49.6.

passportal | Remote | Authentication
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.3 MEDIUM
CVE-2026-77780 — Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save …

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions t…

prospero_flow_crm | Remote | Authorization
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.3 MEDIUM
CVE-2026-77028 — Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redi…

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
9.2 CRITICAL
CVE-2026-76613 — Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro…

Joomla Extension - yootheme.com - Authenticated, privileged SQL injection in YOOtheme Pro 1.0.0-5.0.40 - An SQL injection allowed any contributor-level user to inject own content into SQL queries.

Remote | Injection
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
8.6 HIGH
CVE-2026-76612 — Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields i…

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to …

Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
6.9 MEDIUM
CVE-2026-76611 — Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gal…

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.

Remote | Information Disclosure
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
7.0 HIGH
CVE-2026-75115 — Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOthe…

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowin…

Remote | Path Traversal
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
6.8 MEDIUM
CVE-2026-59654 — Apache CloudStack: DoS caused by database connections leak

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack managem…

cloudstack | Remote | Memory Corruption
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
9.1 CRITICAL
CVE-2026-77776 — Headroom Proxy Treats the Client-Supplied x-headroom-user-id Header as an Authenticated I…

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points in headroom/proxy/handlers/openai.py, including the chat comple…

Remote | Authentication
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
8.6 HIGH
CVE-2026-77775 — Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Vali…

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. _resolve_openai_upstream_base in headroom/proxy/handlers/openai.py accepts the header v…

Remote | Server-Side Request Forgery
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
8.7 HIGH
CVE-2026-77759 — IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenan…

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the…

prospero_flow_crm | Remote | Authorization
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
4.6 MEDIUM
CVE-2026-77029 — Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo <…

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

Remote | Cross-Site Request Forgery
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
6.5 MEDIUM
CVE-2026-59318 — DefaultToolCallingManager Global Resolver Fallback Allows Unadvertised Tool Dispatch via …

In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched. Under certain conditions, a tool that…

Remote | Authorization
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
4.2 MEDIUM
CVE-2026-59308 — Semantic Cache Cross-Tenant Isolation Bypass via SHA-256 Truncation

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected…

Remote | Misconfiguration
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
7.5 HIGH
CVE-2026-59279 — Unbounded persistent session allocation via repeated initialize requests

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a…

Remote | Denial of Service
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
6.5 MEDIUM
CVE-2026-19848 — ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes …

Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
3.7 LOW
CVE-2026-18356 — Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Acc…

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing…

Remote | Authentication
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
Showing 20 of 11714 Results