Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.5 HIGH
CVE-2026-73415 — jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new bro…

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, Jupyt…

Remote | Cross-Site Scripting
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
9.2 CRITICAL
CVE-2026-73414 — Shescape: Shell injection via unescaped parentheses on Windows with CMD

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/win/cmd.js does not escape `(` and `)` when applications use the escape or escap…

Remote | Injection
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.7 HIGH
CVE-2026-73413 — Shescape: Quadratic-time denial of service in flag-protection

Shescape is a simple shell escape library for JavaScript. From 2.1.11 until 2.1.14 and 3.0.1, the flag-protection loop in compose in src/internal/compose.js repeatedly joins and slices flag fragments…

Remote | Denial of Service
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
6.3 MEDIUM
CVE-2026-73412 — Shescape: Path disclosure on Unix with Zsh

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, this impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default sh…

Remote | Information Disclosure
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
6.3 MEDIUM
CVE-2026-73411 — Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or …

Remote | Injection
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
5.1 MEDIUM
CVE-2026-73409 — Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCerti…

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient…

Remote | Information Disclosure
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
9.0 CRITICAL
CVE-2026-73407 — Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak (by…

Budibase is an open-source low-code platform. Prior to 3.40.1, RestIntegration._req in packages/server/src/integrations/rest.ts attached credentials from getAuthHeaders and defaultHeaders without req…

Remote | Server-Side Request Forgery
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
7.5 HIGH
CVE-2026-73406 — Budibase: Unauthenticated user information disclosure via public tenant user lookup endpo…

Budibase is an open-source low-code platform. Prior to 3.39.32, GET /api/global/users/tenant/:id was listed in PUBLIC_ENDPOINTS in packages/worker/src/api/index.ts, and tenantUserLookup returned a fu…

Remote | Information Disclosure
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.7 HIGH
CVE-2026-73332 — CamaleonCMS cama_contact_form Plugin Stored XSS via before_html Field

CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized …

Remote | Cross-Site Scripting
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
7.1 HIGH
CVE-2026-73331 — CamaleonCMS 2.9.1 Authenticated SQL Injection via Post Slug Field

CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL synt…

Remote | Injection
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
6.6 MEDIUM
CVE-2026-73330 — CamaleonCMS 2.9.1 Server-Side Template Injection via test_email Action

CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the te…

Remote | Injection
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
9.2 CRITICAL
CVE-2026-73329 — CamaleonCMS Stored XSS via Draft Post Title Creation Endpoint

CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized …

Remote | Cross-Site Scripting
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
7.6 HIGH
CVE-2026-73326 — CamaleonCMS Missing Authorization via Plugin Administration Endpoints

CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration en…

Remote | Authorization
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
5.7 MEDIUM
CVE-2026-73308 — Budibase: OAuth2 Token Disclosure via Automation Test Results Broadcast to Other Builders

Budibase is an open-source low-code platform. Prior to 3.39.25, packages/server/src/api/controllers/automation.ts returned automation test results containing trigger.outputs.user.oauth2, broadcast Bu…

Remote | Information Disclosure
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
4.9 MEDIUM
CVE-2026-73307 — Budibase: SSRF via bare fetch() in uploadUrl during AI table generation

Budibase is an open-source low-code platform. Prior to 3.39.4, uploadUrl in packages/server/src/utilities/fileUtils.ts used a bare server-side fetch for string attachment values passed by processAtta…

Remote | Server-Side Request Forgery
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
5.3 MEDIUM
CVE-2026-73306 — Budibase: Account Enumeration via Login Lockout Response Differential

Budibase is an open-source low-code platform. Prior to 3.39.25, POST /api/global/auth/:tenantId/login incremented the failure counter in packages/worker/src/api/controllers/global/auth.ts only for ex…

Remote | Authentication
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.2 HIGH
CVE-2026-73303 — Budibase: Email Change IDOR via POST /api/v2/email allows full Account Takeover (accountI…

Budibase is an open-source low-code platform. Prior to 3.40.0, POST /api/v2/email on account.budibase.app accepted a client-controlled accountId without binding it to the authenticated session, while…

Remote | Authentication
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
9.9 CRITICAL
CVE-2026-73269 — Cluster-curator-controller: cluster-curator-controller: tenant-controllable trigger creat…

A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped Clust…

multicluster_engine_for_kubernetes | Remote | Authorization
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
9.9 CRITICAL
CVE-2026-73268 — Cluster-curator-controller: cluster-curator-controller: spec.install.overridejob allows a…

A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specifica…

multicluster_engine_for_kubernetes | Remote | Injection
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.0 HIGH
CVE-2026-72809 — SiYuan before v3.7.4 Authentication Bypass via Localhost Trust

SiYuan versions <= v3.7.2 (patched in v3.7.4) contain an authentication bypass vulnerability in the kernel's CheckAuth function, which grants the administrator role (RoleAdministrator) to any request…

| Authentication
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
Showing 20 of 11049 Results