Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.1 HIGH
CVE-2026-75002 — Roundcube Webmail IMAP Command Injection Vulnerability

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injectio…

webmail | Remote | Injection
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
5.8 MEDIUM
CVE-2026-75000 — Roundcube Webmail SVG Sanitization Bypass Information Disclosure

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to informa…

webmail | Remote | Information Disclosure
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
5.4 MEDIUM
CVE-2026-74999 — Roundcube Webmail Stored Cross-Site Scripting Vulnerability

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.

webmail | Remote | Cross-Site Scripting
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
7.2 HIGH
CVE-2026-74998 — Roundcube Webmail CSS Proxy Cross-Site Scripting and Information Disclosure

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scri…

webmail | Remote | Information Disclosure
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
8.8 HIGH
CVE-2026-74997 — Roundcube Webmail Markasjunk Plugin Remote Code Execution Vulnerability

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue onl…

webmail | Remote | Injection
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
3.5 LOW
CVE-2026-70412 — Dell iDRAC Information Disclosure Vulnerability

Dell iDRAC9, versions prior to 7.20.30.50, and Dell iDRAC10, version prior to 1.20.60.50, contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote acce…

idrac9 idrac9 idrac10 | Remote | Information Disclosure
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
7.0 HIGH
CVE-2026-18674 — Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unva…

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone…

Remote | Authorization
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
7.5 HIGH
CVE-2026-16467 — Broken Access Control in Dolusoft Software's Fortilogger

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Fortilogger: before 6.1.5.9.

Remote | Authorization
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
9.0 CRITICAL
CVE-2026-14564 — Sensitive Data Exposure in Innotim Software's Logsign SIEM

Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsi…

Remote | Authentication
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
10.0 CRITICAL
CVE-2026-74843 — Wavlink WN531P3/WN535M1 Export Pingortrace CGI export_pingortrace.cgi strcpy stack-based …

A vulnerability was determined in Wavlink WN531P3 and WN535M1 V250922. Affected by this vulnerability is the function strcpy of the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi of the compon…

wn531p3 | Remote | Memory Corruption
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
4.8 MEDIUM
CVE-2026-40126 — DOM-based Cross-Site Scripting in OutSystems Service Center

OutSystems Service Center is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack that can be exploited by a low-privileged attacker via the upload of a file with a malicious filename containi…

Remote | Cross-Site Scripting
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-74901 — openssl_encrypt before 1.4.0 Authentication Bypass via AES-CTR Fallback

openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify…

Remote | Authentication
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-74900 — openssl_encrypt before 1.4.0 Weak Shared Secret via PQC Simulation Mode

openssl_encrypt versions before 1.4.0 contain a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from …

Remote | Cryptography
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-74899 — openssl_encrypt before 1.4.0 Sandbox Escape via Type Hierarchy

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Pytho…

Remote | Information Disclosure
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-74896 — openssl_encrypt before 1.4.0 Sandbox Escape via Dunder Attribute Traversal

openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use …

Remote | Path Traversal
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-74895 — openssl_encrypt before 1.4.0 Plugin Sandbox Bypass via Process Isolation

openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access t…

Remote | Misconfiguration
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-74894 — openssl_encrypt before 1.4.0 Authentication Bypass via Bearer Token

openssl_encrypt before 1.4.0 contains an authentication bypass vulnerability in the verify_api_token function that accepts any non-empty Bearer token string without validation. Attackers can upload a…

Remote | Authentication
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
8.8 HIGH
CVE-2026-74893 — openssl_encrypt before 1.4.0 JWT Token Forgery via Hardcoded Secrets

openssl_encrypt versions before 1.4.0 contain hardcoded default JWT signing secrets in config.py that pass validation checks. Attackers with access to source code can forge valid JWT tokens for any c…

Remote | Cryptography
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
7.5 HIGH
CVE-2026-74892 — openssl_encrypt before 1.4.0 Hardcoded Secret Key

openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value c…

Remote | Authentication
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-74891 — openssl_encrypt before 1.4.0 Hardcoded Database Credentials

openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known d…

Remote | Misconfiguration
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
Showing 20 of 11185 Results