Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.6 HIGH
CVE-2026-55182 — LibreNMS: Remote Code Execution by Signal Alert Transportation Module

LibreNMS is a network monitoring system. In versions from 21.6.0 up to 26.5.0, the Signal alert transport is vulnerable to command injection because the signal-cli path and the Recipient field of an …

librenms | Remote | Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
5.4 MEDIUM
CVE-2026-45694 — LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters

LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vm…

librenms | Remote | Cross-Site Scripting
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NONE
CVE-2026-43621 — Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gai…

simple_machines_forum smf | Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
4.4 MEDIUM
CVE-2026-21810 — HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference a…

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the bina…

| Information Disclosure
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
3.9 LOW
CVE-2026-21809 — HCL BigFix Quantum Risk Analyzer is affected by generating error messages with sensitive …

HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more effici…

| Information Disclosure
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
7.2 HIGH
CVE-2026-16809 — LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own…

limesurvey | Remote | Cross-Site Scripting
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
8.9 HIGH
CVE-2026-79921 — amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Ove…

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the nego…

Remote | Denial of Service
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
3.5 LOW
CVE-2026-77573 — Weblate: DNS rebinding in VCS operations allows server-side request forgery

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, a user permitted to manage component repository URLs can perform server-side…

weblate | Remote | Server-Side Request Forgery
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
5.3 MEDIUM
CVE-2026-77507 — Weblate: Object-scoped RSS feeds disclose private change history to unauthorized users

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used el…

weblate | Remote | Information Disclosure
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-75415 — AntFlow Incorrect Access Control Vulnerability

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allo…

| Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-75414 — AntFlow JUEL Expression Injection Command Execution

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability.

| Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-75413 — DocSys Unauthenticated Arbitrary File Download

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath.

| Path Traversal
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-75411 — JeecgBoot CodeNode Remote Command Execution

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanis…

| Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-75364 — Comfast Web Interface Command Injection Vulnerability

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter. User-controlled input is con…

| Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
0.0 NA
CVE-2026-75363 — Comfast CF-WR630AX Remote Code Execution

An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display_n.

| Injection
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
6.5 MEDIUM
CVE-2026-62326 — Weblate Has Uncontrolled Resource Consumption via

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a user with the built-in "Edit source" role can store a malicious regular ex…

weblate | Remote | Denial of Service
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
4.3 MEDIUM
CVE-2026-62249 — Weblate: Restricted-component change history leaked to non-member project users through t…

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, an authenticated user with access to a project can retrieve the change histo…

weblate | Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
7.7 HIGH
CVE-2026-61792 — Weblate path traversal allows a project administrator to read arbitrary files via App sto…

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the …

weblate | Remote | Path Traversal
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
4.4 MEDIUM
CVE-2026-61790 — Weblate: Team-enforced 2FA is bypassed for global permissions

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a team can require its members to configure two-factor authentication before…

weblate | Remote | Authentication
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
8.1 HIGH
CVE-2026-55228 — Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthoriz…

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, the REST API did not properly enforce the scope of project- and workspace-sc…

weblate | Remote | Authorization
Aug 26, 2026 Aug 26, 2026
Aug 26, 2026
Aug 26, 2026
Showing 20 of 12256 Results