Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.4 CRITICAL
CVE-2026-94571 — OpenStack Octavia Amphora Provider Driver HAProxy Configuration Injection Vulnerability

In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect_prefix fields. The RFC 3986 URL validator percent-encodes …

octavia | Remote | Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
9.3 CRITICAL
CVE-2026-94424 — Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overfl…

A vulnerability has been found in Moore Threads MTT S80 Driver Package up to 340.150. Impacted is the function sub_140001000 in the library mtdispkm64.sys of the component IOCTL Handler. The manipula…

mtt_s80_driver_package | Memory Corruption
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
5.5 MEDIUM
CVE-2026-93433 — Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd p…

A flaw was found in libstoragemgmt. An attacker with control over a local or virtual storage device could provide specially crafted SCSI (Small Computer System Interface) Vital Product Data (VPD) pag…

enterprise_linux enterprise_linux | Memory Corruption
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-88746 — IDCCMS Cross-Site Scripting Vulnerability

idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.

| Cross-Site Scripting
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-88745 — Emlog Pro Cross-Site Scripting to Remote Code Execution

EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.

| Cross-Site Scripting
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-88467 — CRMEB Knowledge-Paid System Sensitive Information Disclosure via Backend Verification Err…

CRMEB Knowledge-Paid System crmeb_zzff_class 1.4.4 has a backend verification function that returns the wrong type of value, causing errors and leaking sensitive information.

| Information Disclosure
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
5.3 MEDIUM
CVE-2026-88412 — FalkorDB Integer Overflow Vulnerability

An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.5 HIGH
CVE-2026-88411 — FalkorDB GRAPH.EFFECT Component Denial of Service Vulnerability

Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application.

Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.1 HIGH
CVE-2026-88410 — FalkorDB Improper Command Classification Vulnerability

The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application.

Remote | Misconfiguration
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.8 HIGH
CVE-2026-88409 — FalkorDB Buffer Overflow Vulnerability

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial…

Remote | Memory Corruption
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.5 MEDIUM
CVE-2026-88408 — FalkorDB Stack Overflow Denial of Service

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attackers to cause a Denial of Servi…

Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.5 HIGH
CVE-2026-88407 — FalkorDB Out-of-Bounds Read Vulnerability

An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a crafted input.

Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
7.5 HIGH
CVE-2026-88406 — FalkorDB Stack Overflow Denial of Service Vulnerability

FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a D…

Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-88405 — Univer RemoteRegisterFunctionService Remote Code Execution

A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary …

| Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-88404 — Univer UniscriptExecutionService Remote Code Execution

A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary …

| Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-88403 — NocoBase Server-Side Request Forgery

A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request.

| Server-Side Request Forgery
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
0.0 NA
CVE-2026-88402 — Nocobase SQL Injection Vulnerability

A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements.

| Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.3 MEDIUM
CVE-2026-79919 — MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path …

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinde…

maxkb | Remote | Memory Corruption
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.3 MEDIUM
CVE-2026-79918 — MaxKB: Sandbox escape via unhooked fexecve

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat to prevent subprocess creation but does not h…

maxkb | Remote | Misconfiguration
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.5 MEDIUM
CVE-2026-79917 — MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another use…

MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a conversation exists but does not verify tha…

maxkb | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
Showing 20 of 13844 Results