Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-29194 — Netmaker: Insufficient Authorization in Host Token Verification

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the Authorize middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true)…

| Authorization
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-29076 — cpp-httplib: Stack Overflow Denial of Service (DoS) via std::regex in multipart filename …

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses std::regex (libstdc++) to parse RFC 5987 encoded filename* values in multip…

| Denial of Service
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-28678 — dsa-hub-server: Clear-Text Storage of Sensitive Data

DSA Study Hub is an interactive educational web application. Prior to commit d527fba, the user authentication system in server/routes/auth.js was found to be vulnerable to Insufficiently Protected Cr…

| Authentication
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-3668 — Freedom Factory dGEN1 org.ethosmobile.webpwaemul AndroidEthereum access control

A weakness has been identified in Freedom Factory dGEN1 up to 20260221. This affects the function AndroidEthereum of the component org.ethosmobile.webpwaemul. This manipulation causes improper access…

| Authorization
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-30838 — league/commonmark: DisallowedRawHtml extension bypass via whitespace in HTML tag names

league/commonmark is a PHP Markdown parser. Prior to version 2.8.1, the DisallowedRawHtml extension can be bypassed by inserting a newline, tab, or other ASCII whitespace character between a disallow…

| Cross-Site Scripting
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-30832 — Soft Serve: SSRF via unvalidated LFS endpoint in repo import

Soft Serve is a self-hostable Git server for the command line. From version 0.6.0 to before version 0.11.4, an authenticated SSH user can force the server to make HTTP requests to internal/private IP…

| Server-Side Request Forgery
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-30834 — PinchTab: SSRF with Full Response Exfiltration via Download Handler

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7, a Server-Side Request Forgery (SSRF) vulnerability in the /download endpoint al…

| Server-Side Request Forgery
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-29787 — mcp-memory-service: System Information Disclosure via Health Endpoint

mcp-memory-service is an open-source memory backend for multi-agent systems. Prior to version 10.21.0, the /api/health/detailed endpoint returns detailed system information including OS version, Pyth…

| Information Disclosure
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-29786 — node-tar: Hardlink Path Traversal via Drive-Relative Linkpath

node-tar is a full-featured Tar for Node.js. Prior to version 7.5.10, tar can be tricked into creating a hardlink that points outside the extraction directory by using a drive-relative link target su…

| Path Traversal
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-3667 — Freedom Factory dGEN1 org.ethosmobile.ethoslauncher FakeAppService improper authorization

A security flaw has been discovered in Freedom Factory dGEN1 up to 20260221. The impacted element is the function FakeAppService of the component org.ethosmobile.ethoslauncher. The manipulation resul…

| Authorization
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-3665 — xlnt-community xlnt XLSX File xlsx_consumer.cpp read_office_document null pointer derefer…

A vulnerability was identified in xlnt-community xlnt up to 1.6.1. The affected element is the function xlnt::detail::xlsx_consumer::read_office_document of the file source/detail/serialization/xlsx_…

| Memory Corruption
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-29784 — Ghost: Incomplete CSRF protections around OTC use

Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections around /session/verify made it possible to use OTCs in login sessions different from the requ…

| Cross-Site Request Forgery
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-29778 — pyLoad: Arbitrary File Write via Path Traversal in edit_package()

pyLoad is a free and open-source download manager written in Python. From version 0.5.0b3.dev13 to 0.5.0b3.dev96, the edit_package() function implements insufficient sanitization for the pack_folder …

| Path Traversal
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-29781 — Sliver: Authenticated Nil-Pointer Dereference in Handlers

Sliver is a command and control framework that uses a custom Wireguard netstack. In versions from 1.7.3 and prior, a vulnerability exists in the Sliver C2 server's Protobuf unmarshalling logic due to…

| Denial of Service
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-29780 — eml_parser: Path Traversal in Official Example Script Leading to Arbitrary File Write

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to version 2.0.1, the official example script e…

| Path Traversal
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-29779 — UptimeFlare: Montior config / Credentials in `workerConfig` exposed in client-side JavaSc…

UptimeFlare is a serverless uptime monitoring & status page solution, powered by Cloudflare Workers. Prior to commit 377a596, configuration file uptime.config.ts exports both pageConfig (safe for cli…

| Information Disclosure
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
0.0 NA
CVE-2026-29190 — Karapace: Path Traversal in Backup Reader

Karapace is an open-source implementation of Kafka REST and Schema Registry. Prior to version 6.0.0, there is a Path Traversal vulnerability in the backup reader (backup/backends/v3/backend.py). If a…

| Path Traversal
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
4.8 MEDIUM
CVE-2026-3664 — xlnt-community xlnt Encrypted XLSX File compound_document.cpp read_directory out-of-bounds

A vulnerability was determined in xlnt-community xlnt up to 1.6.1. Impacted is the function xlnt::detail::compound_document::read_directory of the file source/detail/cryptography/compound_document.cp…

| Memory Corruption
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
4.8 MEDIUM
CVE-2026-3663 — xlnt-community xlnt XLSX File compound_document.cpp xsgetn out-of-bounds

A vulnerability was found in xlnt-community xlnt up to 1.6.1. This issue affects the function xlnt::detail::compound_document_istreambuf::xsgetn of the file source/detail/cryptography/compound_docume…

| Memory Corruption
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
8.2 HIGH
CVE-2026-29193 — ZITADEL: Bypassing Zitadel Login Behavior and Security Policy in Login V2

ZITADEL is an open source identity management platform. From version 4.0.0 to 4.12.0, a vulnerability in Zitadel's login V2 UI allowed users to bypass login behavior and security policies and self-re…

Remote | Authentication
Mar 07, 2026 Mar 07, 2026
Mar 07, 2026
Mar 07, 2026
Showing 20 of 5144 Results