Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-18907 — PathTravelsal Vulnerability in com.talpa.hibrowser

Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename.

| Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
9.0 HIGH
CVE-2026-18897 — UTT HiPER 1250GW getOneApConfTempEntry strcpy stack-based overflow

A vulnerability was identified in UTT HiPER 1250GW up to v3.2.7-210907-180535. The impacted element is the function strcpy of the file /goform/getOneApConfTempEntry. The manipulation of the argument …

hiper_1250gw | Remote | Memory Corruption
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-18896 — lavkush-maurya Student-Registration-System changepass.php sql injection

A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argu…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
9.0 HIGH
CVE-2026-18895 — UTT HiPER 1250GW APSecurity_5g strcpy stack-based overflow

A vulnerability was found in UTT HiPER 1250GW up to 3.2.7-210907-180535. Impacted is the function strcpy of the file /goform/APSecurity_5g. Performing a manipulation of the argument cipher results in…

hiper_1250gw | Remote | Memory Corruption
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.5 HIGH
CVE-2026-18859 — ESAFENET CDG usbkey;logindojojs sql injection

A vulnerability was identified in ESAFENET CDG up to 20260615. Affected is an unknown function of the file /CDGServer3/ukey/usbkey;logindojojs. Such manipulation of the argument keyid leads to sql in…

cdg | Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.8 MEDIUM
CVE-2026-18856 — Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile…

A vulnerability was determined in Poesis Rhymix CMS up to 2.1.33. This impacts the function procImporterAdminCheckXmlFile of the file modules/importer/importer.admin.controller.php of the component D…

Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.7 HIGH
CVE-2026-46334 — OpenSIPS: Denial of Service in SDP bandwidth parsing via QoS SDP cloning

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the SDP bandwidth-line parsing logic. A SIP r…

Remote | Denial of Service
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.7 HIGH
CVE-2026-45809 — OpenSIPS: Denial of Service in watcherinfo XML generation from oversized watcher URI

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. Versions prior to 3.6.6 and 4.0.0-rc1 contain a denial of service vulnerability in the watcherinfo generation functionality. An …

Remote | Denial of Service
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.3 MEDIUM
CVE-2026-45705 — OpenSIPS: OOB Read in Multipart Body Boundary Parsing

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the find_line_delimiter() function in the multipart body parser performs an out-of-bou…

Remote | Memory Corruption
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.5 HIGH
CVE-2026-18854 — Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql…

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataS…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.3 MEDIUM
CVE-2026-18853 — ZomboDroid Meme Generator App com.zombodroid.MemeGenerator t5.l.c path traversal

A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android. This issue affects the function t5.l.c of the component com.zombodroid.MemeGenerator. Such manipulation …

| Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
3.3 LOW
CVE-2026-18852 — epsilla-cloud vectordb Filter expr.cpp ShuntingYard unusual condition

A vulnerability has been found in epsilla-cloud vectordb up to 0.3.18/df5a5f5afb85a2376a0f2f316c79dea9b2c6ac7a. This impacts the function SplitTokens/ShuntingYard of the file engine/query/expr/expr.c…

| Denial of Service
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.9 MEDIUM
CVE-2026-18103 — Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI (Open Management Application Programming Interface) port, especially if not secured with TSIG (Transaction Signatur…

enterprise_linux enterprise_linux | Remote | Memory Corruption
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
9.1 CRITICAL
CVE-2026-45537 — OpenSIPS: Global Buffer Overflow in construct_uri

OpenSIPS is a Session Initiation Protocol (SIP) server implementation. In versions prior to 3.6.6 and 4.0.0-rc1, the construct_uri() function concatenates multiple URI components (protocol, username,…

Remote | Memory Corruption
Aug 04, 2026 Aug 04, 2026
Aug 04, 2026
Aug 04, 2026
5.0 MEDIUM
CVE-2026-18819 — RackTables cross-site request forgery

A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The manipulation leads to cross-site request f…

Remote | Cross-Site Request Forgery
Aug 04, 2026 Aug 04, 2026
Aug 04, 2026
Aug 04, 2026
6.5 MEDIUM
CVE-2026-18818 — Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization

A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Execu…

django-sspanel | Remote | Authorization
Aug 04, 2026 Aug 04, 2026
Aug 04, 2026
Aug 04, 2026
6.8 MEDIUM
CVE-2026-70620 — Odysseus SSRF via Embedding Endpoint Configuration

Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admin-privileged attackers to direct the server to probe internal network resources by supplying arbitr…

Remote | Server-Side Request Forgery
Aug 04, 2026 Aug 04, 2026
Aug 04, 2026
Aug 04, 2026
8.8 HIGH
CVE-2026-70619 — Odysseus Missing Admin Authorization via Embedding Endpoint Routes

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint mana…

Remote | Authorization
Aug 04, 2026 Aug 04, 2026
Aug 04, 2026
Aug 04, 2026
6.7 MEDIUM
CVE-2026-70594 — Ghost: Session Fixation in Ghost Admin

Ghost is a Node.js content management system. From 2.2.0 until 6.54.1, Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation attacks. Successful expl…

| Authentication
Aug 04, 2026 Aug 04, 2026
Aug 04, 2026
Aug 04, 2026
6.6 MEDIUM
CVE-2026-70593 — Ghost: Theme Upload Path Traversal

Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom themes allowed a staff user to write files outside of the uploads directory. This could be used to al…

Remote | Path Traversal
Aug 04, 2026 Aug 04, 2026
Aug 04, 2026
Aug 04, 2026
Showing 20 of 9576 Results