Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.7 HIGH
CVE-2026-15913 — Path Traversal in Fortra's GoAnywhere MFT Endpoint

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escap…

Remote | Path Traversal
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
6.8 MEDIUM
CVE-2026-87015 — Open WebUI: A user's session cookies are sent to tool servers configured for bearer authe…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/tools.py captured a cookie jar from the enclosing connection l…

Remote | Authentication
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
6.5 MEDIUM
CVE-2026-87014 — Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users'…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backend/open_webui/routers/auths.py and backend/open_webui/utils…

Remote | Authorization
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
4.3 MEDIUM
CVE-2026-87013 — Open WebUI: Any authenticated user can start a non-terminating request via a folder paren…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/update/parent allowed a user to place a folder under itself o…

Remote | Misconfiguration
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
4.3 MEDIUM
CVE-2026-87012 — Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-n…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/calendar.py stored the calendar event meta.alert_minutes value…

Remote | Denial of Service
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
7.5 HIGH
CVE-2026-87011 — Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in ba…

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oauth/backchannel-logout handler in backend/open_webui/utils/o…

Remote | Denial of Service
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
6.5 MEDIUM
CVE-2026-79522 — GPAC Out-of-Bounds Read Vulnerability

An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2…

Remote | Denial of Service
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
4.0 MEDIUM
CVE-2026-79516 — Nothings stb Out-of-Bounds Read

An out-of-bounds read in the stbsp_vsnprintf function (stb_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted input.

| Memory Corruption
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
4.3 MEDIUM
CVE-2026-79515 — nothings stb Out-of-Bounds Read

An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted TTF file.

Remote | Denial of Service
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
6.5 MEDIUM
CVE-2026-79514 — GPAC Out-of-Bounds Read Vulnerability

An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226…

Remote | Denial of Service
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
6.5 MEDIUM
CVE-2026-79513 — GPAC Divide-by-Zero Denial of Service

A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via a crafted MPD Seg…

Remote | Denial of Service
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-79387 — PbootCMS SQL Injection Vulnerability

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the…

| Injection
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-71808 — Siam Ordering SQL Injection

A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and mul…

| Injection
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-71803 — Money-POS Stored Cross-Site Scripting

money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the or…

| Cross-Site Scripting
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-71802 — REBUILD Stored Cross-Site Scripting Vulnerability

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the clie…

| Cross-Site Scripting
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-71801 — s-pms SPMS-Server Hardcoded Cryptographic Key Authentication Bypass

An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded default access token secret within its core configuration file, which is not overridden or removed in t…

| Authentication
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
5.4 MEDIUM
CVE-2026-53956 — Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-rattler` prior to version 0.24.0 were vulnerable to package-cac…

Remote | Path Traversal
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
7.1 HIGH
CVE-2026-50165 — alf.io has Improper Access Control for Organization Owners that Exposes System Secrets

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. An Improper Access Control issue in versions prior to 2.0-M5-2605 allows an organization owner…

Remote | Authorization
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-36433 — Actions Semiconductor Media Player Utilities Arbitrary Code Execution

An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically proximate attacker execute arbitrary code via the Production.dll and RdiskUpgrade.exe components

| Memory Corruption
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
9.6 CRITICAL
CVE-2026-87911 — Read-only enforcement bypass enabling operating system command execution in the SQL valid…

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operat…

Remote | Injection
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
Showing 20 of 13958 Results