Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
6.0 MEDIUM
CVE-2026-19643 — Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms

An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base…

Remote | Memory Corruption
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
7.6 HIGH
CVE-2026-17111 — IBM i is Affected By Multiple Vulnerabilities in SQL

IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information i…

i i | Remote | Injection
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
6.0 MEDIUM
CVE-2026-19642 — Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp

An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a crash or heap memory corruption in an application that proc…

Remote | Memory Corruption
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.8 HIGH
CVE-2026-17082 — IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of a client-supplied profile name.

i i | Remote | Authorization
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
9.8 CRITICAL
CVE-2026-17083 — IBM i is Affected By Multiple Vulnerabilities in the Debug Server

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to a stack-based buffer overflow.

i i | Remote | Memory Corruption
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.2 HIGH
CVE-2026-17445 — IBM i is Affected By Improper Validation Vulnerability in Line Printer Daemon []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name.

i i | Remote | Authorization
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
0.0 NA
CVE-2026-73411 — Shescape: Home-directory disclosure in assignment context on Unix with Dash

Shescape is a simple shell escape library for JavaScript. Prior to 2.1.14 and 3.0.1, getEscapeFunction in src/internal/unix/dash.js fails to escape ~ after : or = when applications use the escape or …

| Injection
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.8 HIGH
CVE-2026-17417 — IBM i is Affected By Remote Code Execution Vulnerabilities [, ]

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of shell metacharacters.

i i | Remote | Injection
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
4.3 MEDIUM
CVE-2026-63295 — Project restriction `restricted.containers.privilege=isolated` bypassable by omitting `se…

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass project-level container isolation restrictions. When a project is configured with restrictions on container pri…

lxd | Remote | Authorization
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
9.9 CRITICAL
CVE-2026-63296 — Project restriction bypass via instance migration config override

An authorization bypass vulnerability in LXD allows an authenticated attacker to bypass target project restrictions during instance migration. When migrating an instance to a target project, LXD acce…

lxd | Remote | Authorization
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
0.0 NA
CVE-2026-49466 — Draft List - Contributor Stored Cross-Site Scripting via Draft Title in Custom Drafts Tem…

Draft List is a WordPress plugin to manage and promote unpublished content. Versions 2.6.3 and below are vulnerable to stored Cross-Site Scripting (XSS) in the `[drafts]` shortcode and Draft List wid…

| Cross-Site Scripting
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
9.9 CRITICAL
CVE-2026-63297 — Cross-project instance copy bypasses target project restrictions via TOCTOU in config mer…

An authorization bypass vulnerability in LXD due to a timing flaw during configuration merging allows an authenticated attacker to bypass target project restrictions during cross-project instance cop…

lxd | Remote | Authorization
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
7.8 HIGH
CVE-2026-46731 — Dell Display and Peripheral Manager Authentication Bypass Vulnerability

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potential…

Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.7 HIGH
CVE-2026-63298 — LXD arbitrary lxc.conf directive injection via NVIDIA instance configuration

An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplyin…

lxd | Remote | Injection
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
7.8 HIGH
CVE-2026-59914 — Dell Display and Peripheral Manager Authentication Bypass Vulnerability

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potential…

Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
0.0 NA
CVE-2026-73409 — Budibase: Server Filesystem Existence/Read Oracle via Builder-Controlled MongoDB tlsCerti…

Budibase is an open-source low-code platform. Prior to 3.40.1, packages/server/src/integrations/mongodb.ts passed builder-controlled tlsCertificateKeyFile and tlsCAFile values directly to MongoClient…

| Information Disclosure
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
7.8 HIGH
CVE-2026-59917 — Dell Display and Peripheral Manager Improper Access Control Vulnerability

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit th…

Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
4.3 MEDIUM
CVE-2026-73301 — Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tena…

Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authent…

Remote | Information Disclosure
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.6 HIGH
CVE-2026-19311 — Missing Authorization in Execute Monitor API in OpenSearch Alerting Plugin

Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline mon…

Remote | Authorization
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
8.6 HIGH
CVE-2026-18952 — Missing Input Validation in Threat Intel Feed Parser in OpenSearch Security Analytics Plu…

Missing input validation in the threat intelligence feed parser in the OpenSearch Security Analytics plugin might allow an authenticated remote user to perform server-side request forgery and read lo…

Remote | Server-Side Request Forgery
Aug 12, 2026 Aug 12, 2026
Aug 12, 2026
Aug 12, 2026
Showing 20 of 11044 Results