Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
3.7 LOW
CVE-2026-63416 — draw.io: Path traversal in ExportProxyServlet allows access to arbitrary backend endpoints

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo() to build a proxyPath …

drawio drawio | Remote | Path Traversal
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
4.2 MEDIUM
CVE-2026-63373 — draw.io: OAuth CSRF via missing state validation on self-hosted deployments allows sessio…

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/com/mxgraph/online/AbsAuth.java skips comparison of stateToke…

drawio drawio | Remote | Authentication
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.8 MEDIUM
CVE-2026-63334 — draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/jav…

drawio drawio | Remote | Server-Side Request Forgery
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.8 HIGH
CVE-2026-63116 — deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized rec…

deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/permission/valve/rules-map.ts omits RECORD_A…

Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
5.8 MEDIUM
CVE-2026-62987 — Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tl…

Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of for…

fabio | Remote | Misconfiguration
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.2 MEDIUM
CVE-2026-62866 — Dasel: Selector lexer panics on trailing whitespace in `parseCurRune`

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.2, selector/lexer/tokenize.go parseCurRune advances the input index across tr…

dasel | Misconfiguration
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.8 HIGH
CVE-2026-62371 — KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob…

Remote | Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.5 MEDIUM
CVE-2026-62370 — KubeEdge: Unbounded allocation in viaduct packer enables authenticated remote DoS against…

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.0.0 until 1.21.2, 1.22.2, and 1.23.1, Reader.Read in pkg/viaduct/p…

Remote | Memory Corruption
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
9.2 CRITICAL
CVE-2026-61674 — Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG…

Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugins/out_forward/forward.c secure_forward_pong copies the serv…

Remote | Memory Corruption
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.2 MEDIUM
CVE-2026-59168 — Dasel: Unbounded recursion in JSON and XML readers causes unrecoverable stack-overflow DoS

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.11.1, parsing/json/json_reader.go decodeValue, decodeObject, and decodeArray, an…

dasel | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.1 MEDIUM
CVE-2026-58504 — draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-4…

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file can execute attacker-controlled JavaScript in the draw.io ori…

drawio drawio | Remote | Cross-Site Scripting
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.0 MEDIUM
CVE-2026-17051 — Out-of-bounds write in the Intel SEDI IPM driver from an unvalidated inbound doorbell len…

The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). It read the peer-written doorbell register, extracted the pa…

zephyr zephyr | Memory Corruption
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
5.7 MEDIUM
CVE-2026-17050 — Double free of the USB host configuration descriptor when device enumeration fails

The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap in usbh_device_set_configuration() (subsys/usb/host/usbh_dev…

zephyr zephyr | Memory Corruption
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.1 HIGH
CVE-2026-62369 — KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows du…

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz functio…

Remote | Path Traversal
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
4.3 MEDIUM
CVE-2026-88978 — Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via Lis…

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes ca…

hatchet | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
9.8 CRITICAL
CVE-2026-85751 — Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwar…

Mailu is a mail server distributed as a set of Docker images. From Mailu 2.0 until 2024.06.55 and prior to Mailu helm-charts 2.7.3, deployments with PROXY_AUTH_WHITELIST configured but REAL_IP_HEADER…

mailu | Remote | Authentication
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
3.1 LOW
CVE-2026-84298 — Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values …

hatchet | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
8.8 HIGH
CVE-2026-82412 — ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule…

ntopng | Remote | Injection
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
2.4 LOW
CVE-2026-77166 — Mattermost Emoji Field Cross-Site Scripting or UI Redress Vulnerability

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

Remote | Denial of Service
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
6.5 MEDIUM
CVE-2026-77165 — Database File Lock Denial of Service

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

server | Remote | Authorization
Sep 21, 2026 Sep 21, 2026
Sep 21, 2026
Sep 21, 2026
Showing 20 of 13677 Results