Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.5 HIGH
CVE-2026-61899 — Apache Tapestry: Possible classpath file download through URL manipulation

Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, w…

tapestry | Remote | Path Traversal
Aug 10, 2026 Aug 18, 2026
Aug 10, 2026
Aug 18, 2026
7.8 HIGH
CVE-2026-59087 — Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-con…

A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a sp…

enterprise_linux gimp enterprise_linux | Memory Corruption
Aug 10, 2026 Aug 24, 2026
Aug 10, 2026
Aug 24, 2026
7.5 HIGH
CVE-2026-55814 — Apache Ranger: Download APIs expose plugin data without authentication

Missing Authentication in Apache Ranger Download APIs on versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

ranger | Remote | Authentication
Aug 10, 2026 Aug 17, 2026
Aug 10, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-55799 — Apache Ranger: Remote Code Execution Vulnerability in GraalScriptEngineCreator

Remote Code Execution Vulnerability in GraalScriptEngineCreator in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

ranger | Remote | Misconfiguration
Aug 10, 2026 Aug 17, 2026
Aug 10, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-44416 — Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

ranger | Remote | Misconfiguration
Aug 10, 2026 Aug 17, 2026
Aug 10, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-42537 — Apache Ranger: Remote Code Execution via JDBC URL Injection

Remote Code Execution via JDBC URL Injection in Apache Ranger <= 2.8.0 Users are recommended to upgrade to version 2.9.0, which fixes this issue.

ranger | Remote | Injection
Aug 10, 2026 Aug 17, 2026
Aug 10, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-40920 — Apache Ranger: Privilege Escalation via URL Parameter

Privilege Escalation via URL Parameter is reported in Apache Ranger versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue.

ranger | Remote | Authorization
Aug 10, 2026 Aug 17, 2026
Aug 10, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-32227 — Apache Ranger: SQL Injection vulnerability in lookup functionality

SQL Injection vulnerability vulnerability in Apache Ranger. This issue affects . Users are recommended to upgrade to version 2.9.0, which fixes the issue.

ranger | Remote | Injection
Aug 10, 2026 Aug 17, 2026
Aug 10, 2026
Aug 17, 2026
9.8 CRITICAL
CVE-2026-28672 — Apache Ranger: OS Command Injection via Username in UnixUserGroupBuilder

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger: from 0.6 through 2.8.

ranger | Remote | Injection
Aug 10, 2026 Aug 17, 2026
Aug 10, 2026
Aug 17, 2026
10.0 CRITICAL
CVE-2026-66915 — Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Remote code execution in Fabrik < 4.7.2 - An unauthenticated attacker could execute arbitrary code by using the ajax_calc feature of the calc plugin.

Remote | Injection
Aug 10, 2026 Aug 26, 2026
Aug 10, 2026
Aug 26, 2026
7.5 HIGH
CVE-2026-44630 — Apache IoTDB: RPC service denial of service via unchecked Thrift string length

Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed Thrift frame, an attacker…

iotdb | Remote | Denial of Service
Aug 10, 2026 Aug 12, 2026
Aug 10, 2026
Aug 12, 2026
6.5 MEDIUM
CVE-2026-19404 — 389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abor…

A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker…

Aug 10, 2026 Aug 14, 2026
Aug 10, 2026
Aug 14, 2026
6.9 MEDIUM
CVE-2026-66411 — Ecovacs DEEBOT PRO Authentication Bypass Vulnerability

DEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.

| Authentication
Aug 10, 2026 Aug 28, 2026
Aug 10, 2026
Aug 28, 2026
4.8 MEDIUM
CVE-2026-66410 — ECOVACS PRO App Improper Certificate Validation Vulnerability

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.

| Cryptography
Aug 10, 2026 Aug 28, 2026
Aug 10, 2026
Aug 28, 2026
6.9 MEDIUM
CVE-2026-66409 — ECOVACS DEEBOT Weak Wi-Fi Hotspot Password Vulnerability

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.

| Authentication
Aug 10, 2026 Aug 28, 2026
Aug 10, 2026
Aug 28, 2026
5.1 MEDIUM
CVE-2026-66408 — Ecovacs DEEBOT PRO Root Account Weak Password Vulnerability

The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account.

| Authentication
Aug 10, 2026 Aug 28, 2026
Aug 10, 2026
Aug 28, 2026
8.1 HIGH
CVE-2026-66407 — ECOVACS DEEBOT PRO WebSocket Authentication Bypass

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-midd…

| Authentication
Aug 10, 2026 Aug 28, 2026
Aug 10, 2026
Aug 28, 2026
4.8 MEDIUM
CVE-2026-66406 — Ecovacs DEEBOT Improper Certificate Validation Vulnerability

DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. …

| Misconfiguration
Aug 10, 2026 Aug 28, 2026
Aug 10, 2026
Aug 28, 2026
8.8 HIGH
CVE-2026-66405 — Ecovacs DEEBOT Unauthorized Telnet Access Vulnerability

DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.

| Authentication
Aug 10, 2026 Aug 28, 2026
Aug 10, 2026
Aug 28, 2026
6.5 MEDIUM
CVE-2026-66404 — Ecovacs DEEBOT Improper Certificate Validation Vulnerability

DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.

| Misconfiguration
Aug 10, 2026 Aug 28, 2026
Aug 10, 2026
Aug 28, 2026
Showing 20 of 14224 Results