Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.1 HIGH
CVE-2026-59187 — OpenEXR: exrmetrics deep pixelmode heap buffer overflow

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13 are vuln…

Remote | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.1 HIGH
CVE-2026-59186 — OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (I…

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.…

Remote | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.1 HIGH
CVE-2026-59184 — OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB write

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13 …

Remote | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.8 HIGH
CVE-2026-55585 — QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`

QWED is open-source AI verification infrastructure for deterministic verification of LLM outputs, tool calls, code, schemas, and agent state before production execution. Prior to 5.1.2, the qwed pack…

Remote | Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.2 HIGH
CVE-2026-55571 — djust authentication bypass: a login_required / on_mount LiveView mount redirect does not…

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount sends a `{"type":"navigate","to":...}` fra…

Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.6 HIGH
CVE-2026-55557 — browse-mcp: Arbitrary file write via unconfined download and state paths

browse-mcp is a Playwright-based headless-browser MCP server for MCP-capable agents. Prior to 0.8.2, browser_download writes a fetched response body to join(save_dir, filename) without validating the…

| Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.5 HIGH
CVE-2026-55553 — urllib: Cross-origin redirects preserve credential-bearing request headers, leading to po…

urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reus…

Remote | Information Disclosure
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.2 HIGH
CVE-2026-47626 — NVIDIA DGX Spark Firmware Out-of-Bounds Write Vulnerability

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to cod…

dgx_spark | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.0 MEDIUM
CVE-2026-47624 — NVIDIA DGX Spark UEFI Protection Mechanism Failure

NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user. A successful exploit of this vulnerability may allow an attacker to bypass administ…

dgx_spark | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.2 HIGH
CVE-2026-24263 — NVIDIA DGX Spark System Firmware NULL Pointer Dereference Vulnerability

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer dereference. A successful exploit of this vulnerability may lead to…

dgx_spark | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.2 HIGH
CVE-2026-24262 — NVIDIA DGX Spark Firmware Out-of-Bounds Write Vulnerability

NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write. A successful exploit of this vulnerability may lead to cod…

dgx_spark | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.0 MEDIUM
CVE-2026-24225 — NVIDIA DGX Spark Out-of-Bounds Read Vulnerability

NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could be able to cause an out-of-bounds read. A successful exploit of this vulnerability might lead to inform…

dgx_spark | Information Disclosure
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.8 HIGH
CVE-2026-24170 — NVIDIA UFM Enterprise Improper Authorization Vulnerability

NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause improper authentication by sending specially crafted HTTP requests…

| Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.0 HIGH
CVE-2026-24169 — NVIDIA UFM Enterprise Plugin Management API Remote Code Execution Vulnerability

NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful…

| Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.8 MEDIUM
CVE-2026-24168 — NVIDIA UFM Enterprise Command Injection Vulnerability

NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may cause command injection by sending crafted API requests. A succe…

| Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.8 MEDIUM
CVE-2026-24167 — NVIDIA UFM Enterprise Command Injection Vulnerability

NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands by sending a crafted API request. A successful exploit of t…

| Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
5.1 MEDIUM
CVE-2026-24166 — NVIDIA UFM Enterprise Hard-Coded Cryptographic Key Information Disclosure Vulnerability

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. A successful exploit of this vul…

| Cryptography
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-19913 — CVE-2026-19913

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the…

| Information Disclosure
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-19912 — CVE-2026-19912

The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmb…

| Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.9 MEDIUM
CVE-2026-18445 — Integer Overflow Vulnerability Resulting in an Out of Bounds Write in NI LabVIEW

There is an integer overflow vulnerability resulting in an out-of-bounds write recently discovered in NI LabVIEW.  This may result in information disclosure or arbitrary code execution.  Successful e…

labview | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
Showing 20 of 11756 Results