Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.3 CRITICAL
CVE-2026-77415 — JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could o…

jsonata | Remote | Memory Corruption
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
9.3 CRITICAL
CVE-2026-77414 — JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $ha…

jsonata | Remote | Injection
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
9.3 CRITICAL
CVE-2026-77413 — JSONata: Arbitrary Code Execution via crafted JSONata expressions

JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to …

jsonata | Remote | Injection
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
8.7 HIGH
CVE-2026-77354 — kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query paramet…

kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes fr…

Remote | Denial of Service
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
7.1 HIGH
CVE-2026-77220 — PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting

PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the …

Remote | Memory Corruption
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
7.1 HIGH
CVE-2026-77219 — GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader

GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an el…

emacs | Memory Corruption
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
7.5 HIGH
CVE-2026-76905 — kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form…

kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without c…

Remote | Denial of Service
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
9.8 CRITICAL
CVE-2026-76904 — GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function again…

GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when ex…

Remote | Injection
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
3.5 LOW
CVE-2026-69238 — HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home ap…

portal_for_arcgis | Remote | Injection
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
3.8 LOW
CVE-2026-69237 — HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative…

portal_for_arcgis | Remote | Injection
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
6.1 MEDIUM
CVE-2026-69236 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arb…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
6.1 MEDIUM
CVE-2026-69235 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arb…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
6.1 MEDIUM
CVE-2026-69234 — reflected cross site scripting vulnerability in Esri Portal for ArcGIS

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicke…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.5 MEDIUM
CVE-2026-69233 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potent…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.5 MEDIUM
CVE-2026-69232 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arb…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.5 MEDIUM
CVE-2026-69231 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arb…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.5 MEDIUM
CVE-2026-69230 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potent…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.4 MEDIUM
CVE-2026-69229 — HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home applic…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.3 MEDIUM
CVE-2026-69228 — missing authentication vulnerability in Esri Portal for ArcGIS

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) th…

portal_for_arcgis | Remote | Authentication
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.9 MEDIUM
CVE-2026-69225 — information disclosure vulnerability in Esri Portal for ArcGIS

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in…

portal_for_arcgis | Remote | Information Disclosure
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
Showing 20 of 11745 Results