Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
6.1 MEDIUM
CVE-2026-69235 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arb…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
6.1 MEDIUM
CVE-2026-69234 — reflected cross site scripting vulnerability in Esri Portal for ArcGIS

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 11.5 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicke…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.5 MEDIUM
CVE-2026-69233 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potent…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.5 MEDIUM
CVE-2026-69232 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arb…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.5 MEDIUM
CVE-2026-69231 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arb…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.5 MEDIUM
CVE-2026-69230 — stored cross site scripting issue in Esri Portal for ArcGIS

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potent…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.4 MEDIUM
CVE-2026-69229 — HTML injection vulnerability in Esri Portal for ArcGIS

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home applic…

portal_for_arcgis | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.3 MEDIUM
CVE-2026-69228 — missing authentication vulnerability in Esri Portal for ArcGIS

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) th…

portal_for_arcgis | Remote | Authentication
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.9 MEDIUM
CVE-2026-69225 — information disclosure vulnerability in Esri Portal for ArcGIS

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in…

portal_for_arcgis | Remote | Information Disclosure
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.9 MEDIUM
CVE-2026-69224 — information disclosure vulnerability in Esri Portal for ArcGIS

There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to re…

portal_for_arcgis | Remote | Information Disclosure
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
7.8 HIGH
CVE-2026-68508 — Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in…

| Misconfiguration
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
8.1 HIGH
CVE-2026-64679 — Atlantis: Path Traversal in Atlantis Workspace Handling Allows Out-of-Bounds Directory De…

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace v…

atlantis | Remote | Path Traversal
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
7.5 HIGH
CVE-2026-63421 — Keystone: `graphql.maxTake` bypass with negative `take`

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.m…

keystone | Remote | Denial of Service
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
8.2 HIGH
CVE-2026-63135 — YOURLS: Stored XSS in referrer statistics chart via crafted Referer header

YOURLS is a self-hosted, customizable URL shortener written in PHP. From 1.5.1 until 1.10.4, YOURLS stores the HTTP Referer header through yourls_get_referrer(), yourls_sanitize_url_safe(), and yourl…

Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
8.8 HIGH
CVE-2026-62316 — Microsoft UFO: DNS Rebinding → Unauthenticated File Read / Command Execution

Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py binds a FastMCP streamable HTTP server to …

Remote | Server-Side Request Forgery
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
9.9 CRITICAL
CVE-2026-62283 — Nezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream …

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created b…

Remote | Authorization
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
8.2 HIGH
CVE-2026-61824 — Defuddle: XSS via unescaped attribute interpolation in site extractors

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriat…

defuddle | Remote | Cross-Site Scripting
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
10.0 CRITICAL
CVE-2026-61539 — Xinference: Remote code execution via unsafe `eval()` in Llama3 tool-call parsing

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/mode…

Remote | Injection
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
9.2 CRITICAL
CVE-2026-59989 — Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI lead to RCE)

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and ar…

Remote | Injection
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
5.1 MEDIUM
CVE-2026-55185 — Miniflux 2: Open Redirect Bypass

Miniflux 2 is an open source feed reader. Prior to 2.3.1, IsRelativePath in internal/urllib/url.go accepts redirect targets containing backslashes because Go URL parsing treats them as path character…

Remote | Server-Side Request Forgery
Aug 21, 2026 Aug 21, 2026
Aug 21, 2026
Aug 21, 2026
Showing 20 of 11754 Results