Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.3 HIGH
CVE-2026-58562 — Dell Command Update Missing Authorization Vulnerability

Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to…

| Authorization
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.3 HIGH
CVE-2026-56797 — Dell Command Update Time-of-Check Time-of-Use Race Condition Privilege Escalation

Dell Command Update (DCU), versions prior to 5.7.1, a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulne…

| Race Condition
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
6.6 MEDIUM
CVE-2026-56796 — Dell Command Update Improper Link Resolution Privilege Escalation

Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentia…

| Path Traversal
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
4.6 MEDIUM
CVE-2026-54793 — Dell OpenManage Enterprise Cross-Site Scripting Vulnerability

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with rem…

openmanage_enterprise | Remote | Cross-Site Scripting
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.8 HIGH
CVE-2026-53477 — Dell Command Update Time-of-Check Time-of-Use Race Condition Elevation of Privilege Vulne…

Dell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit th…

| Race Condition
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
5.3 MEDIUM
CVE-2026-53452 — Ground Station: Unauthenticated out-of-containment file read via `sigmfplayback` `recordi…

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated configure-sdr Socket.IO command a…

Remote | Information Disclosure
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
9.8 CRITICAL
CVE-2026-53451 — Ground Station: Unauthenticated arbitrary file write (path traversal) in save-waterfall-s…

Ground Station is a browser-based suite for satellite tracking, SDR reception, hardware control, and telemetry decoding. Prior to version 0.4.13, the unauthenticated save-waterfall-snapshot Socket.IO…

Remote | Path Traversal
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
9.8 CRITICAL
CVE-2026-52889 — Formie: Server-Side Template Injection in Formie Hidden field defaults

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query St…

formie | Remote | Injection
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.3 HIGH
CVE-2026-52834 — jxl-oxide: Out-of-bounds writes due to integer overflow in jxl-grid on 32-bit platforms

jxl-oxide is a pure Rust implementation of a JPEG XL decoder. Prior to jxl-grid 0.6.2, decoding a crafted JPEG XL image on a 32-bit platform can overflow length calculations in AlignedGrid::with_allo…

| Memory Corruption
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
8.7 HIGH
CVE-2026-52792 — Algernon: Server-side script source disclosure on Windows via NTFS filename

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext() without first rejecting NTFS-equival…

Remote | Path Traversal
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
6.5 MEDIUM
CVE-2026-50149 — Contour has Improper JWT Verification for Non-SNI Requests on Virtual Hosts with Fallback…

Contour is a Kubernetes ingress controller using Envoy proxy. In versions 1.23.0 through 1.33.4, when an `HTTPProxy` is configured with incompatible combination of both `.spec.virtualhost.tls.enableF…

contour | Remote | Authentication
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.8 HIGH
CVE-2026-49817 — Dell Command Update Deserialization of Untrusted Data Vulnerability

Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability…

| Information Disclosure
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.8 HIGH
CVE-2026-49816 — Dell Command Update Deserialization of Untrusted Data Vulnerability

Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability…

| Authentication
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.5 HIGH
CVE-2026-49289 — SimpleSAMLphp SAML2: Possible DoS via XPath Transform

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. In 4.19.2 and 4.20.2, the library permits attacker-controlled XPath transforms while processing XML signatures in spe…

saml2 | Remote | Denial of Service
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
8.7 HIGH
CVE-2026-49283 — SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded S…

saml2 | Remote | Authentication
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
8.8 HIGH
CVE-2026-49255 — electerm: Command Injection in File System Operations (rmrf, mv, cp)

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrust…

Remote | Injection
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.1 HIGH
CVE-2026-49253 — electerm: Path Traversal in Zmodem and Trzsz Download Filename Handling

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm uses remote-supplied filenames directly with path.join() while receiving Zmodem an…

Remote | Path Traversal
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.0 HIGH
CVE-2026-48711 — SSHFS: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

SSHFS is a network filesystem client for connecting to SSH servers. From version 1.4 until 3.7.6, SSHFS accepts a bracketed mount source such as [-oProxyCommand=CMD]:/path and find_base_path() remove…

| Misconfiguration
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
9.3 CRITICAL
CVE-2026-47187 — SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory com…

Remote | Path Traversal
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.5 HIGH
CVE-2026-45742 — Gotenberg: Concurrent Execution using Shared Resource with Improper Synchronization ('Rac…

Gotenberg is a Docker-powered stateless API for PDF files. From 8.10.0 until 8.33.0, the newContext function in pkg/modules/api/context.go starts one errgroup.Go goroutine for each multipart download…

Remote | Denial of Service
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
Showing 20 of 12465 Results