Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-15904 — Google Chrome Ozone Use-After-Free

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a…

chrome chrome edge_chromium | Memory Corruption
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
0.0 NA
CVE-2026-15903 — Google Chrome V8 Out-of-Bounds Memory Access Vulnerability

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: …

chrome chrome edge_chromium | Memory Corruption
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
0.0 NA
CVE-2026-15902 — Google Chrome Cast Use-After-Free Vulnerability

Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

chrome chrome edge_chromium | Memory Corruption
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
0.0 NA
CVE-2026-15901 — Google Chrome Network Use-After-Free Vulnerability

Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

chrome chrome edge_chromium | Memory Corruption
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
0.0 NA
CVE-2026-15900 — Google Chrome GPU Use-After-Free Sandbox Escape

Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Criti…

chrome chrome edge_chromium | Memory Corruption
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
0.0 NA
CVE-2026-15899 — Google Chrome CameraCapture Use-After-Free

Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity:…

chrome chrome edge_chromium | Memory Corruption
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
6.4 MEDIUM
CVE-2026-64626 — AVideo Encoder downloadURL SSRF via unpinned retry fallback

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS …

avideo | Remote | Server-Side Request Forgery
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
9.8 CRITICAL
CVE-2026-64625 — AVideo before 29.0 OS Command Injection via execAsync

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can…

avideo | Remote | Injection
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
8.5 HIGH
CVE-2026-64624 — FreeRDP RDP File Parser Remote Code Execution via CLI Options

FreeRDP before 3.28.0 treats lines beginning with forward slash in RDP files as raw command-line options, exposing the entire CLI parser surface to untrusted files. Attackers can craft malicious RDP …

freerdp | Misconfiguration
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
6.3 MEDIUM
CVE-2026-57852 — Authentication Bypass via Null Short-Circuit in Grav CMS Scheduler Webhook Token Check

Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic…

Remote | Authentication
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
8.2 HIGH
CVE-2026-57495 — AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operat…

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version …

Remote | Injection
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
7.1 HIGH
CVE-2026-57494 — AgenticMail: Cross-agent task authorization bypass in AgenticMail API

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending…

Remote | Authorization
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
7.1 HIGH
CVE-2026-55550 — NextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify t…

NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, u…

Remote | Authorization
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
7.6 HIGH
CVE-2026-55544 — NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure an…

NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Beare…

Remote | Authorization
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
0.0 NA
CVE-2026-52656 — SJCAM AllWinner Tech Arbitrary Code Execution Vulnerability

An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file

| Misconfiguration
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
6.9 MEDIUM
CVE-2026-51385 — GRAPHIFY Remote Code Execution

An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, _build_opener, _fetch_html and _download_binar…

Remote | Server-Side Request Forgery
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
0.0 NA
CVE-2026-51031 — FlareSolverr Server-Side Request Forgery

FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information

| Server-Side Request Forgery
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
0.0 NA
CVE-2026-51025 — Fuint Member Marketing System Cross-Site Scripting Vulnerability

Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file

| Cross-Site Scripting
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
8.2 HIGH
CVE-2026-47255 — AgenticMail API/storage and outbound relay hardening

AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and b…

Remote | Misconfiguration
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
5.5 MEDIUM
CVE-2026-47144 — Shamefile has an arbitrary file read via shamefile.yaml in shame next

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in `shame next` allows an attacker-controlled `shamefile.yaml` to disclose contents of f…

| Path Traversal
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
Showing 20 of 8284 Results