Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.8 CRITICAL
CVE-2026-86543 — knowns before 0.30.0 Unauthenticated Management API Exposure

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthen…

Remote | Authentication
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
9.1 CRITICAL
CVE-2026-86542 — knowns before 0.30.0 Path Traversal via Import Name

knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the imports directory. Attackers can supply traversal sequences in …

Remote | Path Traversal
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
8.3 HIGH
CVE-2026-86541 — knowns before 0.30.0 Path Traversal via code.replace MCP action

knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite arbitrary files outside the project root. Attackers can sup…

Remote | Path Traversal
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
8.5 HIGH
CVE-2026-86540 — knowns before 0.30.0 Arbitrary Code Execution via LSP Binary

knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns…

| Misconfiguration
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
7.2 HIGH
CVE-2026-86539 — knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without valida…

Remote | Server-Side Request Forgery
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
8.7 HIGH
CVE-2026-86538 — knowns before 0.30.0 Path Traversal via templateFile parameter

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply di…

Remote | Path Traversal
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
8.8 HIGH
CVE-2026-86439 — knowns before 0.30.0 Path Traversal via MCP doc and memory tools

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supp…

Remote | Path Traversal
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
6.3 MEDIUM
CVE-2026-82758 — ash_authentication_oauth2_server treats an empty resolved secret as valid, opening the ga…

Improper Authentication vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to register OAuth clients even when Dynamic Client Registration is gated by an…

ash_authentication_oauth2_server | Remote | Authentication
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
6.3 MEDIUM
CVE-2026-82757 — ash_authentication_oauth2_server CIMD fetcher classifies IPv4-in-IPv6 and site-local addr…

Server-Side Request Forgery (SSRF) vulnerability in ash-project ash_authentication_oauth2_server allows an attacker who controls a client metadata URL and its DNS to make the server connect to intern…

ash_authentication_oauth2_server | Remote | Server-Side Request Forgery
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
6.3 MEDIUM
CVE-2026-82756 — ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authent…

Improper Encoding or Escaping of Output vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Aut…

ash_authentication_oauth2_server | Remote | Injection
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
6.3 MEDIUM
CVE-2026-82755 — ash_authentication_oauth2_server serves tenant-specific OAuth metadata as publicly cachea…

Use of Cache Containing Sensitive Information vulnerability in ash-project ash_authentication_oauth2_server allows a shared HTTP cache to serve one tenant's OAuth discovery metadata to another tenant…

ash_authentication_oauth2_server | Remote | Misconfiguration
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
6.3 MEDIUM
CVE-2026-82754 — ash_authentication_oauth2_server aliases every protocol endpoint under /.well-known, bypa…

Improper Protection of Alternate Path vulnerability in ash-project ash_authentication_oauth2_server exposes the state-changing OAuth endpoints under an unintended URL prefix, bypassing controls scope…

ash_authentication_oauth2_server | Remote | Authentication
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
8.2 HIGH
CVE-2026-82753 — Unauthenticated authorize requests create unbounded, never-expiring CIMD client rows and …

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ash_authentication_oauth2_server allows an unauthenticated attacker to exhaust database storage and memory. The /aut…

ash_authentication_oauth2_server | Remote | Denial of Service
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
8.2 HIGH
CVE-2026-82586 — AshLua read operation aggregate bypasses the exposed-field allow-list, exposing private a…

Improper Protection of Alternate Path vulnerability in ash-project ash_lua allows a user-supplied Lua script to read attributes that are not on the exposed-field allow-list. AshLua exposes Ash resou…

ash_lua | Remote | Path Traversal
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
2.3 LOW
CVE-2026-82584 — Terminal escape sequence injection in the mix igniter.install confirmation prompt via pac…

Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in ash-project igniter allows a malicious package publisher to forge the mix igniter.install confirmation prompt. mix igni…

igniter | Remote | Misconfiguration
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
2.1 LOW
CVE-2026-81638 — Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ash_double_entry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID rende…

ash_double_entry | Information Disclosure
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
8.6 HIGH
CVE-2026-86438 — Lara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action

Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-a…

lara_dashboard | Remote | Authorization
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
8.6 HIGH
CVE-2026-86437 — Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbi…

lara_dashboard | Remote | Authorization
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
5.4 MEDIUM
CVE-2026-86436 — Lara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints

Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can …

lara_dashboard | Remote | Authorization
Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
10.0 CRITICAL
CVE-2026-75650 — Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (C…

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. …

Sep 07, 2026 Sep 07, 2026
Sep 07, 2026
Sep 07, 2026
Showing 20 of 12520 Results