Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.8 CRITICAL
CVE-2026-71289 — NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed…

The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface …

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-71288 — Koha SQL Injection via order_by and {order}_ovalue Parameters in guided_reports.pl

Koha's guided report builder (reports/guided_reports.pl) reads the `order_by` CGI parameter and, for each value, a dynamically-named `{order}_ovalue` parameter, and concatenates both directly into an…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-71287 — Cacti sanitize_sql_column() Regex Allowlist Permits SQL Time-Delay Functions Leading to B…

Cacti's sanitize_sql_column() (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex `preg_replace('/[^a-zA-Z0-9_().]/', '', $column)`. Because this allowlist retains lette…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.1 MEDIUM
CVE-2026-71286 — ember-dynamic-render-template Client-Side Template Injection via Unsanitized templateStri…

The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its `templateString` property directly into Ember/Glimmer's compileTemplate() (from @ember/…

Remote | Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.1 HIGH
CVE-2026-71285 — Uptime Kuma Stored XSS via Matomo Analytics Site ID on Public Status Pages

Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo `siteId` value as a bare, unquoted JavaScript expression inside a <script> bloc…

Remote | Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.2 HIGH
CVE-2026-71284 — Fledge IoT Gateway Backup Restore OS Command Injection via Tar Member Filename

Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell com…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
4.9 MEDIUM
CVE-2026-71283 — Fledge IoT Gateway Backup Restore Tar Path Traversal

Fledge's backup-restore upload handler, upload_backup() (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argume…

Remote | Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-71282 — ChirpStack SQLite Backend SQL Injection via Device Tag Key in ListDevices Filter

ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count() and list()) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's …

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.8 HIGH
CVE-2026-71281 — peft Unsafe Deserialization via torch.load() Without weights_only in LoRA-GA and CorDA Mo…

Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load() on config-specified ca…

Remote | Supply Chain
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.5 HIGH
CVE-2026-71280 — go-shiori Server-Side Request Forgery via Unrestricted Bookmark URL Fetch

go-shiori's DownloadBookmark() (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback(), I…

shiori | Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.0 HIGH
CVE-2026-71279 — Zigbee2MQTT External JS Extension Path Traversal Leading to Remote Code Execution

Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a `name` parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensio…

| Path Traversal
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
9.8 CRITICAL
CVE-2026-71278 — rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script …

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary `script` field. This route does not take the AuthToken requ…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
9.1 CRITICAL
CVE-2026-71277 — rust-iot-platform Authentication Bypass via Non-Validated Authorization Header

rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token sto…

Remote | Authentication
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
7.1 HIGH
CVE-2026-71276 — Magistrala (formerly Mainflux) IoT Platform SQL Injection via format Query Parameter

Magistrala (formerly Mainflux)'s message-readers API reads a `format` value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL que…

Remote | Injection
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
5.4 MEDIUM
CVE-2026-71275 — OpenBK7231T Reflected XSS via OTA host Parameter

OpenBK7231T's http_fn_ota_exec() (src/httpserver/http_fns.c) reflects the `host` query parameter directly into an HTML response via hprintf255(request, "<h3>OTA requested for %s!</h3>", tmpA) with no…

Remote | Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.5 HIGH
CVE-2026-71274 — OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels

OpenBK7231T's CHANNEL_SetLabel() (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup() with no HTML sanitization. CHANNEL_GetLabel() returns th…

| Cross-Site Scripting
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
6.5 MEDIUM
CVE-2026-71273 — OpenBK7231T CSRF in /cfg_wifi_set Leading to Implicit Web Password Disable and WiFi Hijack

OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the `web_admin_password_enabled` parameter is absent from…

Remote | Cross-Site Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.5 HIGH
CVE-2026-71272 — Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()

Memos' webhook dispatch function safeDialContext() (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost() and validates the resulting IPs against reserved ran…

memos | Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.5 HIGH
CVE-2026-71271 — Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass

Memos' webhook URL validation, isReservedIP() (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified() — unlike the c…

memos | Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
8.6 HIGH
CVE-2026-71270 — Stirling-PDF Server-Side Request Forgery via /api/v1/convert/url/pdf WeasyPrint Subprocess

Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling co…

Remote | Server-Side Request Forgery
Aug 05, 2026 Aug 05, 2026
Aug 05, 2026
Aug 05, 2026
Showing 20 of 9765 Results