Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.6 CRITICAL
CVE-2026-20318 — Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Input Va…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulte…

secure_workload | Remote | Injection
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
10.0 CRITICAL
CVE-2026-20317 — Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Authenti…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulte…

secure_workload | Remote | Authentication
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
10.0 CRITICAL
CVE-2026-20315 — Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Access C…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulte…

secure_workload | Remote | Authorization
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
5.0 MEDIUM
CVE-2026-20314 — Cisco Packaged Contact Center Enterprise & Cisco Unified Contact Center Enterprise Server…

A vulnerability in Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE) could allow an authenticated, remote attacker to conduct server-si…

Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
6.1 MEDIUM
CVE-2026-20302 — Cisco RoomOS Stack Overflow Vulnerability

A vulnerability in the USB driver of Cisco RoomOS could allow an unauthenticated, local attacker with physical access to the USB port on an affected device to execute arbitrary code with root pr…

| Memory Corruption
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
5.4 MEDIUM
CVE-2026-20232 — Cisco Industrial Ethernet 1000 Series Switches Stored Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XS…

Remote | Cross-Site Scripting
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
9.9 CRITICAL
CVE-2026-20231 — Cisco Secure Workload Software Security Hardening Release August 2026 - Improper Neutrali…

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulte…

secure_workload | Remote | Injection
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
5.3 MEDIUM
CVE-2026-20177 — Cisco Industrial Ethernet 1000 Series Switches Denial of Service Vulnerability

A vulnerability in the handling of management plane packets by Cisco Industrial Ethernet (IE) 1000 Series Switches could allow an unauthenticated, remote attacker to cause the device manager, SS…

Remote | Denial of Service
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
10.0 CRITICAL
CVE-2026-20030 — Cisco Crosswork Security Hardening Release: August 2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a comprehensive internal security review. This review resulted in a…

Remote | Injection
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.6 HIGH
CVE-2024-13942 — Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leadi…

Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND, EMMC or SD). The code reads the header of the next-st…

| Authentication
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
8.8 HIGH
CVE-2025-14603 — Use of user input in raw SQL queries in vsDesk leading to blind SQL injection

The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the appl…

Remote | Injection
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
8.7 HIGH
CVE-2026-64852 — Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login us…

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks…

grav-plugin-api | Remote | Authorization
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
8.5 HIGH
CVE-2026-64851 — Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax th…

Remote | Cross-Site Scripting
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
8.7 HIGH
CVE-2026-64850 — Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to call_u…

grav | Remote | Injection
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
7.5 HIGH
CVE-2026-63408 — Grav API Plugin: JWT Access Token Accepted via `?token=` URL Query Parameter

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JW…

grav-plugin-api | Remote | Authentication
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
8.2 HIGH
CVE-2026-63407 — Grav API Plugin: CORS 'Access-Control-Allow-Origin: *' on Authenticated API Responses

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin CorsMiddleware returns Access-Control-Allow-Origin: …

grav-plugin-api | Remote | Authorization
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
8.2 HIGH
CVE-2026-62673 — Grav: .htaccess file extension rules bypass via case variation on case-insensitive filesy…

Grav is a file-based Web platform. Prior to 2.0.4, the Grav .htaccess and webserver-configs/htaccess.txt security rules omit the Apache [NC] flag and therefore compare sensitive directory and file-ex…

grav | Remote | Path Traversal
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
6.0 MEDIUM
CVE-2026-62672 — Grav: Authenticated ReDoS via regex_replace in Twig Sandbox

Grav is a file-based Web platform. Prior to 2.0.4, Grav allowlists the regex_replace filter and function in system/config/security.yaml, and GravExtension::regexReplace() passes an editor-controlled …

grav | Remote | Denial of Service
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
5.4 MEDIUM
CVE-2026-62671 — CSRF in grav-plugin-login: anonymous attacker rotates a logged-in user's 2FA (TOTP) secre…

Grav Login Plugin adds login, basic ACL, and session wide messages to Grav. Prior to 3.8.11, the Grav Login plugin login.regenerate2FASecret task accepts a top-level GET request through the TaskServi…

Remote | Authentication
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
6.3 MEDIUM
CVE-2026-62670 — Fail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets …

Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php re…

Remote | Authorization
Aug 19, 2026 Aug 19, 2026
Aug 19, 2026
Aug 19, 2026
Showing 20 of 12463 Results