Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
3.7 LOW
CVE-2025-24978 — eKuiper Stored Cross-Site Scripting

### Summary A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a…

Remote | Cross-Site Scripting
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
8.6 HIGH
CVE-2026-8044 — [Product/Vendor Name] Argument Injection Vulnerability

CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code execution by an attacker with a privileged account when ma…

Remote | Injection
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
9.2 CRITICAL
CVE-2026-87930 — MaxSite CMS through 109.6 PHP Object Injection via ci_session

MaxSite CMS through 109.6 passes the ci_session cookie to unserialize() without class restrictions, allowing unauthenticated attackers to inject PHP objects. Attackers can forge valid session cookies…

maxsite_cms cms | Remote | Information Disclosure
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
9.8 CRITICAL
CVE-2026-87929 — MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key

MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge adminis…

maxsite_cms cms | Remote | Authentication
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
5.4 MEDIUM
CVE-2026-87928 — MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin_page

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML co…

maxsite_cms cms | Remote | Cross-Site Scripting
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
8.8 HIGH
CVE-2026-87927 — MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supply…

maxsite_cms cms | Remote | Path Traversal
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
3.0 LOW
CVE-2026-87876 — Cups: openprinting cups: remaining case-insensitive username matching in scheduler side p…

Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validation and private-attribute filtering) could allow bypass of us…

Sep 09, 2026 Sep 10, 2026
Sep 09, 2026
Sep 10, 2026
4.3 MEDIUM
CVE-2026-87875 — Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-…

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNM…

Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
8.1 HIGH
CVE-2026-87874 — Community.general: community.general: memcached cache plugin deserializes untrusted pickl…

A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit s…

ceph_storage openstack_platform | Remote | Memory Corruption
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
6.8 MEDIUM
CVE-2026-87872 — Community.general: community.general: ocapi module_utils (ocapi_command, ocapi_info) hard…

A flaw was found in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection. The shared OCAPI request helper disables TLS certificate validation on every request and…

ceph_storage openstack_platform | Misconfiguration
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
7.5 HIGH
CVE-2026-87853 — Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strncmp() with the authenticated user's identifier length, perf…

Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
5.7 MEDIUM
CVE-2026-85788 — Incomplete list of disallowed inputs in awslabs mysql-mcp-server

Incomplete list of disallowed inputs in the mutable SQL detector component in Amazon awslabs mysql-mcp-server might allow context-dependent actors to bypass the read-only enforcement gate and reach f…

Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-80925 — vlan: fix skb_under_panic and races when toggling HW VLAN offload

In the Linux kernel, the following vulnerability has been resolved: vlan: fix skb_under_panic and races when toggling HW VLAN offload Toggling hardware VLAN TX offload (NETIF_F_HW_VLAN_CTAG_TX or N…

linux_kernel | Race Condition
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-80924 — crypto: krb5 - use kfree_sensitive() for derived key buffers

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - use kfree_sensitive() for derived key buffers crypto_krb5_prepare_encryption() and crypto_krb5_prepare_checksum() …

linux_kernel | Cryptography
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-80923 — xhci: dbgtty: Fix unregister on tty_register_driver() failure

In the Linux kernel, the following vulnerability has been resolved: xhci: dbgtty: Fix unregister on tty_register_driver() failure If tty_register_driver() fails, it drops the reference, but fails t…

linux_kernel | Memory Corruption
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-80922 — crypto: qcom-rng - Allow zero as a random number

In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - Allow zero as a random number Zero is a valid random number and needs to be allowed. Otherwise the output is …

linux_kernel | Cryptography
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-80921 — KVM: s390: vsie: zero stale crypto bits

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: zero stale crypto bits When shadowing crypto access bits from a format0 apcb (crycb 0 or 1), the bits 64..255 ar…

linux_kernel | Misconfiguration
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-80920 — io_uring: defer eventfd signaling when queued from a wakeup handler

In the Linux kernel, the following vulnerability has been resolved: io_uring: defer eventfd signaling when queued from a wakeup handler io_req_local_work_add() signals the CQ ring eventfd inline wh…

linux_kernel | Race Condition
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-80919 — drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix recursive ww_mutex acquire in amdgpu_devcoredump_format When dumping IB contents from a hung job, amdgpu_devcored…

linux_kernel | Denial of Service
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
0.0 NA
CVE-2026-80918 — HID: core: fix number/pointer type confusion on long items

In the Linux kernel, the following vulnerability has been resolved: HID: core: fix number/pointer type confusion on long items When fetch_item() is called by hid_scan_report() on an item with HID_I…

linux_kernel | Memory Corruption
Sep 09, 2026 Sep 09, 2026
Sep 09, 2026
Sep 09, 2026
Showing 20 of 13950 Results