Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
2.4 LOW
CVE-2026-71438 — Mermaid configuration APIs allow prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid's configuration setters (mermaid.initialize, mermaidAPI.se…

mermaid | Misconfiguration
Aug 06, 2026 Aug 07, 2026
Aug 06, 2026
Aug 07, 2026
6.5 MEDIUM
CVE-2026-71437 — Mermaid Architecture diagrams are vulnerable to prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype po…

mermaid | Remote | Misconfiguration
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
5.3 MEDIUM
CVE-2026-71436 — Mermaid XY Charts are vulnerable to an infinite loop DoS

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 10.6.0 until 10.9.8 and 11.16.1, Mermaid XY Charts are vulnerable to an infinite l…

mermaid | Remote | Denial of Service
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
6.1 MEDIUM
CVE-2026-71435 — Statamic: Stored Cross-Site Scripting in Automagic Form Notification Email Template

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, a…

statamic | Remote | Cross-Site Scripting
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
5.3 MEDIUM
CVE-2026-71434 — Statamic: Missing file upload validation on frontend forms allows uploading disallowed fi…

Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, public frontend forms did not enforce the file upload restrictions that the Control Panel enforces, …

statamic | Remote | Misconfiguration
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
5.3 MEDIUM
CVE-2026-71433 — LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite st…

LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkp…

langgraph-checkpoint langgraph | Remote | Information Disclosure
Aug 06, 2026 Aug 07, 2026
Aug 06, 2026
Aug 07, 2026
6.2 MEDIUM
CVE-2026-71430 — node-re2: String.prototype.replace(re2, template) aborts the Node process (uncatchable To…

node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.25.1, the WrappedRE2::Replace function built its replacement result and passed it to V8 using ToLocalChecked without …

| Memory Corruption
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
7.6 HIGH
CVE-2026-71327 — Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcrout…

traefik | Remote | Misconfiguration
Aug 06, 2026 Aug 07, 2026
Aug 06, 2026
Aug 07, 2026
2.1 LOW
CVE-2026-71326 — Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent passw…

traefik | Remote | Authentication
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
4.8 MEDIUM
CVE-2026-71325 — Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef

Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for Tr…

traefik | Authorization
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
7.0 HIGH
CVE-2026-71324 — Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend ke…

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its bod…

traefik | Remote | Misconfiguration
Aug 06, 2026 Aug 07, 2026
Aug 06, 2026
Aug 07, 2026
7.0 HIGH
CVE-2026-70640 — llama.cpp b1886–b7445 Race Condition Use-After-Free via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Android JNI wrapper where bench_1model() and free_1context() lack synchronization, allowing Thr…

llama.cpp | Race Condition
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
5.5 MEDIUM
CVE-2026-70639 — llama.cpp b1886–b7445 Null Pointer Dereference DoS via llama-android.cpp

llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer be…

llama.cpp | Memory Corruption
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
8.5 HIGH
CVE-2026-70638 — llama.cpp b1886–b7445 Integer Overflow via new_1batch() in llama-android.cpp

llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrapper where the new_1batch() function multiplies sizeof(llama_seq_id) by an attacker-controll…

llama.cpp | Memory Corruption
Aug 06, 2026 Aug 07, 2026
Aug 06, 2026
Aug 07, 2026
7.5 HIGH
CVE-2026-70636 — Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist match…

flowise | Remote | Authentication
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
7.1 HIGH
CVE-2026-70635 — TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Bulk Dictionary Decompression Negative Index

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by su…

timescaledb | Remote | Memory Corruption
Aug 06, 2026 Aug 07, 2026
Aug 06, 2026
Aug 07, 2026
8.1 HIGH
CVE-2026-70634 — TimescaleDB 2.29.1 Out-of-Bounds Read Information Disclosure via Dictionary Compression R…

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path …

timescaledb | Remote | Information Disclosure
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
6.5 MEDIUM
CVE-2026-70633 — TimescaleDB 2.29.1 Out-of-Bounds Read DoS via Gorilla Compression Reverse Iterator

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial…

timescaledb | Remote | Denial of Service
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
7.8 HIGH
CVE-2026-70632 — FFmpeg 4.4 < 9.0 Heap Out-of-Bounds Write in CFHD Decoder via AVI Demuxing

FFmpeg versions from 4.4 up to, but not including, 9.0 contain an out-of-bounds heap write vulnerability in the native GoPro CineForm HD (CFHD) decoder that allows remote attackers to corrupt heap me…

ffmpeg | Memory Corruption
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
5.5 MEDIUM
CVE-2026-70631 — FFmpeg 0.5 < 9.0 Uninitialized Heap Memory Read in TIFF Decoder

FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg …

ffmpeg | Memory Corruption
Aug 06, 2026 Aug 06, 2026
Aug 06, 2026
Aug 06, 2026
Showing 20 of 10058 Results