Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-14932 — Unauthenticated File Read and Deletion via Hardcoded Encryption Key in RadChart

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files withi…

telerik_ui_for_asp.net_ajax | Remote | Path Traversal
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
5.3 MEDIUM
CVE-2026-14865 — XXE Denial of Service via RadLayoutBuilder Client State in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via …

telerik_ui_for_asp.net_ajax | Remote | XML External Entity
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
5.9 MEDIUM
CVE-2026-14586 — Assertion in libngtcp2 when under pressure in high concurrency DNS-over-QUIC environments

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, in DNS-over-QUIC environments, with high concurrency and under pressure, an assertion in libngtcp2 about monotonic timestamps could trigger an…

unbound | Denial of Service
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
6.5 MEDIUM
CVE-2026-13192 — RadEditor PDF Export SSRF Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side req…

telerik_ui_for_asp.net_ajax | Remote | Server-Side Request Forgery
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
8.1 HIGH
CVE-2026-13190 — PersistenceFramework Unsafe Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which c…

telerik_ui_for_asp.net_ajax | Remote | Injection
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
7.5 HIGH
CVE-2026-13189 — SpellChecker DictionaryLanguage Path Traversal Vulnerability in Telerik UI for ASP.NET AJ…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolutio…

telerik_ui_for_asp.net_ajax | Remote | Server-Side Request Forgery
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
5.9 MEDIUM
CVE-2026-13188 — DialogHandler Parameters Tampering Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation.

telerik_ui_for_asp.net_ajax | Remote | Injection
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
8.1 HIGH
CVE-2026-13187 — DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation.

telerik_ui_for_asp.net_ajax | Remote | Injection
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
8.1 HIGH
CVE-2026-13186 — AppDataStorageProvider Path Traversal Deserialization Vulnerability in Telerik UI for ASP…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-contro…

telerik_ui_for_asp.net_ajax | Remote | Path Traversal
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
8.1 HIGH
CVE-2026-13185 — PersistenceFramework Cookie Deserialization Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unau…

telerik_ui_for_asp.net_ajax | Remote | Authentication
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
7.5 HIGH
CVE-2026-13184 — RadAsyncUpload Default HMAC Key Fallback Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall b…

telerik_ui_for_asp.net_ajax | Remote | Misconfiguration
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
7.5 HIGH
CVE-2026-13183 — RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to r…

telerik_ui_for_asp.net_ajax | Remote | Cryptography
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
7.5 HIGH
CVE-2026-13182 — RadAsyncUpload Client-State Decrypt-vs-Parse Oracle Vulnerability in Telerik UI for ASP.N…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals prote…

telerik_ui_for_asp.net_ajax | Remote | Information Disclosure
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
8.1 HIGH
CVE-2026-13181 — RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NE…

In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote cod…

telerik_ui_for_asp.net_ajax | Remote | Misconfiguration
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
9.3 CRITICAL
CVE-2026-8152 — Unblu Spark Open Redirect leading to DOM-Based XSS

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=…

spark | Remote | Cross-Site Scripting
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
7.8 HIGH
CVE-2026-44191 — Ansible-lightspeed: visual studio code ansible lightspeed extension: remote code executio…

A flaw was found in the Visual Studio Code Ansible Lightspeed extension. This command injection vulnerability (CWE-78) arises from improper handling of the ansible.executionEnvironment.containerOptio…

Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
6.9 MEDIUM
CVE-2026-16270 — ReDoS in Open Mercato

Open Mercato does not validate regex rules. An attacker with privileges to create the regex rule can add an unsafe regex to a field. When someone provide the proper string it can result in a DoS atta…

Remote | Denial of Service
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
8.8 HIGH
CVE-2026-65603 — Grav Login Plugin 3.8.11 Privilege Escalation via Profile Update

The Grav Login plugin (grav-plugin-login) versions <= 3.8.11 contain a privilege escalation flaw in the authenticated profile self-update handler (processUserProfile(), the update_user task). Unlike …

grav | Remote | Authorization
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
5.3 MEDIUM
CVE-2026-65602 — Traefik before 3.6.23 IngressRouteTCP ServersTransport Namespace Bypass

Traefik 3.6.0 through 3.6.22 and 3.7.0 through 3.7.6 fail to enforce the crossProviderNamespaces allowlist for IngressRouteTCP service serversTransport references (the allowlist was only enforced for…

traefik | Remote | Misconfiguration
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
5.3 MEDIUM
CVE-2026-65601 — Traefik before 3.7.7 Namespace Confusion via HTTPRoute ExtensionRef

Traefik versions 3.7.0 through 3.7.6 contain a namespace confusion vulnerability in the Kubernetes Gateway API provider. When resolving HTTPRoute.spec.rules[].backendRefs[].filters[].extensionRef, Tr…

traefik | Remote | Authorization
Jul 22, 2026 Jul 22, 2026
Jul 22, 2026
Jul 22, 2026
Showing 20 of 9652 Results