Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
7.8 HIGH
CVE-2026-67178 — Open Redirect in MISP Installer-Generated Apache Configuration

MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: Redirect permanent / https://misp.example Apache’s Redirect…

Remote | Misconfiguration
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-66299 — Apache Tomcat: DoS via WebSocket chat example

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.8…

tomcat | Denial of Service
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
8.8 HIGH
CVE-2026-63727 — Anchore Enterprise Privilege Escalation via User Management API

Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anch…

Remote | Authorization
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
5.1 MEDIUM
CVE-2026-67173 — Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests

Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an imag…

Remote | Server-Side Request Forgery
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
5.1 MEDIUM
CVE-2026-66922 — Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipula…

Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties in…

Remote | Misconfiguration
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
6.3 MEDIUM
CVE-2026-66921 — Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated <sp…

Remote | Cross-Site Scripting
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-61487 — Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via te…

Improper Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated low-privilege user can bypass a per-destination write ACL by sending to an Act…

activemq activemq_broker | Authorization
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-59878 — Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size …

Improper Input Validation vulnerability in Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All. A remote unauthenticated peer that can reach an exposed AMQP NIO connector can trigger denial-o…

activemq | Denial of Service
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
7.3 HIGH
CVE-2026-8164 — Search Order Hijacking in ArkSigner's ArkSigner Desktop Client

Uncontrolled Search Path Element vulnerability in ArkSigner Software and Hardware Industry and Trade Inc. ArkSigner Desktop Client allows Search Order Hijacking. This issue affects ArkSigner Desktop…

| Path Traversal
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
5.5 MEDIUM
CVE-2026-7521 — SAML certificate deletion allows path traversal to delete arbitrary files outside the con…

Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to del…

Remote | Path Traversal
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
9.2 CRITICAL
CVE-2026-67174 — DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick

Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as …

Remote | Cross-Site Scripting
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
2.0 LOW
CVE-2026-6879 — Quadratic Behavior in xml.etree.ElementPath Index Predicates

`Element.findall()` and fully-consumed `Element.iterfind()` exhibit `O(n^2)` time complexity when using XPath index predicates (e.g. `[1]`, `[last()]`, `[last()-N]`) on XML documents with many same-t…

cpython cpython | Remote | Denial of Service
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-66713 — Apache Axis2/Java: deserialization of untrusted Data

Deserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component  in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat  (only when Tribes clustering …

| Injection
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
8.8 HIGH
CVE-2026-7187 — Improper Authentication in Universal Sotware's UKBS

Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects UKBS: through 28072026.…

| Authentication
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
8.2 HIGH
CVE-2026-66920 — Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer r…

Remote | Denial of Service
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
6.9 MEDIUM
CVE-2026-66919 — Stored DOM-Based Cross-Site Scripting in Node Modal Headers

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to const…

Remote | Cross-Site Scripting
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
8.2 HIGH
CVE-2026-66918 — DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code…

Remote | Cross-Site Scripting
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
6.9 MEDIUM
CVE-2026-66913 — Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Lookyloo did not enforce limits on the decompressed size of uploaded capture archives and compressed HAR files. An attacker could submit a specially crafted ZIP, gzip, or zlib-compressed capture con…

Remote | Denial of Service
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-65882 — Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a reflected XSS vector.

| Cross-Site Scripting
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
0.0 NA
CVE-2026-65881 — Joomla Extension - joomdle.com - Insecure default configuration allows read/write user ac…

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1 - The default configuration of the extension allowed read access and password …

| Authorization
Jul 28, 2026 Jul 28, 2026
Jul 28, 2026
Jul 28, 2026
Showing 20 of 9420 Results