Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
9.3 CRITICAL
CVE-2026-74254 — Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixe…

Remote | Injection
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
10.0 CRITICAL
CVE-2026-74253 — Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected use…

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes {source} blocks found in Joomla…

Remote | Injection
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
8.7 HIGH
CVE-2026-73523 — COVESA Open1722 0.9.2 Stack Memory Disclosure via acf-can-listener.c Integer Truncation

COVESA Open1722 through 0.9.2 contains an integer truncation vulnerability in acf-can-listener.c that allows unauthenticated remote attackers to cause the CAN listener to transmit process stack memor…

Remote | Memory Corruption
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
8.7 HIGH
CVE-2026-73522 — COVESA Open1722 0.9.2 Stack Buffer Overflow via avtp_to_can() in acf-can-listener

COVESA Open1722 through 0.9.2 contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to write past the end of a fixed 15-slot stack array by sending a crafted UDP…

Remote | Memory Corruption
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
6.5 MEDIUM
CVE-2026-73424 — Astro: Unauthenticated path override in the @astrojs/vercel ISR function

Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the publ…

Remote | Authentication
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
8.7 HIGH
CVE-2026-71980 — Belledonne Communications bcg729 1.1.2 Out-of-Bounds Read via decodeSIDframe()

Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to tri…

Remote | Memory Corruption
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
8.7 HIGH
CVE-2026-71979 — INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing

INDI (Instrument Neutral Distributed Interface) indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to cra…

Remote | Memory Corruption
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
8.7 HIGH
CVE-2026-71491 — sqlparse: Quadratic O(n²) DoS in group_comments

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guar…

Remote | Denial of Service
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
5.3 MEDIUM
CVE-2026-68520 — Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/c…

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, as_dict_secure() in glances/config.py checks only option names and exposes public_username and credentials embedded in…

glances | Remote | Information Disclosure
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
7.1 HIGH
CVE-2026-68519 — Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix …

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run() in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes secu…

glances | Injection
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
8.8 HIGH
CVE-2026-62982 — Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by neste…

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, _sanitize_mustache_dict() in glances/actions.py skips nested list and dictionary strings such as process cmdli…

glances | Injection
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
6.5 MEDIUM
CVE-2026-59903 — Netty: Cache Poisoning and Information Disclosure via CORS Vary Header Overwrite

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.http.cors.CorsHandler setVaryHeader replaces application Vary hea…

Remote | Information Disclosure
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
7.5 HIGH
CVE-2026-59902 — Netty: Memory Exhaustion in SctpMessageCompletionHandler

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and …

Remote | Denial of Service
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
6.2 MEDIUM
CVE-2026-59894 — sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped b…

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse/filters/output.py fails to escape existing backslashes before quotes in sqlparse.format output_format='python' and …

| Injection
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
7.5 HIGH
CVE-2026-59893 — sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial…

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted lit…

Remote | Denial of Service
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
8.7 HIGH
CVE-2026-54284 — sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS bef…

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by grou…

Remote | Denial of Service
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
0.0 NA
CVE-2026-51346 — Stud.IP SQL Injection Vulnerability

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store() functions.

| Injection
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
0.0 NA
CVE-2026-50772 — Squirro Cognitive Search Remote Code Execution

An issue in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload to the password reset function.

| Authentication
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
0.0 NA
CVE-2026-50771 — Squirro Cognitive Search Cross-Site Scripting Vulnerability

Cross Site Scripting vulnerability in Squirro Cognitive Search < 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions.

| Cross-Site Scripting
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
0.0 NA
CVE-2026-50770 — Squirro Cognitive Search Privilege Escalation

An issue in Squirro Cognitive Search before v.3.14.2 allows a remote attacker to escalate privileges via a crafted request.

| Authorization
Aug 17, 2026 Aug 17, 2026
Aug 17, 2026
Aug 17, 2026
Showing 20 of 11223 Results