Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2026-62986 — OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosure

OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In versions 3.3.0 through 3.3.12 and 3.4.0 through 3.4.13, the PyO…

| Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-55620 — eml_parser: DoS via deeply nested parens in Received headers

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.routing.noparenthesis in e…

| Denial of Service
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-55619 — eml_parser: Parser DoS via deeply nested parentheses in e-mail headers

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, eml_parser.parser.HeaderParser.header…

| Denial of Service
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.1 HIGH
CVE-2026-80050 — ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart U…

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions. Att…

Remote | Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
8.8 HIGH
CVE-2026-80049 — Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied w…

Airbyte Platform resolves the workspace used for its authorization decision from a field the caller supplies. AuthorizationServerHandler copies recognised identifiers out of the raw JSON request body…

Remote | Authorization
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.1 HIGH
CVE-2026-79788 — Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted…

In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorizat…

Remote | Server-Side Request Forgery
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
9.8 CRITICAL
CVE-2026-79787 — Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signature

Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers to spoof user identity. Attackers can extract usernames fro…

Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.1 HIGH
CVE-2026-79786 — Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registration

Coroot's unauthenticated MCP OAuth dynamic client registration endpoint accepts any syntactically valid redirect URI without validation, allowing attackers to register clients pointing to attacker-co…

Remote | Authentication
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-55618 — eml_parser: URL extraction bypass via HTML entities in URLs

eml_parser serves as a python module for parsing eml files and returning various information found in the e-mail as well as computed information. Prior to 3.0.2, the clean_found_uri function in eml_p…

| Information Disclosure
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
0.0 NA
CVE-2026-61555 — OpenEXR: Empty multiView viewFromChannelName file crash

OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR versions before 3.2.11, 3.3.0 through 3.3.12, and 3.4.0 through…

| Denial of Service
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
5.9 MEDIUM
CVE-2026-80051 — graphql-go/graphql Improper Input Validation and Denial of Service Vulnerability

github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) …

| Misconfiguration
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.8 HIGH
CVE-2026-79992 — Emacs: local shell command injection through the user field in emacs tramp

A flaw was found in Emacs TRAMP. A local attacker could exploit this vulnerability by processing maliciously crafted filenames. This occurs because TRAMP concatenates login arguments without proper s…

Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
5.5 MEDIUM
CVE-2026-76198 — CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files…

| Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
10.0 CRITICAL
CVE-2026-76197 — Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS …

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution i…

campaign_classic | Remote | Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
10.0 CRITICAL
CVE-2026-76195 — Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS …

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution i…

campaign_classic | Remote | Injection
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
10.0 CRITICAL
CVE-2026-76193 — Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could expl…

campaign_classic | Remote | Server-Side Request Forgery
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
6.2 MEDIUM
CVE-2026-76189 — CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to c…

| Denial of Service
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.8 HIGH
CVE-2026-75770 — Substance3D - Painter | Out-of-bounds Write (CWE-787)

Substance3D - Painter is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user in…

substance_3d_painter | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.8 HIGH
CVE-2026-75769 — Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)

Substance3D - Painter is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires u…

substance_3d_painter | Memory Corruption
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
7.8 HIGH
CVE-2026-75768 — Substance3D - Painter | Untrusted Search Path (CWE-426)

Substance3D - Painter is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerabil…

substance_3d_painter | Path Traversal
Aug 25, 2026 Aug 25, 2026
Aug 25, 2026
Aug 25, 2026
Showing 20 of 11799 Results