Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.7 HIGH
CVE-2026-19317 — Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)

An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending spec…

fireware_os | Remote | Denial of Service
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.7 HIGH
CVE-2026-19316 — Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS)

A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially cr…

fireware_os | Remote | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
9.3 CRITICAL
CVE-2026-19315 — Fireware OS Pre-Authentication Type Confusion in iked Allows Remote Code Execution

A type confusion vulnerability in the iked process of WatchGuard Fireware OS allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

fireware_os | Remote | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.7 HIGH
CVE-2026-19314 — Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS)

An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending speci…

fireware_os | Remote | Denial of Service
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
9.3 CRITICAL
CVE-2026-19313 — Fireware OS Pre-Authentication Heap Buffer Overflow in iked Allows Remote Code Execution

An heap overflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to execute arbitrary code by sending specially crafted network traffic.

fireware_os | Remote | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.7 HIGH
CVE-2026-13108 — Dimension Denial-of-Service

WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service.

Remote | Denial of Service
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
9.3 CRITICAL
CVE-2026-13086 — Fireware OS Stack-Based Buffer Overflow in Mobile Security epm Endpoint

A stack-based buffer overflow in the epm (Endpoint Protection Manager) service used by the deprecated Mobile Security feature in WatchGuard Fireware OS allows an unauthenticated remote attacker to ex…

fireware_os | Remote | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
0.0 NA
CVE-2026-82072 — Google Chrome V8 Out-of-Bounds Read

Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

chrome chrome | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
6.9 MEDIUM
CVE-2026-81851 — Fireware OS Heap-Based Buffer Overflow in iked Allows Denial of Service

A heap-based buffer overflow vulnerability in Fireware OS's iked process allows an authenticated administrator to crash the IKE daemon (iked), resulting in a denial of service, by saving a specially …

fireware_os | Remote | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.1 MEDIUM
CVE-2026-81848 — cyberchitta scrapling-fetch-mcp _fetcher.py s_fetch_pattern server-side request forgery

A vulnerability was determined in cyberchitta scrapling-fetch-mcp up to 0.2.2. The impacted element is the function s_fetch_page/s_fetch_pattern of the file src/scrapling_fetch_mcp/_fetcher.py. Execu…

scrapling-fetch-mcp | Remote | Server-Side Request Forgery
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
6.5 MEDIUM
CVE-2026-81847 — MAA-AI MaaMCP pipeline_tools.py load_pipeline path traversal

A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeline/load_pipeline of the file pipeline_tools.py. Performing a manipulation resul…

maamcp | Remote | Path Traversal
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
6.5 MEDIUM
CVE-2026-81845 — arben-adm mcp-sequential-thinking Import Session/Export Session server.py export_session …

A vulnerability has been found in arben-adm mcp-sequential-thinking up to 0.5.0. Impacted is the function import_session/export_session of the file mcp_sequential_thinking/server.py of the component …

mcp-sequential-thinking | Remote | Path Traversal
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
7.5 HIGH
CVE-2026-81837 — RooCodeInc Roo-Code ApplyPatchTool ApplyPatchTool.ts path.resolve path traversal

A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation…

roo-code | Remote | Path Traversal
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
3.7 LOW
CVE-2026-81836 — RooCodeInc Roo-Code OAuth Callback oauth.ts cleartext transmission

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipu…

roo-code | Remote | Cryptography
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
6.5 MEDIUM
CVE-2026-81835 — RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instruction…

A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP Integration Trust…

roo-code | Remote | Injection
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
5.9 MEDIUM
CVE-2026-80179 — Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize(…

Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
9.8 CRITICAL
CVE-2026-78239 — Xiiaozet LK100W Missing Authentication for Critical Function

Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful…

Remote | Authentication
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.8 HIGH
CVE-2026-78037 — Xiiaozet LK100W OS Command Injection

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated …

Remote | Injection
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.1 HIGH
CVE-2026-77977 — Ebyte NE2-D11 Missing Authentication for Critical Function

Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthe…

| Authentication
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
8.2 HIGH
CVE-2026-77358 — cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()

cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, produci…

cpp-httplib | Remote | Memory Corruption
Aug 28, 2026 Aug 28, 2026
Aug 28, 2026
Aug 28, 2026
Showing 20 of 12379 Results