Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
0.0 NA
CVE-2025-69933 — CodeAstro Membership Management System SQL Injection

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.

| Injection
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2025-69931 — CodeAstro Membership Management System SQL Injection

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.

| Injection
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2025-69930 — CodeAstro Membership Management System SQL Injection

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.

| Injection
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2025-65342 — Blood System Cross-Site Scripting

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field.

| Cross-Site Scripting
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2025-65341 — Ecommerce Fruits Bazar Cross-Site Scripting Vulnerability

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.

| Cross-Site Scripting
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2025-65336 — Fruits-Bazar SQL Injection

Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.

| Injection
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.8 CRITICAL
CVE-2026-67594 — Spikster Missing Authentication via API Route Group

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware,…

Remote | Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
5.7 MEDIUM
CVE-2026-67550 — re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex`…

re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset …

| Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.4 MEDIUM
CVE-2026-67530 — WACRM: SSRF via the automation `send_webhook` action

WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/lib/automations/validate.ts all…

Remote | Server-Side Request Forgery
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
4.3 MEDIUM
CVE-2026-67529 — OpenProject: Private work package subject/identity disclosure through the global Time Ent…

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href…

Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
4.3 MEDIUM
CVE-2026-67528 — OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" lea…

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and allowed UserCustomField and G…

Remote | Information Disclosure
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.6 HIGH
CVE-2026-67527 — OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH param…

OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages …

Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.8 CRITICAL
CVE-2026-67208 — Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console …

Remote | Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.8 HIGH
CVE-2026-67207 — Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController

Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted backup functionality due to …

Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.8 HIGH
CVE-2026-67206 — Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload

Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by exploiting missing file extension…

Remote | Misconfiguration
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.9 MEDIUM
CVE-2026-66756 — Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=fa…

Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upgrade to version 4.0.0-beta-1,…

tika | Remote | Path Traversal
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
5.9 MEDIUM
CVE-2026-66755 — Apache Tika: Arbitrary Local File Read in ISArchiveParser

Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the appli…

tika | Path Traversal
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.6 MEDIUM
CVE-2026-65835 — Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still a…

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Generators in internal/controllers…

capsule | Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.8 MEDIUM
CVE-2026-65834 — Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing…

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfiguration.Spec.NodeMetadata.Forbidde…

capsule | Remote | Misconfiguration
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.9 CRITICAL
CVE-2026-12946 — Remote Code Execution in CUGA Component CodeAgent

IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.

langflow_oss | Remote | Injection
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
Showing 20 of 10053 Results