Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.5 HIGH
CVE-2026-73233 — FreeCAD: FEM formula incomplete escape

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, the FEM Displacement Constraint task dialog in src/Mod/Fem/Gui/TaskFemConstraintDisplacement.cpp passes the xDis…

| Injection
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
7.5 HIGH
CVE-2026-73232 — ffuf denial of service (OOM) via HTTP response decompression bomb

ffuf is a fast web fuzzer written in Go. Prior to 2.2.0, ffuf allows a malicious target server to cause an out-of-memory denial of service because the response size guard in pkg/runner/simple.go chec…

Remote | Denial of Service
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
7.8 HIGH
CVE-2026-73231 — Faker: helpers.fake exploitable into arbritary code execution

Faker generates massive amounts of fake data in the browser and Node.js. Prior to 10.5.0, the faker.helpers.fake method in src/modules/helpers/eval.ts allows attacker-controlled fake templates to acc…

| Injection
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
5.9 MEDIUM
CVE-2026-73230 — Ente: 2of3 cards v1 contain a checksum that enables offline guessing of low-entropy secre…

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on eve…

| Cryptography
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
4.3 MEDIUM
CVE-2026-73229 — Django REST framework: AdminRenderer may disclose GET-protected data when rendering inval…

Django REST framework is a powerful and flexible toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's rest_framework/renderers.py AdminRenderer.render() uses override_method() to s…

Remote | Information Disclosure
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
4.4 MEDIUM
CVE-2026-73036 — Bash-it barbuk Theme 3.2.0 Terminal Escape Sequence Injection via pyproject.toml

Bash-it 3.2.0 contains a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment that allows local attackers to inject arbitrary terminal control seque…

| Injection
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
9.8 CRITICAL
CVE-2026-73034 — DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences i…

Remote | Path Traversal
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
9.6 CRITICAL
CVE-2026-73032 — PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanit…

Remote | Injection
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
8.7 HIGH
CVE-2026-73031 — telegram-search Stored XSS via v-html in MessageList.vue

telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitiz…

Remote | Cross-Site Scripting
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
6.3 MEDIUM
CVE-2026-71845 — Insights-client: insights-client: ccx_token bearer credential logged in clear text at sta…

A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deploym…

advanced_cluster_management_for_kubernetes | Remote | Information Disclosure
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
5.0 MEDIUM
CVE-2026-71475 — Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded int…

A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can inject unencoded data into the Insights API URL path. This occurs because the ClusterID, which is con…

advanced_cluster_management_for_kubernetes | Remote | Path Traversal
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
6.3 MEDIUM
CVE-2026-71474 — Insights-client-rhel9: insights-client: pull-secret bearer token written to logs on non-2…

A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with acce…

advanced_cluster_management_for_kubernetes | Remote | Information Disclosure
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
5.3 MEDIUM
CVE-2026-71468 — Acm-search-v2-api-rhel9: search-v2-api: cross-user bearer-token reuse via global federati…

A flaw was found in acm-search-v2-api-rhel9. When the `getFederationConfig` function refreshes its cache, it improperly reuses a user's bearer token for all subsequent federated requests until the ca…

advanced_cluster_management_for_kubernetes | Remote | Information Disclosure
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
7.5 HIGH
CVE-2026-71467 — Acm-search-v2-api-rhel9: search-v2-api: authentication bypass on /federated via upgrade: …

A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthentica…

advanced_cluster_management_for_kubernetes | Remote | Authentication
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
5.4 MEDIUM
CVE-2026-70339 — Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
6.1 MEDIUM
CVE-2026-66146 — GMS Cross-Site Scripting Vulnerability

Multiple Cross-Site Scripting (XSS) vulnerabilities were identified in GMS 9.5.1 (Build 9510.1044) and earlier versions that allow a remote attacker to execute javascript script in a user's browser.

Remote | Cross-Site Scripting
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
9.1 CRITICAL
CVE-2026-66145 — GMS Arbitrary File Write Vulnerability

An unauthenticated remote code execution vulnerability was identified in GMS 9.5.1 (Build 9510.1044) and earlier versions which allows remote attacker to read sensitive data and perform arbitrary fil…

Remote | Information Disclosure
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
2.3 LOW
CVE-2026-65655 — Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminati…

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Se…

Remote | Authentication
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
8.7 HIGH
CVE-2026-48813 — Flawfinder output manipulation via untrusted filenames and source text

Flawfinder is a a static analysis tool for finding vulnerabilities in C/C++ source code. Versions prior to 2.0.20 have an improper input neutralization issue leading to output manipulation, specifica…

Remote | Injection
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
7.5 HIGH
CVE-2026-48804 — python-socketio: Binary attachment accumulation can cause denial of service

python-socketio is a Python implementation of the Socket.IO realtime client and server. The python-socketio server stores binary `EVENT` and `ACK` messages in memory while it waits to receive their b…

Remote | Denial of Service
Aug 11, 2026 Aug 11, 2026
Aug 11, 2026
Aug 11, 2026
Showing 20 of 10982 Results