Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
4.3 MEDIUM
CVE-2026-32823 — dataCycle State-Changing GET Endpoints Enable CSRF

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before an…

Remote | Cross-Site Request Forgery
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
8.1 HIGH
CVE-2026-32821 — API Collection Impersonation Via user_email And Missing Object- Level Authorization

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before an…

Remote | Authorization
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
7.5 HIGH
CVE-2026-32820 — dataCycle Public Markdown Path Traversal Via /docs/*path

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before an…

Remote | Path Traversal
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
4.3 MEDIUM
CVE-2026-32819 — dataCycle User Directory Enumeration Via /users/search

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before an…

Remote | Information Disclosure
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
7.5 HIGH
CVE-2026-32806 — dataCycle Authorization Bypass Via /remote_render

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before an…

Remote | Authorization
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
5.4 MEDIUM
CVE-2026-6793 — Stored XSS in Bifra Engineering's Q-smart NexT Poll

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS. This issue affects Q-smar…

Remote | Cross-Site Scripting
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
8.6 HIGH
CVE-2026-63429 — HeyForm has unauthenticated /api/upload endpoint that accepts arbitrary files with no aut…

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `POST /api/upload` has no authentication guard, no global guard, no form-context validation, no `openToken` requirement, and no se…

Remote | Authentication
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
5.8 MEDIUM
CVE-2026-63428 — HeyForm: completeSubmission persists submitter-supplied hidden fields verbatim without va…

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.9, `completeSubmission` accepts a `hiddenFields: [{id, name, value}]` array from the submitter and stores it verbatim in `submission.…

Remote | Injection
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
5.4 MEDIUM
CVE-2026-63102 — rConfig Core < 8.2.8 Privilege Escalation via Users API role field

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Us…

Remote | Authorization
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
9.9 CRITICAL
CVE-2026-51027 — FileThingie Information Disclosure Vulnerability

An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component.

Remote | Information Disclosure
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
6.5 MEDIUM
CVE-2026-51026 — FileThingie Directory Traversal Vulnerability

Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request.

Remote | Path Traversal
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
5.3 MEDIUM
CVE-2026-48824 — Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messag…

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw (CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited …

mailpit | Remote | Denial of Service
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
4.4 MEDIUM
CVE-2026-46671 — Rust OneNote File Parser: Path traversal in `Parser::parse_notebook` allows reading files…

Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook…

| Path Traversal
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
9.1 CRITICAL
CVE-2026-46428 — lettre has TLS hostname verification disabled when using Boring TLS backend

lettre is a a mailer library for Rust. Starting in version 0.10.1 and prior to version 0.11.22, an inverted-boolean bug in lettre's `boring-tls` integration silently disables TLS hostname verificatio…

Remote | Misconfiguration
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
8.2 HIGH
CVE-2026-46415 — Caddy Defender trusted proxy client IP bypass

The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` whe…

Remote | Misconfiguration
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
10.0 CRITICAL
CVE-2026-46412 — Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm

@beproduct/nestjs-auth is a NestJS authentication module for BeProduct IDS (Identity Server) with OpenID Connect support. Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised np…

Remote | Supply Chain
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
6.4 MEDIUM
CVE-2026-45797 — HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the `/api/upload` endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets …

Remote | Cross-Site Scripting
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
7.5 HIGH
CVE-2026-45713 — Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1…

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the f…

mailpit | Remote | Denial of Service
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
5.9 MEDIUM
CVE-2026-45712 — Mailpit: Concurrent map read & write in proxy CSS rewriter - remote unauth crash (fatal e…

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the screenshot/print proxy (/proxy?data=…) maintains a package-level assets map[string]MessageAssets cache, but reads…

mailpit | Remote | Race Condition
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
5.9 MEDIUM
CVE-2026-45711 — Mailpit: Path traversal & arbitrary file write in mailpit dump --http via attacker-contro…

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump --http <base-url> <out-dir> sub-command downloads every message from a remote Mailpit instance and w…

mailpit | Remote | Path Traversal
Jul 20, 2026 Jul 20, 2026
Jul 20, 2026
Jul 20, 2026
Showing 20 of 8205 Results