Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
5.3 MEDIUM
CVE-2026-11904 — Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security V…

IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access Container 11.0 through 11.0.2 and IBM Security Verify Access Contain…

Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.5 MEDIUM
CVE-2026-10700 — Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed…

IBM Langflow OSS 1.0.0 through 1.8.4 contains multiple broken access control vulnerabilities in its file handling API that allow unauthorized access to user files.The /api/v1/files/images/{flow_id}/{…

langflow_oss | Remote | Authorization
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.2 MEDIUM
CVE-2026-10695 — IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries

IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries.

db2 | Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2026-10545 — IBM Planning Analytics Local is affected by Open Redirect

IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authenti…

planning_analytics_local | Remote | Misconfiguration
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.4 HIGH
CVE-2026-10535 — IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to pr…

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to buffer overflow in setgid helper db2flacc.

db2 | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
5.5 MEDIUM
CVE-2025-36374 — IBM DataPower Gateway affected by XML external entity injection

IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or co…

datapower_gateway | Remote | XML External Entity
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.1 MEDIUM
CVE-2025-0152 — IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multipl…

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthent…

Remote | Cross-Site Scripting
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.3 MEDIUM
CVE-2024-40683 — IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active …

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session af…

operations_analytics_log_analysis | Remote | Authentication
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2024-25039 — IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multipl…

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could allow for a Slowloris HTT…

Remote | Denial of Service
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2026-9322 — IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by…

IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 are vulnerable to a denial of service via a crafted HTTP request.

Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
6.1 MEDIUM
CVE-2026-66414 — Leantime Open Redirect in Login Controller via redirectUrl Parameter

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the re…

Remote | Misconfiguration
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
7.5 HIGH
CVE-2026-62663 — Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/documen…

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters (image, audio, video, document) in banks accept untrusted user input as fil…

Remote | Path Traversal
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
8.7 HIGH
CVE-2026-54722 — dssrf: there a critical security bug with remove_at_symbol_in_string

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.4, is_url_safe in src/helpers.ts strips the @ userinfo delimiter with remove_at_symbo…

Remote | Server-Side Request Forgery
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
2.1 LOW
CVE-2026-54522 — MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner …

| Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2026-51295 — SQLite Use-After-Free Vulnerability

SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can t…

| Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2026-51294 — SQLite jsonArrayLengthFunc Use-After-Free

SQLite 3.41 is vulnerable to use after free in the jsonArrayLengthFunc function.

| Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2026-51293 — SQLite Use-After-Free Vulnerability

A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode() function is invoked subsequent to sqlite3DbFree() being called on the aBlob member of the Parse structure.

| Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
0.0 NA
CVE-2026-51292 — SQLite Use-After-Free Vulnerability

sqlite 3.41 has a use-after-free vulnerability in the memory buffer processing logic. Remote attackers can exploit this flaw via specially crafted input to cause arbitrary code execution, sensitive i…

| Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.8 CRITICAL
CVE-2026-51291 — SQLite JSON Cache Use-After-Free

sqlite 3.41 is vulnerable to use after free in the json.c jsonCacheInsert function of the JSON cache management module.

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
9.1 CRITICAL
CVE-2026-51290 — SQLite B-tree Module Use-After-Free Vulnerability

SQLite 3.41 has a use-after-free vulnerability in the shared cache lock management logic of the btree module. The program frees a BtLock structure without removing the node from the linked list. Subs…

Remote | Memory Corruption
Jul 30, 2026 Jul 30, 2026
Jul 30, 2026
Jul 30, 2026
Showing 20 of 10047 Results