Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 79 available sources using the dropdown above.
| ID | CVSS | Description | Vendor | Product | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-58659 |
8.4 (4.0)
7.8 (3.1)
|
PyTorch Lightning Arbitrary Code Execution via _instan… |
Lightning-AI |
pytorch-lightning |
2026-07-15T17:02:40.640Z | 2026-07-18T01:03:17.592Z |
| CVE-2026-55410 |
6.7 (3.1)
|
NocoBase backup restore schema name allows command injection |
nocobase |
nocobase |
2026-07-15T20:19:54.632Z | 2026-07-18T01:52:49.269Z |
| CVE-2026-53514 |
7.7 (3.1)
|
Better Auth: Unauthorized invitation acceptance via un… |
better-auth |
better-auth |
2026-07-15T17:30:46.069Z | 2026-07-18T01:13:02.175Z |
| CVE-2026-53512 |
9.1 (4.0)
|
Better Auth: OAuth refresh-token replay via missing cl… |
better-auth |
better-auth |
2026-07-15T17:18:09.512Z | 2026-07-18T01:08:08.419Z |
| CVE-2026-50030 |
7.1 (4.0)
|
DataEase: Arbitrary SQL execution in preview path (dir… |
dataease |
dataease |
2026-07-15T19:24:51.531Z | 2026-07-18T01:30:34.129Z |
| CVE-2026-49988 |
6.8 (4.0)
|
Repomix: attach_packed_output can bypass file-read sec… |
yamadashy |
repomix |
2026-07-15T18:05:10.789Z | 2026-07-18T01:16:12.325Z |
| CVE-2026-49867 |
6.3 (4.0)
|
DataEase: Authenticated Stored XSS in DataEase Templat… |
dataease |
dataease |
2026-07-15T19:41:52.701Z | 2026-07-18T01:38:33.335Z |
| CVE-2026-45419 |
8.5 (4.0)
|
DataEase: Arbitrary File Write Vulnerability |
dataease |
dataease |
2026-07-15T19:21:46.596Z | 2026-07-18T01:24:30.454Z |
| CVE-2026-8505 |
9.8 (3.1)
|
Authentication Bypass in Webhook Endpoints Allowed Una… |
IBM |
Langflow OSS |
2026-07-17T19:06:00.986Z | 2026-07-17T23:15:27.248Z |
| CVE-2026-7755 |
8.8 (3.1)
|
MCP Server Configuration Validator Bypass via File Upl… |
IBM |
Langflow OSS |
2026-07-17T19:18:26.904Z | 2026-07-17T23:15:17.947Z |
| CVE-2026-48010 |
6.5 (3.1)
|
Shopware: Privilege escalation: non-admin user with us… |
shopware |
shopware |
2026-07-17T17:55:25.722Z | 2026-07-17T23:15:41.762Z |
| CVE-2026-47183 |
6.5 (3.1)
|
Zeroconf: Unbounded exception-dedup state retains pack… |
python-zeroconf |
python-zeroconf |
2026-07-17T18:22:59.803Z | 2026-07-17T23:15:36.656Z |
| CVE-2026-45162 |
8 (3.1)
|
Pimcore: Unsafe PHP Deserialization in Multiple Locati… |
pimcore |
pimcore |
2026-07-17T18:50:19.924Z | 2026-07-17T23:15:31.060Z |
| CVE-2026-44739 |
8.7 (3.1)
|
Pimcore: SQL Injection in Custom Reports Column Config… |
pimcore |
pimcore |
2026-07-17T19:10:10.107Z | 2026-07-17T23:15:23.395Z |
| CVE-2026-15093 |
4.3 (3.1)
|
Multiple Vulnerabilities in IBM Engineering AI hub. |
IBM |
Engineering AI Hub |
2026-07-17T19:37:57.768Z | 2026-07-17T23:15:12.887Z |
| CVE-2026-10652 |
4.8 (3.1)
|
Out-of-bounds read in Zephyr DNS resolver TXT/SRV reco… |
zephyrproject |
zephyr |
2026-06-30T15:50:46.510Z | 2026-07-17T22:11:32.866Z |
| CVE-2026-10638 |
5.9 (3.1)
|
Use-after-free in Zephyr ICMPv6 RX path when updating … |
zephyrproject |
zephyr |
2026-06-16T13:16:14.688Z | 2026-07-17T22:11:32.345Z |
| CVE-2026-58598 |
7 (3.1)
|
Windows Backup Service Elevation of Privilege Vulnerability |
Microsoft |
Windows 10 Version 21H2 |
2026-07-16T21:57:56.220Z | 2026-07-18T03:55:29.122Z |
| CVE-2026-57980 |
5.4 (3.1)
|
Microsoft Edge (Chromium-based) Tampering Vulnerability |
Microsoft |
Microsoft Edge (Chromium-based) |
2026-07-17T21:29:27.541Z | 2026-07-17T21:29:27.541Z |
| CVE-2026-56741 |
7.5 (3.1)
|
JLine: Unauthenticated Remote DoS via Unbounded Telnet… |
jline |
jline3 |
2026-07-17T21:15:14.732Z | 2026-07-17T21:15:14.732Z |
| CVE-2026-56740 |
7.5 (3.1)
|
JLine: Unauthenticated Remote Memory Exhaustion via Un… |
jline |
jline3 |
2026-07-17T21:17:03.239Z | 2026-07-17T21:17:03.239Z |
| CVE-2026-56171 |
7.1 (3.1)
|
Windows Remote Desktop Protocol (RDP) Information Disc… |
Microsoft |
Remote Desktop Web Client |
2026-07-17T21:34:17.768Z | 2026-07-17T21:34:17.768Z |
| CVE-2026-54335 |
3.7 (3.1)
|
Feathersjs: Prototype pollution in @feathersjs/commons… |
feathersjs |
feathers |
2026-07-17T20:56:51.857Z | 2026-07-17T20:56:51.857Z |
| CVE-2026-49485 |
7.5 (3.1)
|
HAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches… |
hapifhir |
org.hl7.fhir.core |
2026-07-17T20:59:47.800Z | 2026-07-17T20:59:47.800Z |
| CVE-2026-48049 |
5.3 (3.1)
|
@hapi/inert: Static-file confinement bypass via siblin… |
hapijs |
inert |
2026-07-17T21:03:16.577Z | 2026-07-17T21:03:16.577Z |
| CVE-2026-48022 |
6.5 (3.1)
|
@hapi/wreck: Sensitive credential headers leak across … |
hapijs |
wreck |
2026-07-17T21:02:05.980Z | 2026-07-17T21:02:05.980Z |
| CVE-2026-44979 |
6.3 (4.0)
|
@hapi/wreck : Sensitive `Proxy-Authorization` header l… |
hapijs |
wreck |
2026-07-17T21:01:01.165Z | 2026-07-17T21:01:01.165Z |
| CVE-2026-55518 |
9.6 (3.1)
|
Avo: Missing Authorization in Avo Association Attach E… |
avo-hq |
avo |
2026-07-17T20:51:19.056Z | 2026-07-17T20:51:19.056Z |
| CVE-2026-54498 |
8.7 (3.1)
|
view_component: around_render HTML-Safety Bypass |
ViewComponent |
view_component |
2026-07-17T20:46:52.176Z | 2026-07-17T20:46:52.176Z |
| CVE-2026-54497 |
6.8 (3.1)
|
view_component: Reused Component Instances Retain Stal… |
ViewComponent |
view_component |
2026-07-17T20:45:28.338Z | 2026-07-17T20:45:28.338Z |