Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 80 available sources using the dropdown above.
| ID | CVSS | Description | Vendor | Product | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2026-33327 |
7 (4.0)
|
Possible integer overflow leading to potential heap-ba… |
libvips |
libvips |
2026-07-20T16:21:16.663Z | 2026-07-20T19:07:38.256Z |
| CVE-2026-46701 |
7.6 (3.1)
|
Network-AI: Unauthenticated Cross-Origin MCP Tool Invo… |
Jovancoding |
Network-AI |
2026-07-20T16:33:43.791Z | 2026-07-20T19:07:31.413Z |
| CVE-2026-44178 |
8.8 (3.1)
|
xrdp: Channel Data Forwarding Fixed-Size Buffer Overflow |
neutrinolabs |
xrdp |
2026-07-20T16:54:30.590Z | 2026-07-20T19:07:24.213Z |
| CVE-2026-39385 |
7.1 (4.0)
|
Frappe LMS enrollment bypass in paid courses via unrel… |
frappe |
lms |
2026-07-20T16:55:08.593Z | 2026-07-20T19:07:17.376Z |
| CVE-2026-55238 |
5.3 (3.1)
|
xrdp: Malformed Confirm Active capability sets cause o… |
neutrinolabs |
xrdp |
2026-07-20T17:05:01.470Z | 2026-07-20T19:07:08.673Z |
| CVE-2026-55639 |
5.3 (3.1)
|
xrdp: Out-of-bounds read in GCC Conference Create Requ… |
neutrinolabs |
xrdp |
2026-07-20T17:14:50.233Z | 2026-07-20T19:06:59.250Z |
| CVE-2026-44227 |
6.1 (3.1)
|
RT: Reflected Cross-Site Scripting via URL parameters |
bestpractical |
rt |
2026-07-20T17:32:48.794Z | 2026-07-20T19:06:52.288Z |
| CVE-2026-63769 |
6.3 (4.0)
7.7 (3.1)
|
Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method |
huginn |
huginn |
2026-07-20T19:05:41.298Z | 2026-07-20T19:05:41.298Z |
| CVE-2026-32823 |
4.3 (3.1)
|
dataCycle State-Changing GET Endpoints Enable CSRF |
datacycle-engine |
dataCycle-CORE |
2026-07-20T16:12:33.395Z | 2026-07-20T19:05:22.754Z |
| CVE-2026-35590 |
6.8 (4.0)
|
Possible out-of-bounds read leading to crash when deco… |
libvips |
libvips |
2026-07-20T16:23:33.905Z | 2026-07-20T19:03:42.733Z |
| CVE-2026-63770 |
8.2 (4.0)
7.5 (3.1)
|
Glance 0.8.5 IP Spoofing Authentication Brute-Force Pr… |
glanceapp |
glance |
2026-07-20T19:02:36.910Z | 2026-07-20T19:02:36.910Z |
| CVE-2026-35198 |
9 (3.1)
|
HeyForm vulnerable to stored XSS via form field titles |
heyform |
heyform |
2026-07-20T15:47:21.255Z | 2026-07-20T19:02:26.984Z |
| CVE-2026-58414 |
5.5 (3.1)
|
Network-AI: EnvironmentManager.backup() follows symlin… |
Jovancoding |
Network-AI |
2026-07-20T16:28:29.809Z | 2026-07-20T19:00:05.188Z |
| CVE-2026-41521 |
8.2 (3.1)
|
xrdp: lib_framebuffer_update Has Integer Overflow Heap… |
neutrinolabs |
xrdp |
2026-07-20T16:41:43.935Z | 2026-07-20T18:57:19.781Z |
| CVE-2026-26199 |
5.9 (4.0)
|
Buffer underflow in `H5Iget_name `/`H5G_get_name` if s… |
HDFGroup |
hdf5 |
2026-07-20T14:59:35.038Z | 2026-07-20T18:56:52.113Z |
| CVE-2026-47275 |
2.6 (3.1)
|
nanomq NULL Pointer Dereference in MQTTv5 Client CONNE… |
nanomq |
nanomq |
2026-07-20T16:43:03.704Z | 2026-07-20T18:56:28.995Z |
| CVE-2026-39878 |
9.3 (3.1)
|
Chamilo stored XSS via user registration leads to admi… |
chamilo |
chamilo-lms |
2026-07-20T17:08:21.230Z | 2026-07-20T18:54:20.667Z |
| CVE-2026-58484 |
7.1 (3.1)
|
Network-AI: Poisoned environment backup manifest allow… |
Jovancoding |
Network-AI |
2026-07-20T17:00:56.125Z | 2026-07-20T18:52:43.854Z |
| CVE-2026-55626 |
8 (3.1)
|
xrdp: No authentication required with Xvnc backend on RHEL 9 |
neutrinolabs |
xrdp |
2026-07-20T17:11:44.442Z | 2026-07-20T18:50:51.567Z |
| CVE-2026-48389 |
7.8 (3.1)
|
DNG SDK | Stack-based Buffer Overflow (CWE-121) |
Adobe |
DNG SDK |
2026-07-20T18:14:22.124Z | 2026-07-20T18:50:01.299Z |
| CVE-2026-54538 |
7.5 (3.1)
|
xrdp: Pre-auth infinite loop via totalLength=0 in TS_S… |
neutrinolabs |
xrdp |
2026-07-20T16:57:32.738Z | 2026-07-20T18:48:02.307Z |
| CVE-2026-61425 |
9.4 (4.0)
|
Joomla Extension - balbooa.com - Authentication bypass… |
balbooa.com |
Gridbox extension for Joomla |
2026-07-20T18:45:51.191Z | 2026-07-20T18:45:51.191Z |
| CVE-2026-63731 |
6.3 (4.0)
7.7 (3.1)
|
HyperDX < 2.31.0 SSRF via ClickHouse Proxy Test Endpoint |
hyperdxio |
hyperdx |
2026-07-20T18:45:14.088Z | 2026-07-20T18:45:14.088Z |
| CVE-2026-46715 |
5.3 (4.0)
|
Flask-Security-Too OAuth reauthentication freshness by… |
pallets-eco |
Flask-Security-Too |
2026-07-20T17:10:27.014Z | 2026-07-20T18:43:54.970Z |
| CVE-2026-6656 |
7.5 (3.1)
|
Crypt::Password versions through 0.28 for Perl are sus… |
DRSTEVE |
Crypt::Password |
2026-07-20T07:01:45.818Z | 2026-07-20T18:38:21.362Z |
| CVE-2026-63071 |
N/A
|
Apache Syncope: RCE via Groovy Sandbox bypass |
Apache Software Foundation |
Apache Syncope |
2026-07-20T14:19:19.065Z | 2026-07-20T18:38:20.369Z |
| CVE-2026-62418 |
N/A
|
Apache Syncope: Low-privileged authenticated SSRF in C… |
Apache Software Foundation |
Apache Syncope |
2026-07-20T14:27:04.679Z | 2026-07-20T18:38:19.443Z |
| CVE-2026-62183 |
N/A
|
Apache Syncope: User self-service privilege escalation |
Apache Software Foundation |
Apache Syncope |
2026-07-20T14:23:20.294Z | 2026-07-20T18:38:18.526Z |
| CVE-2026-57308 |
N/A
|
Apache Syncope: SQL injection vulnerability in Audit E… |
Apache Software Foundation |
Apache Syncope |
2026-07-20T14:21:57.415Z | 2026-07-20T18:38:15.528Z |
| CVE-2026-53421 |
N/A
|
Apache Syncope: Remote Code Execution via Scripted Connector |
Apache Software Foundation |
Apache Syncope |
2026-07-20T14:21:10.071Z | 2026-07-20T18:38:14.593Z |