Search
450 CVEs · published 2026-07-27 to 2026-07-27
CVEs (450)
Showing 226–250 of 450
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-65921 | HIGH | 8.8 | 2026-07-27 | A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location. | |
| CVE-2026-65618 | MEDIUM | 6.5 | 2026-07-27 | Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposin… | |
| CVE-2026-65617 | HIGH | 8.8 | 2026-07-27 | A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific rep… | |
| CVE-2026-65616 | HIGH | 8.8 | 2026-07-27 | Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token. | |
| CVE-2026-64649 | NONE | Patched | — | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redir… |
| CVE-2026-64648 | NONE | Patched | — | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request bo… |
| CVE-2026-59729 | NONE | Patched | — | 2026-07-27 | Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix f… |
| CVE-2026-59727 | NONE | Patched | — | 2026-07-27 | Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive i… |
| CVE-2026-56748 | HIGH | Patched | 8.8 | 2026-07-27 | Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline prev… |
| CVE-2026-56747 | HIGH | Patched | 8.8 | 2026-07-27 | Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to… |
| CVE-2026-42017 | HIGH | 8.8 | 2026-07-27 | An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions. | |
| CVE-2026-42016 | HIGH | Patched | 8.1 | 2026-07-27 | JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the… |
| CVE-2026-66759 | HIGH | 7.1 | 2026-07-27 | A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifyi… | |
| CVE-2026-66758 | HIGH | 7.8 | 2026-07-27 | A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width an… | |
| CVE-2026-66757 | MEDIUM | 5.5 | 2026-07-27 | A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysiz… | |
| CVE-2026-66031 | MEDIUM | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and Jav… | |
| CVE-2026-64647 | NONE | Patched | — | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request bod… |
| CVE-2026-64646 | NONE | Patched | — | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js application… |
| CVE-2026-51244 | HIGH | 7.5 | 2026-07-27 | schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackFrameHeader(). Multiple attacker-controlled index parameters are used to access static and he… | |
| CVE-2026-17612 | NONE | — | 2026-07-27 | Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability that could al… | |
| CVE-2026-16481 | NONE | — | 2026-07-27 | A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool take… | |
| CVE-2026-12383 | HIGH | 7.5 | 2026-07-27 | A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_cla… | |
| CVE-2026-10683 | LOW | 2.4 | 2026-07-27 | In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state… | |
| CVE-2026-10682 | MEDIUM | 6.6 | 2026-07-27 | The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id paramete… | |
| CVE-2026-66030 | MEDIUM | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and Ja… |