Search
450 CVEs · published 2026-07-27 to 2026-07-27
CVEs (450)
Showing 251–275 of 450
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-66029 | MEDIUM | 5.4 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and Jav… | |
| CVE-2026-66028 | MEDIUM | 6.7 | 2026-07-27 | Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client a… | |
| CVE-2026-64645 | NONE | Patched | — | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a rewrites() or redirects() rule that… |
| CVE-2026-64644 | NONE | Patched | — | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the def… |
| CVE-2026-64643 | NONE | Patched | — | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router,… |
| CVE-2026-64642 | NONE | Patched | — | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 16.0.0 through 16.2.10, crafted requests targeting Next.js applications using App Router … |
| CVE-2026-64641 | NONE | Patched | — | 2026-07-27 | Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, crafted requests targeting Next.js app… |
| CVE-2026-59239 | NONE | Patched | — | 2026-07-27 | Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary Ja… |
| CVE-2026-55579 | CRITICAL | Patched | 9.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, Pheditor ships with a hardcoded default password admin (SHA-51… |
| CVE-2026-55578 | HIGH | Patched | 8.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.6, the terminal feature in Pheditor uses an incomplete character … |
| CVE-2026-54540 | HIGH | Patched | 8.8 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. Prior to version 2.0.5, there is an authenticated terminal command whitelist bypass. The terminal feature … |
| CVE-2026-54272 | NONE | Patched | — | 2026-07-27 | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification … |
| CVE-2026-51235 | HIGH | 8.8 | 2026-07-27 | LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch() function (src/libraw_cxx.cpp) and fuji_rotate() function (src/decoders/fuji.cpp). | |
| CVE-2026-48052 | MEDIUM | Patched | 5.4 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename … |
| CVE-2026-48051 | LOW | Patched | 3.5 | 2026-07-27 | Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, Papra's webhook delivery system contains an SSRF protection bypass that allows … |
| CVE-2026-48030 | CRITICAL | Patched | 9.9 | 2026-07-27 | Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action h… |
| CVE-2026-45623 | HIGH | Patched | 7.5 | 2026-07-27 | PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the Previ… |
| CVE-2026-17570 | MEDIUM | 4.3 | 2026-07-27 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via… | |
| CVE-2026-17569 | MEDIUM | 4.3 | 2026-07-27 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via… | |
| CVE-2026-17568 | HIGH | 8.8 | 2026-07-27 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership m… | |
| CVE-2026-17552 | CRITICAL | Patched | 9.1 | 2026-07-27 | Plack::App::Prerender versions before 0.3.0 for Perl can proxy to an arbitrary host via unvalidated REQUEST_URI concatenation in call. When the rewrite base is a plain str… |
| CVE-2026-66731 | HIGH | 7.5 | 2026-07-27 | facil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to cra… | |
| CVE-2026-66730 | HIGH | 7.5 | 2026-07-27 | facil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze wo… | |
| CVE-2026-66729 | HIGH | 7.5 | 2026-07-27 | facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server … | |
| CVE-2026-66391 | MEDIUM | Patched | 6.5 | 2026-07-27 | Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 … |