Search
80 CVEs · published 2026-07-18 to 2026-07-18
CVEs (80)
Showing 1–25 of 80
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-71396 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript scripting functions when the scrip… |
| CVE-2025-71394 | NONE | Patched | — | 2026-07-18 | SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to read arbitrary files on the file… |
| CVE-2024-58356 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table … |
| CVE-2026-16156 | LOW | 3.5 | 2026-07-18 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /forexam.php. The manipulation of the … | |
| CVE-2026-16155 | LOW | 3.5 | 2026-07-18 | A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /schoolyr.php. The … | |
| CVE-2026-57857 | MEDIUM | 4.3 | 2026-07-18 | The Flow Payment plugin for WordPress (flow.cl) version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an o… | |
| CVE-2026-16122 | MEDIUM | 4.3 | 2026-07-18 | A security flaw has been discovered in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function extractBin/RequestApproval/matchesAllowlist of t… | |
| CVE-2026-16081 | MEDIUM | 4.3 | 2026-07-18 | A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can… | |
| CVE-2026-9734 | MEDIUM | 4.3 | 2026-07-18 | The W3SC Elementor to Zoho CRM plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0. This is due to missing or incor… | |
| CVE-2026-16075 | MEDIUM | 4.3 | 2026-07-18 | A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulnerability affects the function OpenApiRoute.get_chat_sessions of the file astrbot/dashboard/routes/open_… | |
| CVE-2026-16130 | MEDIUM | 4.4 | 2026-07-18 | A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validate_path of the file src/tools/builtin/path_utils.rs of the compon… | |
| CVE-2026-16088 | MEDIUM | 4.7 | 2026-07-18 | A vulnerability was detected in halo-dev halo up to 2.24.2. Affected by this vulnerability is the function Download of the file MigrationEndpoint.java of the component File… | |
| CVE-2024-58358 | MEDIUM | Patched | 4.9 | 2026-07-18 | SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Atta… |
| CVE-2026-16133 | MEDIUM | 5.0 | 2026-07-18 | A flaw has been found in LiuMengxuan04 MiniCode 0.1.0. Affected by this vulnerability is the function child_process.spawn of the file mcp.ts. Executing a manipulation can l… | |
| CVE-2026-16129 | MEDIUM | 5.3 | 2026-07-18 | A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction._validate_command of the file src/safestclaw/action… | |
| CVE-2026-16085 | MEDIUM | 5.3 | 2026-07-18 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. Affected is the function NewContextBuilder of the file pkg/agent/context.go. Such manipulation le… | |
| CVE-2026-16082 | MEDIUM | 5.3 | 2026-07-18 | A vulnerability was identified in Sipeed PicoClaw up to 0.2.9. The impacted element is the function ExecTool.executeRun of the file pkg/agent/pipeline_execute.go. The manip… | |
| CVE-2026-16083 | MEDIUM | 5.3 | 2026-07-18 | A security flaw has been discovered in Sipeed PicoClaw up to 0.2.9. This affects the function webhook.ParseRequest of the file pkg/channels/line/line.go of the component LI… | |
| CVE-2026-16077 | MEDIUM | 5.3 | 2026-07-18 | A vulnerability was found in AstrBotDevs AstrBot up to 4.25.5. Impacted is the function _normalize_rw_path of the file astrbot/core/tools/computer_tools/fs.py of the compon… | |
| CVE-2026-57848 | MEDIUM | 5.5 | 2026-07-18 | Stoat for Android exports the chat.stoat.activities.ShareTargetActivity component (reachable to any process on the device via the android.intent.action.SEND intent) and acc… | |
| CVE-2025-71398 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP address… |
| CVE-2025-71390 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http… |
| CVE-2025-71393 | NONE | Patched | — | 2026-07-18 | SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenti… |
| CVE-2026-16196 | MEDIUM | 6.3 | 2026-07-18 | A weakness has been identified in Sipeed PicoClaw up to 0.2.9. Impacted is the function isPrivateOrRestrictedIP of the file pkg/tools/integration/web.go of the component we… | |
| CVE-2026-16197 | MEDIUM | 6.3 | 2026-07-18 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu_… |