Search
29 CVEs · published 2026-07-18 to 2026-07-18, High severity
CVEs (29)
Showing 1–25 of 29
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-10130 | HIGH | 8.2 | 2026-07-18 | QueryWeaver contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signu… | |
| CVE-2026-16154 | HIGH | 7.3 | 2026-07-18 | A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0/1.php. Affected by this vulnerability is an unknown functionality of the file /edit_r… | |
| CVE-2026-16152 | HIGH | 7.3 | 2026-07-18 | A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /edit_rooma.php. Performing a manipulation of… | |
| CVE-2026-12228 | HIGH | 8.7 | 2026-07-18 | A stored cross-site scripting (XSS) vulnerability exists in the `POST /api/prompts/share` endpoint of parisneo/lollms (latest version). The endpoint stores attacker-control… | |
| CVE-2026-53994 | HIGH | 7.5 | 2026-07-18 | ProFTPD mod_sftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxp_packet_read() function accepts the attacker-supplied 32-bit big-endi… | |
| CVE-2026-16128 | HIGH | 7.3 | 2026-07-18 | A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver_thread of the file claw/services/swarm/swarm.c of the component http_r… | |
| CVE-2026-16127 | HIGH | 7.3 | 2026-07-18 | A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function claw_net_get/claw_net_post of the file claw/tools/tool_net.c of the component http_r… | |
| CVE-2026-16126 | HIGH | 7.3 | 2026-07-18 | A vulnerability was determined in zevorn rt-claw up to 0.2.0. The impacted element is the function handle_rpc_request of the file claw/services/swarm/swarm.c of the compone… | |
| CVE-2026-16125 | HIGH | 7.3 | 2026-07-18 | A vulnerability was found in zevorn rt-claw up to 0.2.0. The affected element is the function claw_net_get/claw_net_post of the file claw/services/tools/net.c of the compon… | |
| CVE-2026-9323 | HIGH | 8.1 | 2026-07-18 | The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that … | |
| CVE-2026-11826 | HIGH | 8.8 | 2026-07-18 | OpenPLC_v3 contains a heap-based buffer overflow in the getData() function in webserver/core/modbus_master.cpp. getData() reads characters between two delimiters into a cal… | |
| CVE-2024-58368 | HIGH | Patched | 7.5 | 2026-07-18 | SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can sen… |
| CVE-2024-58366 | HIGH | Patched | 8.5 | 2026-07-18 | SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges … |
| CVE-2024-58362 | HIGH | Patched | 8.8 | 2026-07-18 | SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it… |
| CVE-2023-54366 | HIGH | Patched | 8.8 | 2026-07-18 | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions… |
| CVE-2026-9147 | HIGH | 7.8 | 2026-07-18 | uproot dynamically generates Python class source code from ROOT TStreamerInfo records in a file and compiles it at runtime. Some file-controlled streamer metadata fields (f… | |
| CVE-2026-59173 | HIGH | Patched | 7.5 | 2026-07-18 | Uncontrolled Resource Consumption vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.13, from 10.0.0 through 10.1.2. … |
| CVE-2026-16158 | HIGH | Patched | 8.7 | 2026-07-18 | Impact: @fastify/reply-from versions from 8.3.1 up to but not including 12.6.4 build the internal URL cache key by concatenating the destination and source path without a d… |
| CVE-2026-15631 | HIGH | Patched | 8.7 | 2026-07-18 | Impact: @fastify/http-proxy versions from 9.4.0 up to and including 11.5.0 fail to validate the resolved WebSocket destination path against the configured rewrite prefix. T… |
| CVE-2026-16097 | HIGH | 8.8 | 2026-07-18 | A vulnerability was found in Shibby Tomato 1.28. This vulnerability affects the function sub_42537C of the component Scheduler Name Handler. The manipulation of the argumen… | |
| CVE-2026-16096 | HIGH | 8.8 | 2026-07-18 | A vulnerability has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. This affects the function sub_40BB50 of the file /proc/webmon_recent_domains. The manipulation… | |
| CVE-2026-16095 | HIGH | 8.8 | 2026-07-18 | A flaw has been found in Shibby Tomato 1.28 RT-N5x MIPSR2 Build 124. Affected by this issue is the function setup_conntrack of the file /sbin/rc. Executing a manipulation o… | |
| CVE-2026-47871 | HIGH | Patched | 8.8 | 2026-07-18 | VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation allow malicious, authenticated network users to perform directory trave… |
| CVE-2026-47870 | HIGH | Patched | 7.1 | 2026-07-18 | VMware Avi Load Balancer contains a privilege escalation vulnerability. A malicious authenticated user with network access may be able to execute remote code. Affected ver… |
| CVE-2026-47869 | HIGH | Patched | 8.7 | 2026-07-18 | VMware Avi Load Balancer contains a remote code execution vulnerability. A malicious authenticated user with network access may be able to inject and execute code. Affecte… |