cve.li

Recent

CVE-2026-11374CWE-340CWE-330CWE-287

Account Takeover via Predictable SSO Ticket Generation

Published 2026-06-23 by Zohocorp

CVE-2026-10521CWE-425

Authenticated unintended access to critical program parameters

Published 2026-06-23 by CERTVDE

CVE-2026-9733CWE-340CWE-338

Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter

Published 2026-06-23 by CPANSec

CVE-2026-8379

Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Download

Published 2026-06-23 by WPScan

CVE-2026-8378

Frontend File Manager Plugin <= 23.6 - Subscriber+ Stored Cross-Site Scripting via File Rename

Published 2026-06-23 by WPScan

CVE-2026-8172

Simple Basic Contact Form <= 20250114 - Reflected XSS

Published 2026-06-23 by WPScan

CVE-2026-8163

Infility Global < 2.15.19 - Subscriber+ SQL Injection via order Parameter

Published 2026-06-23 by WPScan

CVE-2026-7842

Infility Global < 2.15.20 - Editor+ SQL Injection via orderby Parameter

Published 2026-06-23 by WPScan

CVE-2026-12866CWE-94

Published 2026-06-23 by snyk

CVE-2026-55654CWE-125

Openssh: heap out-of-bounds read in red hat enterprise linux versions of openssh gssapi indicator cleanup due to missing null sentinel termination

Published 2026-06-23 by redhat

CVE-2026-55655CWE-923

Openssh: local mitm of x11 forwarding via abstract unix socket pre-binding in red hat enterprise linux openssh client versions

Published 2026-06-23 by redhat

CVE-2026-55653CWE-415

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Published 2026-06-23 by redhat

CVE-2026-11833CWE-319

Published 2026-06-23 by YokogawaGroup

CVE-2026-10658

Bluetooth Host ISO RX Missing SDU Header Length Validation in bt_iso_recv() Leads to DoS

Published 2026-06-22 by zephyr

CVE-2026-10651CWE-20CWE-617

Bluetooth Classic SDP parser truncation bug in bt_sdp_parse_attribute() leads to reachable assertion and possible out-of-bounds read

Published 2026-06-22 by zephyr

CVE-2026-10645CWE-125

fs: ext2: Missing structural validation of directory entries can cause out-of-bounds read and zero-progress directory traversal

Published 2026-06-22 by zephyr

CVE-2026-47155CWE-345

vLLM: Artifact Pin Decay in vLLM allows pinned deployments to load unpinned code, weights, and processors

Published 2026-06-22 by GitHub_M

CVE-2026-41523CWE-94CWE-617

vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution

Published 2026-06-22 by GitHub_M

CVE-2026-54232CWE-427

vLLM: Dependency Confusion Vulnerability in vLLM Dockerfile

Published 2026-06-22 by GitHub_M

CVE-2026-54233CWE-409

vLLM: OOM Denial of Service via Audio Decompression Bomb

Published 2026-06-22 by GitHub_M

CVE-2026-54236CWE-532

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

Published 2026-06-22 by GitHub_M

CVE-2026-54235CWE-1287

vLLM: temperature=NaN and temperature=Infinity bypass validation and propagate to GPU kernels

Published 2026-06-22 by GitHub_M

CVE-2026-48746CWE-444

vLLM: OpenAI auth bypass

Published 2026-06-22 by GitHub_M

CVE-2026-53923CWE-681CWE-200

vLLM GGUF Kernels: int64_t to int truncation of tensor dimensions causes GPU buffer overflow

Published 2026-06-22 by GitHub_M

CVE-2026-55409CWE-79

Filament: Disabled RichEditor field state can be used for XSS

Published 2026-06-22 by GitHub_M

CVE-2026-48067CWE-639

Filament: Inconsistent scope enforcement for AttachAction and AssociateAction Select fields

Published 2026-06-22 by GitHub_M

CVE-2026-48167CWE-79

Filament: Unvalidated ImageColumn and ImageEntry values can be used for XSS

Published 2026-06-22 by GitHub_M

CVE-2026-48500CWE-862

Filament: Unauthenticated temporary file upload on auth pages

Published 2026-06-22 by GitHub_M

CVE-2026-48166CWE-208

Filament: Timing-based user enumeration on login page

Published 2026-06-22 by GitHub_M

CVE-2026-48505CWE-362CWE-841

Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission

Published 2026-06-22 by GitHub_M

CVE-2026-44889CWE-601

WebOb: Location header normalization during redirect leads to open redirect

Published 2026-06-22 by GitHub_M

CVE-2026-48109CWE-20

MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

Published 2026-06-22 by GitHub_M

CVE-2026-48502CWE-125CWE-190CWE-407CWE-409CWE-470CWE-502CWE-674CWE-789CWE-1188

MessagePack-CSharp: Denial of service vulnerabilities can swamp the CPU or crash the process with stack and heap overflows

Published 2026-06-22 by GitHub_M

CVE-2026-48506CWE-674

MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth

Published 2026-06-22 by GitHub_M

CVE-2026-48509CWE-1188

MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies

Published 2026-06-22 by GitHub_M

CVE-2026-48510CWE-409CWE-770

MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths

Published 2026-06-22 by GitHub_M

CVE-2026-48511CWE-407

MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps

Published 2026-06-22 by GitHub_M

CVE-2026-48512CWE-674

MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement

Published 2026-06-22 by GitHub_M

CVE-2026-48513CWE-674

MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement

Published 2026-06-22 by GitHub_M

CVE-2026-48514CWE-770

MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

Published 2026-06-22 by GitHub_M

CVE-2026-48515CWE-770

MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions

Published 2026-06-22 by GitHub_M

CVE-2026-48516CWE-407

MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings

Published 2026-06-22 by GitHub_M

CVE-2026-56698CWE-79

Nuxt - Cross-Site Scripting via navigateTo open Option

Published 2026-06-22 by VulnCheck

CVE-2026-56697CWE-601

Nuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtApp

Published 2026-06-22 by VulnCheck

CVE-2026-56357CWE-290

n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Verification in GitHub Webhook Trigger

Published 2026-06-22 by VulnCheck

CVE-2026-56348CWE-918

n8n - Credential Exfiltration via Allowed HTTP Request Domains Bypass in Dynamic Node Parameters Endpoint

Published 2026-06-22 by VulnCheck

CVE-2026-56326CWE-601

Nuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateTo

Published 2026-06-22 by VulnCheck

CVE-2026-56324CWE-770

Capgo - Rate Limit Bypass via User-Controlled device_id Parameter

Published 2026-06-22 by VulnCheck

CVE-2026-56323CWE-200

Capgo - Unauthenticated Channel Enumeration and App Oracle via GET /channel_self

Published 2026-06-22 by VulnCheck

CVE-2026-56321CWE-306

Capgo - Missing Authentication Middleware on GET /private/role_bindings Endpoint

Published 2026-06-22 by VulnCheck

CVE-2026-56314CWE-672

Capgo - Deleted Bundle Selection via Missing Deletion Filter in /updates Endpoint

Published 2026-06-22 by VulnCheck

CVE-2026-56311CWE-285

Capgo - Unauthenticated Cross-Tenant Disclosure via get_current_plan_max_org RPC

Published 2026-06-22 by VulnCheck

CVE-2026-56306CWE-20

Capgo - Subkey Enforcement Bypass via x-limited-key-id Header Parsing

Published 2026-06-22 by VulnCheck

CVE-2026-56280CWE-862

Cap-go - Privilege Inversion in Build Log Stream via SSE Disconnect

Published 2026-06-22 by VulnCheck

CVE-2026-56268CWE-863

Flowise - Cross-Workspace Information Disclosure via chatflows/apikey Endpoint

Published 2026-06-22 by VulnCheck

CVE-2026-56266CWE-918

Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints

Published 2026-06-22 by VulnCheck

CVE-2026-56255CWE-770

Capgo - Denial of Service via Unlimited Demo App Creation

Published 2026-06-22 by VulnCheck

CVE-2026-56221CWE-89

Cap-go - SQL Injection in Cloudflare Analytics Engine Queries via cloudflare.ts

Published 2026-06-22 by VulnCheck

CVE-2025-71358CWE-502

picklescan - Remote Code Execution via idlelib.autocomplete.AutoComplete.get_entity

Published 2026-06-22 by VulnCheck

CVE-2025-71344CWE-502

picklescan - Arbitrary Code Execution via Undetected ensurepip._run_pip Function

Published 2026-06-22 by VulnCheck

CVE-2025-71339CWE-502

Picklescan - Arbitrary Code Execution via numpy.f2py.crackfortran._eval_length Gadget

Published 2026-06-22 by VulnCheck

CVE-2026-48517CWE-470CWE-502

MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments

Published 2026-06-22 by GitHub_M

CVE-2026-54911CWE-20

UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()

Published 2026-06-22 by GitHub_M

CVE-2026-44311CWE-79CWE-116

Fabric.js: Improper escaping in fabric.Gradient colorStops leads to XSS in SVG serialization

Published 2026-06-22 by GitHub_M

CVE-2026-54281CWE-863

Nest: Middleware Bypass on Fastify via Trailing Slash

Published 2026-06-22 by GitHub_M

CVE-2026-49468CWE-290

LiteLLM: Authentication Bypass via Host Header Injection

Published 2026-06-22 by GitHub_M

CVE-2026-41479CWE-601

Authlib OAuth 2.0 authorization endpoint open redirects to attacker-controlled redirect_uri on unsupported response_type

Published 2026-06-22 by GitHub_M

CVE-2026-45034CWE-502

PhpSpreadsheet: File::prohibitWrappers bypass

Published 2026-06-22 by GitHub_M

CVE-2026-54651CWE-835

pypdf: Possible infinite loop when processing threads/articles in writer

Published 2026-06-22 by GitHub_M

CVE-2026-49460CWE-407

pypdf: Inefficient decoding of FlateDecode PNG predictor streams

Published 2026-06-22 by GitHub_M

Load more ↓