Total CVEs

140,303

Critical Severity

3,711

High Severity

13,344

Last 7 Days

1,830
Quick preset (or use dates below)
Clear Filters
๐Ÿ“… Showing Year: 2026 (January 1 - December 31, 2026) View All Years โ†’
Showing 41 - 60 of 36,708 CVEs
CVE-2026-49349 MEDIUM - 6.8

regclient may leak authentication credentials to external blob stores

Vendor: go
Product: github.com/regclient/regclient
Published: Jun 26, 2026
Source: GitHub
CVE-2026-55069 HIGH - 8.7

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, this vulnerability exists in the BasicAuth authentication component of the Kestra OSS workflow orchestration platform. An attacker who gains read access to the PostgreSQL database can exploit SHA-512's high computat...

Vendor: kestra-io
Product: kestra
Published: Jun 26, 2026
Source: NVD
CVE-2026-53577 MEDIUM - 6.5

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the previewFileFromExecution endpoint (GET /api/v1/{tenant}/executions/{executionId}/file/preview) contains an access control bypass that allows any authenticated user to read output files from any other execu...

Vendor: kestra-io
Product: kestra
Published: Jun 26, 2026
Source: NVD
CVE-2026-53576 CRITICAL - 10.0

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, the authentication filter for the REST API (@Filter("/api/v1/**")) treats any request whose path ends in /configs as the public instance-config endpoint and forwards it without a credential check. ke...

Vendor: kestra-io
Product: kestra
Published: Jun 26, 2026
Source: NVD

A stored cross-site scripting (XSS) vulnerability in the item type administration page of Koha Library Management System through 25.11 allows an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the item type check-in message field (checkinmsg)

Published: Jun 26, 2026
Source: NVD

A stored cross-site scripting (XSS) vulnerability in the OPAC item detail page of Koha Library Management System through 25.11 allows an authenticated remote attacker with edit_items permission to inject arbitrary web scripts via the item public notes field (items.itemnotes).

Published: Jun 26, 2026
Source: NVD

Cross-Site Scripting (XSS) vulnerability in the patron restriction type administration page of Koha Library Management System through 25.11 allows an authenticated remote attacker with administrator privileges to inject arbitrary web scripts via the restriction type label (display_text field)

Published: Jun 26, 2026
Source: NVD
CVE-2026-49984 HIGH - 7.7

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.23, the local internal-storage backend validates user-supplied paths for .. traversal before it converts Windows-style backslashes to forward slashes. An attacker can therefore smuggle a traversal sequence past th...

Vendor: kestra-io
Product: kestra
Published: Jun 26, 2026
Source: NVD
CVE-2026-49869 CRITICAL - 10.0

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact...

Vendor: kestra-io
Product: kestra
Published: Jun 26, 2026
Source: NVD
CVE-2026-45807 HIGH - 7.7

Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.43 and 1.3.19, several Kestra API endpoints accept a kestra:// URI from the client and pass it through StorageInterface.parentTraversalGuard before reading the underlying file from the local storage backend. The guard only i...

Vendor: kestra-io
Product: kestra
Published: Jun 26, 2026
Source: NVD

Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr memory read/write commands, in the unauthenticated UART debug console of the Tenda N300 F3 (V603) allow a physically proximate attacker to obtain stored WPA2 credentials in cleartext and to read or write arbi...

Published: Jun 26, 2026
Source: NVD

A stack overflow in the AP4_Array<AP4_TrunAtom::Entry>::EnsureCapacity component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

Published: Jun 26, 2026
Source: NVD

A stack overflow in the AP4_StsdAtom::AP4_StsdAtom component of axiomatic-systems Bento4 before v1.8.9allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

Published: Jun 26, 2026
Source: NVD

An issue in Technitium DNS Server v.14.3 and before allows a remote attacker to cause a denial of service via the DnsServerApp.exe, DnsServerApp.dll, TechnitiumLibrary.Net/Dns/DnsClient.cs components

Published: Jun 26, 2026
Source: NVD

Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy

Vendor: composer
Product: aimeos/pagible
Published: Jun 26, 2026
Source: GitHub
CVE-2026-49258 HIGH - 8.8

Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Vendor: go
Product: github.com/juev/nebula-mesh
Published: Jun 26, 2026
Source: GitHub

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user command fires (Time-of-Check). However, the command payload is taken from the in-memory _userCommands vector, which is populated at application ...

Vendor: notepad-plus-plus
Product: notepad-plus-plus
Published: Jun 26, 2026
Source: NVD
CVE-2026-52884 HIGH - 7.8

Notepad++ is a free and open-source source code editor. In v8.9.6.1, isInTrustedDirectory() does NOT canonicalize the path before checking. It uses a prefix-based check (PathIsPrefix() or equivalent) that matches paths starting with trusted directory strings. A path traversal using ..\..\ after a tr...

Vendor: notepad-plus-plus
Product: notepad-plus-plus
Published: Jun 26, 2026
Source: NVD
CVE-2026-48800 HIGH - 7.8

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <Command> tag text content inside <UserDefinedCommands> in shortcuts.xml is read by NppXml::value(aNode) (Parameters.cpp:3658) in the feedUserCmds() function and stored in UserCommand._cmd without any validatio...

Vendor: notepad-plus-plus
Product: notepad-plus-plus
Published: Jun 26, 2026
Source: NVD
CVE-2026-48778 HIGH - 7.8

Notepad++ is a free and open-source source code editor. Prior to 8.9.6.1, the <GUIConfig name="commandLineInterpreter"> tag in config.xml is read by NppXml::value() (Parameters.cpp:6430) and stored in _nppGUI._commandLineInterpreter without any validation, whitelist, or digital signa...

Vendor: notepad-plus-plus
Product: notepad-plus-plus
Published: Jun 26, 2026
Source: NVD