CVE-2026-30633: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the getdoc and updatedoc tools...

CVE-2026-12139: Invocation of Process Using Visible Sensitive Information

Tanium addressed an information disclosure vulnerability in Connect...

CVE-2026-11925: User Interface (UI) Misrepresentation of Critical Information

Tanium addressed a User Interface UI Misrepresentation of Critical Information vulnerability in Tanium Server...

CVE-2026-64880: Improper Neutralization of Special Elements used in an SQL Command

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

CVE-2026-64878: Improper Neutralization of Special Elements used in an OS Command

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...

CVE-2026-64879: Improper Neutralization of Special Elements used in an OS Command

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

CVE-2026-50757: Improper Limitation of a Pathname to a Restricted Directory

Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server...

CVE-2026-64877: Improper Input Validation

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...

CVE-2026-56578: Exposure of Sensitive Information to an Unauthorized Actor

HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions...

CVE-2026-16243: Out-of-bounds Read

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...

CVE-2026-6792: Missing Authorization

Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexCity: from 5.536.0 before 5.542.0...

CVE-2026-16409: Access of Uninitialized Pointer

Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153...

CVE-2026-1617: Improper Neutralization of Special Elements used in an SQL Command

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection. This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3...

CVE-2026-8593: Missing Authorization

Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 EOL allows users without permissions to view and modify BI packs and rules...

CVE-2026-3183: Authentication Bypass by Spoofing

Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass...

CVE-2026-3182: Cleartext Transmission of Sensitive Information

Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability...

CVE-2023-37507: Exposure of Sensitive System Information to an Unauthorized Control Sphere

HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed...

CVE-2026-46600: Out-of-bounds Read

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CVE-2026-28304: Improper Access Control

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments...

zaproxy vw2026-07-14

The Zed Attack Proxy ZAP by Checkmarx is the world’s most widely used web app scanner. Free and open source. A community based GitHub Top 1000 project that anyone can contribute to. It can help you automatically find security vulnerabilities in your we...