by Kastro CVE-2026-34038 · coollabsio coolify
The archive.
Browse all tracked critical vulnerabilities, including records outside today's brief.
38,897 matching vulnerabilities · Page 138 of 778
coollabsio
CVE-2026-34048 · coollabsio coolify
Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers
CVE-2026-34047 · coollabsio coolify
Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution
CVE-2026-34037 · coollabsio coolify
Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo()
decolua
cve-search
trailofbits
Unknown
CVE-2026-12375 · Unknown uncanny-automator-pro
Uncanny Automator Pro 7.3.0.5 - Backdoor via Compromised Vendor Update Server
CVE-2026-6382 · Unknown FileOrganizer
Multiple elFinder Plugins - Authenticated OS Command Injection
CVE-2026-4375 · Unknown DoLeads Integrator
DoLeads Integrator <= 1.2.2 & wp2epub <= 0.65 - Unauthenticated RCE
topoteretes
Apache Software Foundation
CVE-2026-33264 · Apache Software Foundation Apache Airflow
Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()
CVE-2026-40047 · Apache Software Foundation Apache Camel
Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer
CVE-2026-53913 · Apache Software Foundation Apache Camel Keycloak
Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the token is never verified and any non-null bearer value is accepted
CVE-2026-43867 · Apache Software Foundation Apache Camel
Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter
CVE-2026-46454 · Apache Software Foundation Apache Camel
Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
CVE-2026-46456 · Apache Software Foundation Apache Camel
Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers
CVE-2026-24014 · Apache Software Foundation Apache IoTDB
Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
CVE-2026-46455 · Apache Software Foundation Apache Camel
Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted
CVE-2026-48204 · Apache Software Foundation Apache Camel
Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration
CVE-2026-56140 · Apache Software Foundation Apache Camel AWS2 SNS
Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy to align it with sibling components
CVE-2026-24013 · Apache Software Foundation Apache IoTDB
Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC
CVE-2026-48203 · Apache Software Foundation Apache Camel
Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields
CVE-2026-48205 · Apache Software Foundation Apache Camel DNS
Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour
getwpfunnels
CVE-2026-14345 · getwpfunnels WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
Esri
CVE-2026-9181 · Esri ArcGIS Server
Directory Traversal in ArcGIS Server
CVE-2026-13019 · Esri Portal for ArcGIS
Missing Authentication
CVE-2026-9182 · Esri ArcGIS Server
Unvalidated File Upload vulnerability in ArcGIS Server.
CVE-2026-13020 · Esri Portal for ArcGIS
Weak Password Recovery Mechanism in Portal for ArcGIS
unclecode
BeyondTrust
CVE-2026-40139 · BeyondTrust Remote Support
Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access
CVE-2026-40141 · BeyondTrust Remote Support
High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote Access
CVE-2026-40138 · BeyondTrust Remote Support
Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access
Tenda
Dell
CVE-2026-53481 · Dell PowerProtect Data Domain
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.…
CVE-2026-53483 · Dell PowerProtect Data Domain
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.…
mitre
CVE-2026-37270 · mitre
Trueview Security camera T18161- AF v4.9.60.0 contains an authentication bypass vulnerability caused by improper password validation and…
CVE-2026-37271 · mitre
Fire-Boltt Smartwatch FB BGS001 Firmware: MOY-JS14-2.0.4 is vulnerable to Improper Authentication, The device accepts GATT Write Request…
PROG MIS
CVE-2026-14807 · PROG MIS ERP App
PROG MIS｜ERP App - Use of Hard-coded Credentials
CVE-2026-14808 · PROG MIS Prog Management System
PROG MIS｜Prog Management System - Exposure of Sensitive Information
WebPros
owncloud
CVE-2025-53827 · owncloud ownCloud Core
ownCloud Core: Updater has an exposed dangerous method or function
CVE-2025-53830 · owncloud Anti-Virus for ownCloud
Anti-Virus for ownCloud 10 is vulnerable to Server-Side Request Forgery (SSRF)
traefik
FOSSBilling
B&R Industrial Automation GmbH
CVE-2026-6900 · B&R Industrial Automation GmbH APROL