CVE ID :CVE-2026-60102 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :Horde Virtual File System (VFS) API before 3.0.1 contains an OS command injection vulnerability in the Horde_Vfs_Smb driver where the _escapeShellCommand() method fails to sanitize…
CVE ID :CVE-2026-59879 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :Immutable.js provides many Persistent Immutable data structures. Prior to 4.3.9 and 5.1.8, List#set, List#setSize, List#setIn, List#updateIn, and the functional set, setIn, and updateIn mishandle an…
CVE ID :CVE-2026-59261 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :OpenClaw before 2026.5.28 contains a credential exposure vulnerability where workspace dotenv files can override provider credentials. Attackers with lower-trust access to configured input paths can…
CVE ID :CVE-2026-59731 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :Astro is a web framework for content-driven websites. Version 6.4.7 performs authorization decisions on a partially decoded pathname after reaching the iterative URL decoder limit,…
CVE ID :CVE-2026-29008 Published : July 8, 2026, 5:17 p.m. | 1 hour, 53 minutes ago Description :U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net) that allows a network-adjacent attacker to crash the bootloader by sending a…
CVE ID :CVE-2026-59708 Published : July 7, 2026, 6:38 p.m. | 26 minutes ago Description :The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access…
CVE ID :CVE-2026-59800 Published : July 7, 2026, 6:19 p.m. | 45 minutes ago Description :9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so…
CVE ID :CVE-2026-23698 Published : July 7, 2026, 5:16 p.m. | 1 hour, 48 minutes ago Description :Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP…
CVE ID :CVE-2026-57851 Published : July 7, 2026, 5:16 p.m. | 1 hour, 48 minutes ago Description :MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory…
CVE ID :CVE-2026-13020 Published : July 7, 2026, 5:16 p.m. | 1 hour, 48 minutes ago Description :A Weak Password Recovery Mechanism for Forgotten Password exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes. A remote,…