CVE watch
Every disclosure pulled from the NVD feed, filterable by severity.
CVE-2026-19852 published: NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbit...
View full advisory →CVE-2026-19853 published: NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a sp...
View full advisory →CVE-2026-78179 published: A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the fil...
View full advisory →CVE-2026-19200 published: The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault ...
View full advisory →CVE-2026-78177 published: A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/dev...
View full advisory →CVE-2026-78178 published: A vulnerability was determined in jQWidgets up to 24.0.1. This affects the function JQXLite.extend/jqxBaseFramework.extend of the file jq...
View full advisory →CVE-2026-78171 published: A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality...
View full advisory →CVE-2026-78170 published: A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306. Affected is the function strcpy of the file /goform/formConfigFastDirection...
View full advisory →CVE-2026-78166 published: A security flaw has been discovered in provectus kafka-ui up to 0.7.2. The affected element is the function executeSmartFilterTest of the...
View full advisory →CVE-2026-78167 published: A weakness has been identified in EFM ipTIME T16000M 14.20.2. The impacted element is the function httpcon_check_session_url of the compo...
View full advisory →CVE-2026-78168 published: A security vulnerability has been detected in EFM ipTIME T24000M up to 14.20.0. This affects the function httpcon_check_session_url of th...
View full advisory →CVE-2026-78169 published: A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemot...
View full advisory →CVE-2026-78207 published: exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constr...
View full advisory →CVE-2026-78208 published: exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file pat...
View full advisory →CVE-2026-78209 published: exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. ...
View full advisory →CVE-2026-78161 published: A vulnerability was found in warmcat libwebsockets 4.5.0. Impacted is the function report_raw_cbor of the file lib/misc/lecp.c of the com...
View full advisory →CVE-2026-78203 published: Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-s...
View full advisory →CVE-2026-78204 published: Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test...
View full advisory →CVE-2026-78160 published: A vulnerability has been found in Dolibarr ERP up to 18.0.10/22.0.5/23.0.3. This issue affects some unknown processing of the file /user/...
View full advisory →CVE-2026-78205 published: BentoML's outbound connection safeguard (make_safe_connect in _internal/utils/uri.py) blocks private, loopback, and link-local IP address...
View full advisory →