1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
  1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 8, 2026, 6:55 PM 16,269 active 1,443 known exploited

Catalog summary

16,269

Active CVEs

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 8, 2026, 6:55 PM 16,269 active 1,443 known exploited

Catalog summary

16,269

Active CVEs

8,418

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 1,201–1,250 of 16,269 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-18812High
    H3C NX15 esps esps.ipv6.wan command injection
    CVSS 7.2
    H3C/NX15generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  2. CVE-2026-70487Medium
    Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
    CVSS 5.3
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  3. CVE-2026-18811High
    H3C NX15 esps add command injection
    CVSS 7.2
    H3C/NX15generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  4. CVE-2026-65986High
    CVAT has stored XSS via annotation guide assets
    CVSS 8.5
    cvat-ai/cvatgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  5. CVE-2026-70554Critical
    MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie
    CVSS 9.8
    MaxSite/MaxSite CMSgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  6. CVE-2026-70486High
    Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
    CVSS 8.2
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  7. CVE-2026-47682High
    CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes
    CVSS 7.1
    cvat-ai/cvatgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  8. CVE-2026-18810High
    H3C NX15 networkSetup missing authentication
    CVSS 7.3
    H3C/NX15generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  9. CVE-2026-70485High
    Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
    CVSS 7.1
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  10. CVE-2026-70484Medium
    Open WebUI: Users denied the image-generation permission can still generate images via chat completions
    CVSS 4.3
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  11. CVE-2026-70483Low
    Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
    CVSS 3.1
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  12. CVE-2026-70482High
    Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
    CVSS 8.1
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026 Fix availableView HOL analysis
  13. CVE-2026-16793High
    Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator
    CVSS 8.8
    Lenovo/XClarity Orchestratorgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  14. CVE-2026-16792Medium
    Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator
    CVSS 6.1
    Lenovo/XClarity Orchestratorgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  15. CVE-2026-16791Low
    Predictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLI
    CVSS 3.9
    Lenovo/XClarity Essentials OneCLIgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  16. CVE-2026-48154Medium
    GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access
    CVSS 5.9
    github.com/pilinux/gorest, pilinux/gorestgeneric · go
    PublishedAug 4, 2026First seen at HOL Jun 19, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  17. CVE-2026-70481Medium
    Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
    CVSS 5.4
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  18. CVE-2026-70480Medium
    Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
    CVSS 4.1
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  19. CVE-2026-70479High
    Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
    CVSS 7.7
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  20. CVE-2026-18657High
    Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows
    CVSS 7.8
    Amazon/Kiro CLIgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026 Fix availableView HOL analysis
  21. CVE-2026-70553Critical
    MaxSite CMS Unauthenticated RCE via Install Endpoint
    CVSS 9.8
    MaxSite/MaxSite CMSgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  22. CVE-2026-70478Critical
    Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
    CVSS 9.2
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  23. CVE-2026-18656High
    Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows
    CVSS 7.8
    Amazon/Kiro IDEgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026View HOL analysis
  24. CVE-2026-70477Critical
    Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    CVSS 9.5
    FlowiseAI/Flowise, flowise +1generic · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  25. CVE-2026-70552Critical
    MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
    CVSS 9.8
    MaxSite/MaxSite CMSgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  26. CVE-2026-70476High
    Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
    CVSS 8.3
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  27. CVE-2026-70475High
    Flowise: Missing Authorization on Execution Update Endpoint
    CVSS 7.1
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  28. CVE-2026-49435Critical
    Keysight IxChariot-related products stack-based buffer overflow
    CVSS 9.8
    Keysight/Hawkeye, Keysight/IxByPass +3generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  29. CVE-2017-20242Critical
    Keysight IxChariot Endpoint stack-based buffer overflow
    CVSS 9.8
    Keysight/IxChariotgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  30. CVE-2017-20241Critical
    Keysight IxChariot Endpoint heap-based buffer overflow
    CVSS 9.8
    Keysight/IxChariotgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  31. CVE-2026-66300Medium
    SNOMED International Snowstorm reflected XSS
    CVSS 5.0
    SNOMED International/Snowstormgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  32. CVE-2026-69704Medium
    Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()
    CVSS 6.5
    maximeAmini/Atals-Livregeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  33. CVE-2026-47781High
    pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
    CVSS 8.4
    pdm, pdm-project/pdmgeneric · pip
    PublishedAug 4, 2026First seen at HOL Jun 11, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  34. CVE-2026-69703Critical
    Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit
    CVSS 9.8
    maximeAmini/Atals-Livregeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026View HOL analysis
  35. CVE-2026-68743Medium
    Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1
    CVSS 5.5
    Affected software not mappedEcosystem not listed
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026View HOL analysis
  36. CVE-2026-0163Critical
    CISA ADP Vulnrichment
    CVSS 9.8
    Google/Androidgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  37. CVE-2026-13229High
    Zammad 7.0.1 - Improper authorization in ticket article attachment cloning
    CVSS 7.1
    Zammad/Zammadgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  38. CVE-2026-70474High
    Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
    CVSS 7.6
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  39. CVE-2026-47764High
    pdm: Path traversal in wheel installation via overridden write_to_fs
    CVSS 8.4
    pdm, pdm-project/pdmgeneric · pip
    PublishedAug 4, 2026First seen at HOL Jun 11, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  40. CVE-2026-70473High
    Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
    CVSS 8.3
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  41. CVE-2026-70472High
    Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
    CVSS 7.1
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  42. CVE-2026-69702Medium
    SnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOM
    CVSS 6.5
    aizuda/SnailJob (snail-job)generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  43. CVE-2026-70471High
    Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
    CVSS 7.1
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  44. CVE-2026-18830High
    Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API
    CVSS 8.1
    AWS/Amazon Bedrock AgentCore harnessgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026View HOL analysis
  45. CVE-2026-47623High
    CISA ADP Vulnrichment
    CVSS 8.2
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  46. CVE-2026-47622Medium
    CISA ADP Vulnrichment
    CVSS 5.3
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  47. CVE-2026-47621Medium
    CISA ADP Vulnrichment
    CVSS 6.5
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  48. CVE-2026-47620Medium
    CISA ADP Vulnrichment
    CVSS 6.5
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  49. CVE-2026-47619Medium
    CISA ADP Vulnrichment
    CVSS 6.6
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  50. CVE-2026-47618High
    CISA ADP Vulnrichment
    CVSS 7.5
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
Page 25 of 326
Previous2324252627Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard

8,418

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 1,201–1,250 of 16,269 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-18812High
    H3C NX15 esps esps.ipv6.wan command injection
    CVSS 7.2
    H3C/NX15generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  2. CVE-2026-70487Medium
    Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
    CVSS 5.3
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  3. CVE-2026-18811High
    H3C NX15 esps add command injection
    CVSS 7.2
    H3C/NX15generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  4. CVE-2026-65986High
    CVAT has stored XSS via annotation guide assets
    CVSS 8.5
    cvat-ai/cvatgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  5. CVE-2026-70554Critical
    MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie
    CVSS 9.8
    MaxSite/MaxSite CMSgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  6. CVE-2026-70486High
    Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
    CVSS 8.2
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  7. CVE-2026-47682High
    CVAT: Missing path-containment validation in multiple entry points allows arbitrary path writes
    CVSS 7.1
    cvat-ai/cvatgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  8. CVE-2026-18810High
    H3C NX15 networkSetup missing authentication
    CVSS 7.3
    H3C/NX15generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  9. CVE-2026-70485High
    Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
    CVSS 7.1
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  10. CVE-2026-70484Medium
    Open WebUI: Users denied the image-generation permission can still generate images via chat completions
    CVSS 4.3
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  11. CVE-2026-70483Low
    Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
    CVSS 3.1
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  12. CVE-2026-70482High
    Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
    CVSS 8.1
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026 Fix availableView HOL analysis
  13. CVE-2026-16793High
    Remote Command Injection via OS Profile Password in Lenovo XClarity Orchestrator
    CVSS 8.8
    Lenovo/XClarity Orchestratorgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  14. CVE-2026-16792Medium
    Global TLS Certificate Validation Bypass in Lenovo XClarity Orchestrator
    CVSS 6.1
    Lenovo/XClarity Orchestratorgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  15. CVE-2026-16791Low
    Predictable Temporary File Symlink Vulnerability in Lenovo XClarity Essentials OneCLI
    CVSS 3.9
    Lenovo/XClarity Essentials OneCLIgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  16. CVE-2026-48154Medium
    GoRest: InMemorySecret2FA race condition allows process crash via concurrent map access
    CVSS 5.9
    github.com/pilinux/gorest, pilinux/gorestgeneric · go
    PublishedAug 4, 2026First seen at HOL Jun 19, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  17. CVE-2026-70481Medium
    Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
    CVSS 5.4
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  18. CVE-2026-70480Medium
    Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
    CVSS 4.1
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  19. CVE-2026-70479High
    Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
    CVSS 7.7
    open-webui, open-webui/open-webuigeneric · pip
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  20. CVE-2026-18657High
    Executable Resolution from Untrusted Project Directory in Kiro CLI on Windows
    CVSS 7.8
    Amazon/Kiro CLIgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026 Fix availableView HOL analysis
  21. CVE-2026-70553Critical
    MaxSite CMS Unauthenticated RCE via Install Endpoint
    CVSS 9.8
    MaxSite/MaxSite CMSgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  22. CVE-2026-70478Critical
    Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service
    CVSS 9.2
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  23. CVE-2026-18656High
    Executable Resolution from Untrusted Project Directory in Kiro IDE on Windows
    CVSS 7.8
    Amazon/Kiro IDEgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026View HOL analysis
  24. CVE-2026-70477Critical
    Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
    CVSS 9.5
    FlowiseAI/Flowise, flowise +1generic · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  25. CVE-2026-70552Critical
    MaxSite CMS 109.5 Unauthenticated AJAX Dispatcher Bypass via ajax.php
    CVSS 9.8
    MaxSite/MaxSite CMSgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  26. CVE-2026-70476High
    Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation
    CVSS 8.3
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  27. CVE-2026-70475High
    Flowise: Missing Authorization on Execution Update Endpoint
    CVSS 7.1
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  28. CVE-2026-49435Critical
    Keysight IxChariot-related products stack-based buffer overflow
    CVSS 9.8
    Keysight/Hawkeye, Keysight/IxByPass +3generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  29. CVE-2017-20242Critical
    Keysight IxChariot Endpoint stack-based buffer overflow
    CVSS 9.8
    Keysight/IxChariotgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  30. CVE-2017-20241Critical
    Keysight IxChariot Endpoint heap-based buffer overflow
    CVSS 9.8
    Keysight/IxChariotgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  31. CVE-2026-66300Medium
    SNOMED International Snowstorm reflected XSS
    CVSS 5.0
    SNOMED International/Snowstormgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  32. CVE-2026-69704Medium
    Atals-Livre SQL Injection via Unsanitized GET Parameter in supp()
    CVSS 6.5
    maximeAmini/Atals-Livregeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  33. CVE-2026-47781High
    pdm: Project-Controlled `.pdm-plugins` Content Executes Before CLI Parsing
    CVSS 8.4
    pdm, pdm-project/pdmgeneric · pip
    PublishedAug 4, 2026First seen at HOL Jun 11, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  34. CVE-2026-69703Critical
    Atlas-Livre Unauthenticated Access via Admin Controllers Missing Exit
    CVSS 9.8
    maximeAmini/Atals-Livregeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026View HOL analysis
  35. CVE-2026-68743Medium
    Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1
    CVSS 5.5
    Affected software not mappedEcosystem not listed
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026View HOL analysis
  36. CVE-2026-0163Critical
    CISA ADP Vulnrichment
    CVSS 9.8
    Google/Androidgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  37. CVE-2026-13229High
    Zammad 7.0.1 - Improper authorization in ticket article attachment cloning
    CVSS 7.1
    Zammad/Zammadgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  38. CVE-2026-70474High
    Flowise: Cross-Workspace OAuth2 Credential Metadata Leak
    CVSS 7.6
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  39. CVE-2026-47764High
    pdm: Path traversal in wheel installation via overridden write_to_fs
    CVSS 8.4
    pdm, pdm-project/pdmgeneric · pip
    PublishedAug 4, 2026First seen at HOL Jun 11, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  40. CVE-2026-70473High
    Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history
    CVSS 8.3
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  41. CVE-2026-70472High
    Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store
    CVSS 7.1
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  42. CVE-2026-69702Medium
    SnailJob 1.7.0 Denial of Service via FuryUtil.deserialize OOM
    CVSS 6.5
    aizuda/SnailJob (snail-job)generic
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  43. CVE-2026-70471High
    Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure
    CVSS 7.1
    FlowiseAI/Flowise, flowisegeneric · npm
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  44. CVE-2026-18830High
    Insufficient input validation in Amazon Bedrock AgentCore harness InvokeHarness API
    CVSS 8.1
    AWS/Amazon Bedrock AgentCore harnessgeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026View HOL analysis
  45. CVE-2026-47623High
    CISA ADP Vulnrichment
    CVSS 8.2
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  46. CVE-2026-47622Medium
    CISA ADP Vulnrichment
    CVSS 5.3
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  47. CVE-2026-47621Medium
    CISA ADP Vulnrichment
    CVSS 6.5
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  48. CVE-2026-47620Medium
    CISA ADP Vulnrichment
    CVSS 6.5
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  49. CVE-2026-47619Medium
    CISA ADP Vulnrichment
    CVSS 6.6
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
  50. CVE-2026-47618High
    CISA ADP Vulnrichment
    CVSS 7.5
    NVIDIA/Dynamogeneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 7, 2026View HOL analysis
Page 25 of 326
Previous2324252627Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard