1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
  1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 8, 2026, 8:43 PM 16,269 active 1,443 known exploited

Catalog summary

16,269

Active CVEs

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 8, 2026, 8:43 PM 16,269 active 1,443 known exploited

Catalog summary

16,269

Active CVEs

8,421

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 1,401–1,450 of 16,269 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-67856High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  2. CVE-2026-67857High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  3. CVE-2026-67858High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  4. CVE-2026-67859High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  5. CVE-2026-67860High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  6. CVE-2026-67861High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  7. CVE-2026-67862High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  8. CVE-2026-67979Critical
    CISA ADP Vulnrichment
    CVSS 9.1
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  9. CVE-2026-18685Critical
    GL.iNet GL-MT3000 modem.so glc set_upgrade command injection
    CVSS 9.8
    GL.iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026View HOL analysis
  10. CVE-2026-18684Critical
    GL.iNet GL-MT3000 modem.so glc remove_profile command injection
    CVSS 9.8
    GL.iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026View HOL analysis
  11. CVE-2026-48330Critical
    Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
    CVSS 10.0
    Adobe/Adobe Campaign Classicgeneric
    PublishedAug 3, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026View HOL analysis
  12. CVE-2026-18667Critical
    Sensor Proxy Version 1.4.2 Fixes One Vulnerability
    CVSS 9.6
    Tenable, Inc./Sensor Proxygeneric
    PublishedAug 3, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  13. CVE-2026-46714Medium
    Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation
    CVSS 5.1
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  14. CVE-2026-47746High
    Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks
    CVSS 8.9
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  15. CVE-2026-67616Medium
    Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint
    CVSS 4.3
    owen2345/camaleon-cmsgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  16. CVE-2026-46713Critical
    Misskey: JSON-LD signature validation + compaction may lead to improper activity handling
    CVSS 9.2
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  17. CVE-2026-18682Low
    OpenAkita File Upload API upload cross site scripting
    CVSS 3.1
    n/a/OpenAkitageneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  18. CVE-2026-46712Low
    Misskey: Lack of proper permission checks in Direct Messaging feature
    CVSS 2.3
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  19. CVE-2026-48115Medium
    Misskey: Improper Authorization in the Announcements API
    CVSS 6.3
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  20. CVE-2026-10849High
    Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body
    CVSS 8.2
    zephyrproject/zephyrgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 6, 2026 Fix availableView HOL analysis
  21. CVE-2026-48113High
    Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
    CVSS 8.5
    github.com/jpillora/chisel, jpillora/chiselgeneric · go
    PublishedAug 3, 2026First seen at HOL Jun 19, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  22. CVE-2026-18648Medium
    Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal
    CVSS 5.3
    Blix/Email Blue Mail Calendar Appgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  23. CVE-2026-41447High
    FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Path
    CVSS 7.8
    Zucchetti S.p.a./FirmaCheckgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  24. CVE-2026-18738Medium
    Shlink CSV Formula Injection via Visit Export CLI
    CVSS 4.7
    shlinkio/Shlinkgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  25. CVE-2026-69243Medium
    AIOHTTP: HTTP request smuggling via WebSocket upgrade
    CVSS 6.3
    aio-libs/aiohttp, aiohttpgeneric · pip
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  26. CVE-2026-18647High
    jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery
    CVSS 7.3
    jina-ai/readergeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  27. CVE-2026-18737Medium
    Shlink Blind SQL Injection via tags/stats orderBy Parameter
    CVSS 6.5
    shlinkio/Shlinkgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  28. CVE-2026-49132Medium
    OPNsense < 26.1.9 Stored XSS via Certificate Description Field
    CVSS 5.4
    Deciso B.V./OPNsensegeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  29. CVE-2026-18733High
    Prompt injection bypasses shell tool consent gate in Strands Agents Tools
    CVSS 8.8
    AWS/strands-agents-toolsgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  30. CVE-2026-18646Medium
    danpros HTMLy Author Name htmly.php path traversal
    CVSS 5.3
    danpros/HTMLygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  31. CVE-2026-66065High
    Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)
    CVSS 8.4
    Q00/ouroborosgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  32. CVE-2026-18736Medium
    Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution
    CVSS 5.0
    shlinkio/Shlinkgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  33. CVE-2026-18645Medium
    danpros HTMLy Admin Content Endpoint admin.php add_content path traversal
    CVSS 5.4
    danpros/HTMLygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  34. CVE-2026-47211High
    Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
    CVSS 8.4
    Q00/ouroborosgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  35. CVE-2026-18644Medium
    danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal
    CVSS 5.4
    danpros/HTMLygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  36. CVE-2026-68981High
    Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
    CVSS 8.8
    Apache Software Foundation/Apache NiFigeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  37. CVE-2026-69198Medium
    ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
    CVSS 6.9
    beaugunderson/ip-address, ip-addressgeneric · npm
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  38. CVE-2026-68980Low
    Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
    CVSS 2.3
    Apache Software Foundation/Apache NiFigeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  39. CVE-2026-62354High
    Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests
    CVSS 7.7
    Apache Software Foundation/Apache NiFigeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  40. CVE-2026-68979Medium
    Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
    CVSS 5.9
    Apache Software Foundation/Apache NiFigeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  41. CVE-2026-18641High
    Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection
    CVSS 7.3
    Sangfor/Operation and Maintenance Security Management Systemgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  42. CVE-2026-18654Medium
    Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
    CVSS 6.8
    AWS/aws-cli, awscligeneric · pip
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 6, 2026 Fix availableView HOL analysis
  43. CVE-2026-18632Medium
    langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine
    CVSS 6.3
    langgenius/difygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  44. CVE-2026-18631Medium
    jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization
    CVSS 6.3
    jeequan/jeepaygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  45. CVE-2026-67599High
    ClearOS 7.9 OS Command Injection via Log Viewer filter parameter
    CVSS 7.2
    ClearFoundation/ClearOSgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  46. CVE-2026-18655Medium
    Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection
    CVSS 6.5
    AWS/amazon-mq-mcp-servergeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  47. CVE-2026-18616Critical
    GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection
    CVSS 9.8
    GL-iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  48. CVE-2026-18615Critical
    GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection
    CVSS 9.8
    GL-iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  49. CVE-2026-18614Critical
    GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection
    CVSS 9.8
    GL-iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  50. CVE-2026-59913High
    CISA ADP Vulnrichment
    CVSS 7.8
    Dell/Display and Peripheral Manager (DDPM Mac)generic
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
Page 29 of 326
Previous2728293031Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard

8,421

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 1,401–1,450 of 16,269 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-67856High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  2. CVE-2026-67857High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  3. CVE-2026-67858High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  4. CVE-2026-67859High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  5. CVE-2026-67860High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  6. CVE-2026-67861High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  7. CVE-2026-67862High
    CISA ADP Vulnrichment
    CVSS 7.5
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  8. CVE-2026-67979Critical
    CISA ADP Vulnrichment
    CVSS 9.1
    n/a/n/ageneric
    PublishedAug 4, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026View HOL analysis
  9. CVE-2026-18685Critical
    GL.iNet GL-MT3000 modem.so glc set_upgrade command injection
    CVSS 9.8
    GL.iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026View HOL analysis
  10. CVE-2026-18684Critical
    GL.iNet GL-MT3000 modem.so glc remove_profile command injection
    CVSS 9.8
    GL.iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 4, 2026Updated Aug 4, 2026View HOL analysis
  11. CVE-2026-48330Critical
    Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
    CVSS 10.0
    Adobe/Adobe Campaign Classicgeneric
    PublishedAug 3, 2026First seen at HOL Aug 4, 2026Updated Aug 6, 2026View HOL analysis
  12. CVE-2026-18667Critical
    Sensor Proxy Version 1.4.2 Fixes One Vulnerability
    CVSS 9.6
    Tenable, Inc./Sensor Proxygeneric
    PublishedAug 3, 2026First seen at HOL Aug 4, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  13. CVE-2026-46714Medium
    Misskey: Denial of Service via Uncontrolled Recursion in Theme Compilation
    CVSS 5.1
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  14. CVE-2026-47746High
    Misskey: JSON-LD signature validation + compaction is vulnerable to timing attacks
    CVSS 8.9
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  15. CVE-2026-67616Medium
    Camaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint
    CVSS 4.3
    owen2345/camaleon-cmsgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  16. CVE-2026-46713Critical
    Misskey: JSON-LD signature validation + compaction may lead to improper activity handling
    CVSS 9.2
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  17. CVE-2026-18682Low
    OpenAkita File Upload API upload cross site scripting
    CVSS 3.1
    n/a/OpenAkitageneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  18. CVE-2026-46712Low
    Misskey: Lack of proper permission checks in Direct Messaging feature
    CVSS 2.3
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  19. CVE-2026-48115Medium
    Misskey: Improper Authorization in the Announcements API
    CVSS 6.3
    misskey-dev/misskeygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  20. CVE-2026-10849High
    Heap out-of-bounds write in Zephyr hawkBit OTA client when terminating server response body
    CVSS 8.2
    zephyrproject/zephyrgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 6, 2026 Fix availableView HOL analysis
  21. CVE-2026-48113High
    Chisel: ACL Bypass via Post-Handshake SSH Channel ExtraData Injection
    CVSS 8.5
    github.com/jpillora/chisel, jpillora/chiselgeneric · go
    PublishedAug 3, 2026First seen at HOL Jun 19, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  22. CVE-2026-18648Medium
    Blix Email Blue Mail Calendar App react-native-receive-sharing-intent FileDirectory.getFileFromUri path traversal
    CVSS 5.3
    Blix/Email Blue Mail Calendar Appgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  23. CVE-2026-41447High
    FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Path
    CVSS 7.8
    Zucchetti S.p.a./FirmaCheckgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  24. CVE-2026-18738Medium
    Shlink CSV Formula Injection via Visit Export CLI
    CVSS 4.7
    shlinkio/Shlinkgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  25. CVE-2026-69243Medium
    AIOHTTP: HTTP request smuggling via WebSocket upgrade
    CVSS 6.3
    aio-libs/aiohttp, aiohttpgeneric · pip
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
  26. CVE-2026-18647High
    jina-ai reader Crawler/Puppeteer crawler.ts isValidTLD server-side request forgery
    CVSS 7.3
    jina-ai/readergeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  27. CVE-2026-18737Medium
    Shlink Blind SQL Injection via tags/stats orderBy Parameter
    CVSS 6.5
    shlinkio/Shlinkgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  28. CVE-2026-49132Medium
    OPNsense < 26.1.9 Stored XSS via Certificate Description Field
    CVSS 5.4
    Deciso B.V./OPNsensegeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  29. CVE-2026-18733High
    Prompt injection bypasses shell tool consent gate in Strands Agents Tools
    CVSS 8.8
    AWS/strands-agents-toolsgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  30. CVE-2026-18646Medium
    danpros HTMLy Author Name htmly.php path traversal
    CVSS 5.3
    danpros/HTMLygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  31. CVE-2026-66065High
    Ouroboros: Untrusted project .env can still reach RCE via omitted execution-routing keys (Incomplete fix of CVE-2026-47211)
    CVSS 8.4
    Q00/ouroborosgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  32. CVE-2026-18736Medium
    Shlink Server-Side Request Forgery via Short URL Title Auto-Resolution
    CVSS 5.0
    shlinkio/Shlinkgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  33. CVE-2026-18645Medium
    danpros HTMLy Admin Content Endpoint admin.php add_content path traversal
    CVSS 5.4
    danpros/HTMLygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  34. CVE-2026-47211High
    Ouroboros: Remote Code Execution via Untrusted Project-Directory .env
    CVSS 8.4
    Q00/ouroborosgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  35. CVE-2026-18644Medium
    danpros HTMLy Delete Username Endpoint htmly.php unlink path traversal
    CVSS 5.4
    danpros/HTMLygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  36. CVE-2026-68981High
    Apache NiFi: Uncontrolled Resource Consumption through Decompression of HTTP Requests
    CVSS 8.8
    Apache Software Foundation/Apache NiFigeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  37. CVE-2026-69198Medium
    ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks
    CVSS 6.9
    beaugunderson/ip-address, ip-addressgeneric · npm
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  38. CVE-2026-68980Low
    Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
    CVSS 2.3
    Apache Software Foundation/Apache NiFigeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  39. CVE-2026-62354High
    Apache NiFi: Incorrect Authorization for Parameter Context Validation Requests
    CVSS 7.7
    Apache Software Foundation/Apache NiFigeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  40. CVE-2026-68979Medium
    Apache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates
    CVSS 5.9
    Apache Software Foundation/Apache NiFigeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  41. CVE-2026-18641High
    Sangfor Operation and Maintenance Security Management System Login Endpoint portal_login com.sbr.fort.foreignDP.DpLoginController os command injection
    CVSS 7.3
    Sangfor/Operation and Maintenance Security Management Systemgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026View HOL analysis
  42. CVE-2026-18654Medium
    Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
    CVSS 6.8
    AWS/aws-cli, awscligeneric · pip
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 6, 2026 Fix availableView HOL analysis
  43. CVE-2026-18632Medium
    langgenius dify Jinja2 jinja2_transformer.py jinja2.Template special elements used in a template engine
    CVSS 6.3
    langgenius/difygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  44. CVE-2026-18631Medium
    jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization
    CVSS 6.3
    jeequan/jeepaygeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  45. CVE-2026-67599High
    ClearOS 7.9 OS Command Injection via Log Viewer filter parameter
    CVSS 7.2
    ClearFoundation/ClearOSgeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  46. CVE-2026-18655Medium
    Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection
    CVSS 6.5
    AWS/amazon-mq-mcp-servergeneric
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  47. CVE-2026-18616Critical
    GL-iNet GL-MT3000 wg-server.so Native Plugin glc server.set_peer command injection
    CVSS 9.8
    GL-iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 4, 2026View HOL analysis
  48. CVE-2026-18615Critical
    GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection
    CVSS 9.8
    GL-iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  49. CVE-2026-18614Critical
    GL-iNet GL-MT3000 s2s.so Native Plugin glc s2s.enable_echo_server command injection
    CVSS 9.8
    GL-iNet/GL-MT3000generic
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 3, 2026View HOL analysis
  50. CVE-2026-59913High
    CISA ADP Vulnrichment
    CVSS 7.8
    Dell/Display and Peripheral Manager (DDPM Mac)generic
    PublishedAug 3, 2026First seen at HOL Aug 3, 2026Updated Aug 5, 2026 Fix availableView HOL analysis
Page 29 of 326
Previous2728293031Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard