1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
  1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 9, 2026, 7:05 PM 16,350 active 1,443 known exploited

Catalog summary

16,350

Active CVEs

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 9, 2026, 7:05 PM 16,350 active 1,443 known exploited

Catalog summary

16,350

Active CVEs

8,457

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 3,751–3,800 of 16,350 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-57212High
    RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size
    CVSS 7.7
    rabbitmq/rabbitmq-servergeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  2. CVE-2026-55233High
    OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream
    CVSS 7.5
    openresty/openrestygeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  3. CVE-2026-55377High
    Logto: Account Center MFA management step-up bypass via WebAuthn registration verification
    CVSS 8.1
    logto-io/logtogeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  4. CVE-2026-55370Medium
    Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)
    CVSS 6.4
    logto-io/logtogeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  5. CVE-2026-55789High
    Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers
    CVSS 8.5
    logto-io/logtogeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  6. CVE-2026-54714Medium
    Logto: XSS via unescaped RelayState in SAML auto-submit form
    CVSS 6.1
    logto-io/logtogeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  7. CVE-2026-57157Medium
    Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName
    CVSS 6.5
    FreeRDP/FreeRDPgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  8. CVE-2026-15295Medium
    Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
    CVSS 4.4
    dcooney/Ajax Load More – Infinite Scroll, Load More, & Lazy Loadgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  9. CVE-2026-55475Medium
    Snipe-IT: Import created_by can be overwritten
    CVSS 5.7
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  10. CVE-2026-55469Medium
    Snipe-IT: Path traversal vulnerability via CSV import `image` field
    CVSS 6.5
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  11. CVE-2026-55479Medium
    Snipe-IT: Incorrect permission for legacy license checkin API
    CVSS 5.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  12. CVE-2026-55452High
    Snipe-IT: CSV formula injection in Activity Report export
    CVSS 7.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  13. CVE-2026-55466High
    Snipe-IT: Stored XSS via inline-served attachment
    CVSS 8.7
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  14. CVE-2026-55515Medium
    Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
    CVSS 5.0
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  15. CVE-2026-55462Medium
    Snipe-IT: Authorization bypass on print inventory page
    CVSS 4.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  16. CVE-2026-11321Medium
    GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import
    CVSS 6.4
    pluginsGLPI/datainjectiongeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 30, 2026 Fix availableView HOL analysis
  17. CVE-2026-55464Medium
    Snipe-IT: Stored XSS via Markdown custom field
    CVSS 5.4
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  18. CVE-2026-55472Medium
    Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
    CVSS 4.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  19. CVE-2026-55476Medium
    Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
    CVSS 5.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  20. CVE-2026-6212High
    IDOR in Teracity's TeraMIS
    CVSS 8.8
    Teracity Software Technologies Inc./TeraMISgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  21. CVE-2026-55478Medium
    Snipe-IT: Missing object-level authorization in Kits API
    CVSS 5.4
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  22. CVE-2026-55843High
    Snipe-IT: Improper Privilege Management
    CVSS 7.0
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  23. CVE-2026-55474High
    Snipe-IT: Directory traversal in displaySig
    CVSS 7.1
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  24. CVE-2026-54329High
    Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API
    CVSS 8.5
    grokability/snipe-it, snipe/snipe-itcomposer · generic
    PublishedJul 10, 2026First seen at HOL Jun 23, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  25. CVE-2026-61460High
    Krayin CRM Insecure Direct Object Reference via Controllers
    CVSS 8.8
    krayin/laravel-crmgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  26. CVE-2026-15146Medium
    CVE-2026-15146
    CVSS 5.9
    GNU wget/Wgetgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 15, 2026 Fix availableView HOL analysis
  27. CVE-2026-5801Critical
    SQLi in Semtek Informatics' SEM-PMP
    CVSS 9.8
    Semtek Informatics Software Consulting Trade Ltd. Co./SEM-PMPgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  28. CVE-2026-53450High
    Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
    CVSS 7.4
    coturn/coturngeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 16, 2026View HOL analysis
  29. CVE-2026-53449Medium
    Coturn: Arbitrary File Write via CLI psd Command
    CVSS 6.0
    coturn/coturngeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 16, 2026View HOL analysis
  30. CVE-2025-30008Medium
    HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface
    CVSS 4.6
    hestiacp/hestiacpgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026 Fix availableView HOL analysis
  31. CVE-2025-30007High
    HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management
    CVSS 8.8
    hestiacp/hestiacpgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026 Fix availableView HOL analysis
  32. CVE-2026-59151Critical
    Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
    CVSS 9.6
    prowler-cloud/prowlergeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  33. CVE-2026-56666Medium
    ZITADEL: Auto-linking by email: IdP-side email verification is not checked
    CVSS 4.8
    zitadel/zitadelgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  34. CVE-2026-2397Critical
    SQLi in AdamPOS' MobilMen 20T
    CVSS 9.8
    Adam Retail Automation Ltd./MobilMen 20Tgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 16, 2026View HOL analysis
  35. CVE-2026-56667High
    ZITADEL: Stored XSS via Default URI Redirect in Login V2
    CVSS 7.3
    zitadel/zitadelgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  36. CVE-2026-56665Medium
    ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
    CVSS 4.2
    zitadel/zitadelgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  37. CVE-2026-56664Medium
    ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
    CVSS 4.2
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 18, 2026 Fix availableView HOL analysis
  38. CVE-2026-55672High
    ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
    CVSS 7.4
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 15, 2026 Fix availableView HOL analysis
  39. CVE-2026-55671Low
    ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
    CVSS 2.3
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 14, 2026 Fix availableView HOL analysis
  40. CVE-2026-55670Low
    ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
    CVSS 2.3
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  41. CVE-2026-2398High
    IDOR in AdamPOS' MobilMen 20T
    CVSS 8.8
    Adam Retail Automation Ltd./MobilMen 20Tgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 16, 2026View HOL analysis
  42. CVE-2026-55669Medium
    ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
    CVSS 4.2
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  43. CVE-2026-55781Low
    NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
    CVSS 2.4
    M2Team/NanaZipgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  44. CVE-2026-55780Low
    NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
    CVSS 2.4
    M2Team/NanaZipgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  45. CVE-2026-55783Low
    NanaZip: NULL pointer dereference in Extract() of all seven NanaZip custom archive handlers when extracting/testing the whole archive
    CVSS 2.4
    M2Team/NanaZipgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  46. CVE-2026-55782Low
    NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields
    CVSS 2.4
    M2Team/NanaZipgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  47. CVE-2026-3251Medium
    XSS in Webremium's Mezunum Satiyorum
    CVSS 6.4
    Webremium Istanbul Web Design/Mezunum Satiyorumgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  48. CVE-2026-57167Medium
    PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
    CVSS 5.1
    Chocobozzz/PeerTubegeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  49. CVE-2026-59193Medium
    Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
    CVSS 6.9
    getgrav/gravgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  50. CVE-2026-59190High
    Grav Admin Plugin — IDOR Privilege Escalation via saveUser()
    CVSS 8.7
    getgrav/gravgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
Page 76 of 327
Previous7475767778Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard

8,457

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 3,751–3,800 of 16,350 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-57212High
    RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size
    CVSS 7.7
    rabbitmq/rabbitmq-servergeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  2. CVE-2026-55233High
    OpenResty: Buffer overflow when writing PROXY protocol v2 header to upstream
    CVSS 7.5
    openresty/openrestygeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  3. CVE-2026-55377High
    Logto: Account Center MFA management step-up bypass via WebAuthn registration verification
    CVSS 8.1
    logto-io/logtogeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  4. CVE-2026-55370Medium
    Logto: TOTP code can be replayed within the RFC 6238 validity window (one-time use violation)
    CVSS 6.4
    logto-io/logtogeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  5. CVE-2026-55789High
    Logto: SAML IdP injects user-controlled profile attributes raw into signed assertions, allowing privilege escalation at relying Service Providers
    CVSS 8.5
    logto-io/logtogeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  6. CVE-2026-54714Medium
    Logto: XSS via unescaped RelayState in SAML auto-submit form
    CVSS 6.1
    logto-io/logtogeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  7. CVE-2026-57157Medium
    Out-of-bounds read in the camera device enumerator server (rdpecam) via unterminated DeviceName / VirtualChannelName
    CVSS 6.5
    FreeRDP/FreeRDPgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  8. CVE-2026-15295Medium
    Ajax Load More <= 7.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
    CVSS 4.4
    dcooney/Ajax Load More – Infinite Scroll, Load More, & Lazy Loadgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  9. CVE-2026-55475Medium
    Snipe-IT: Import created_by can be overwritten
    CVSS 5.7
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  10. CVE-2026-55469Medium
    Snipe-IT: Path traversal vulnerability via CSV import `image` field
    CVSS 6.5
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  11. CVE-2026-55479Medium
    Snipe-IT: Incorrect permission for legacy license checkin API
    CVSS 5.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  12. CVE-2026-55452High
    Snipe-IT: CSV formula injection in Activity Report export
    CVSS 7.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  13. CVE-2026-55466High
    Snipe-IT: Stored XSS via inline-served attachment
    CVSS 8.7
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  14. CVE-2026-55515Medium
    Snipe-IT: Cross-company deletion of pending checkout acceptances via unscoped report endpoint
    CVSS 5.0
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  15. CVE-2026-55462Medium
    Snipe-IT: Authorization bypass on print inventory page
    CVSS 4.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  16. CVE-2026-11321Medium
    GLPI DataInjection Plugin Authenticated SQL Injection via CSV Import
    CVSS 6.4
    pluginsGLPI/datainjectiongeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 30, 2026 Fix availableView HOL analysis
  17. CVE-2026-55464Medium
    Snipe-IT: Stored XSS via Markdown custom field
    CVSS 5.4
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  18. CVE-2026-55472Medium
    Snipe-IT: API Location Creation Bypasses FMCS Parent-Child Company Boundary Validation
    CVSS 4.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  19. CVE-2026-55476Medium
    Snipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter
    CVSS 5.3
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  20. CVE-2026-6212High
    IDOR in Teracity's TeraMIS
    CVSS 8.8
    Teracity Software Technologies Inc./TeraMISgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  21. CVE-2026-55478Medium
    Snipe-IT: Missing object-level authorization in Kits API
    CVSS 5.4
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  22. CVE-2026-55843High
    Snipe-IT: Improper Privilege Management
    CVSS 7.0
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  23. CVE-2026-55474High
    Snipe-IT: Directory traversal in displaySig
    CVSS 7.1
    grokability/snipe-itgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  24. CVE-2026-54329High
    Snipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API
    CVSS 8.5
    grokability/snipe-it, snipe/snipe-itcomposer · generic
    PublishedJul 10, 2026First seen at HOL Jun 23, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  25. CVE-2026-61460High
    Krayin CRM Insecure Direct Object Reference via Controllers
    CVSS 8.8
    krayin/laravel-crmgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  26. CVE-2026-15146Medium
    CVE-2026-15146
    CVSS 5.9
    GNU wget/Wgetgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 15, 2026 Fix availableView HOL analysis
  27. CVE-2026-5801Critical
    SQLi in Semtek Informatics' SEM-PMP
    CVSS 9.8
    Semtek Informatics Software Consulting Trade Ltd. Co./SEM-PMPgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  28. CVE-2026-53450High
    Coturn: IPv4-mapped 127.0.0.1 bypasses default loopback peer protection
    CVSS 7.4
    coturn/coturngeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 16, 2026View HOL analysis
  29. CVE-2026-53449Medium
    Coturn: Arbitrary File Write via CLI psd Command
    CVSS 6.0
    coturn/coturngeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 16, 2026View HOL analysis
  30. CVE-2025-30008Medium
    HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface
    CVSS 4.6
    hestiacp/hestiacpgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026 Fix availableView HOL analysis
  31. CVE-2025-30007High
    HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management
    CVSS 8.8
    hestiacp/hestiacpgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026 Fix availableView HOL analysis
  32. CVE-2026-59151Critical
    Prowler: SAML Domain Claiming Enables Cross-Tenant Account Takeover
    CVSS 9.6
    prowler-cloud/prowlergeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  33. CVE-2026-56666Medium
    ZITADEL: Auto-linking by email: IdP-side email verification is not checked
    CVSS 4.8
    zitadel/zitadelgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  34. CVE-2026-2397Critical
    SQLi in AdamPOS' MobilMen 20T
    CVSS 9.8
    Adam Retail Automation Ltd./MobilMen 20Tgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 16, 2026View HOL analysis
  35. CVE-2026-56667High
    ZITADEL: Stored XSS via Default URI Redirect in Login V2
    CVSS 7.3
    zitadel/zitadelgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  36. CVE-2026-56665Medium
    ZITADEL: Missing Token Expiration (`exp`) Validation in JWT IdP Provider
    CVSS 4.2
    zitadel/zitadelgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  37. CVE-2026-56664Medium
    ZITADEL: Missing Token Lifecyle Validation (`exp` and `iat`) in JWT IdP Provider
    CVSS 4.2
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 18, 2026 Fix availableView HOL analysis
  38. CVE-2026-55672High
    ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)
    CVSS 7.4
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 15, 2026 Fix availableView HOL analysis
  39. CVE-2026-55671Low
    ZITADEL: Server-Side Request Forgery (SSRF) and Denylist Bypass in Outgoing HTTP Components
    CVSS 2.3
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 14, 2026 Fix availableView HOL analysis
  40. CVE-2026-55670Low
    ZITADEL: Cross-Tenant User Leakage via Recycled Identifiers
    CVSS 2.3
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  41. CVE-2026-2398High
    IDOR in AdamPOS' MobilMen 20T
    CVSS 8.8
    Adam Retail Automation Ltd./MobilMen 20Tgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 16, 2026View HOL analysis
  42. CVE-2026-55669Medium
    ZITADEL: Missing Token Audience Validation (`aud`) in JWT IdP Provider
    CVSS 4.2
    github.com/zitadel/zitadel, zitadel/zitadelgeneric · go
    PublishedJul 10, 2026First seen at HOL Jun 19, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  43. CVE-2026-55781Low
    NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields
    CVSS 2.4
    M2Team/NanaZipgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  44. CVE-2026-55780Low
    NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size
    CVSS 2.4
    M2Team/NanaZipgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 13, 2026View HOL analysis
  45. CVE-2026-55783Low
    NanaZip: NULL pointer dereference in Extract() of all seven NanaZip custom archive handlers when extracting/testing the whole archive
    CVSS 2.4
    M2Team/NanaZipgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  46. CVE-2026-55782Low
    NanaZip: Unbounded memory allocation (DoS) in NanaZip WebAssembly parser via attacker-controlled section/name length fields
    CVSS 2.4
    M2Team/NanaZipgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 14, 2026View HOL analysis
  47. CVE-2026-3251Medium
    XSS in Webremium's Mezunum Satiyorum
    CVSS 6.4
    Webremium Istanbul Web Design/Mezunum Satiyorumgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  48. CVE-2026-57167Medium
    PeerTube: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
    CVSS 5.1
    Chocobozzz/PeerTubegeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  49. CVE-2026-59193Medium
    Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()
    CVSS 6.9
    getgrav/gravgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
  50. CVE-2026-59190High
    Grav Admin Plugin — IDOR Privilege Escalation via saveUser()
    CVSS 8.7
    getgrav/gravgeneric
    PublishedJul 10, 2026First seen at HOL Jul 10, 2026Updated Jul 10, 2026View HOL analysis
Page 76 of 327
Previous7475767778Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard