1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
  1. Guard
  2. Security
  3. CVEs
HOL Guard

Public security guidance for teams protecting AI harnesses, MCP servers, skills, prompts, and local tool execution.

Install Guard

AI Security

  • Prompt injection
  • MCP security
  • Supply chain

Resources

  • Trust packet
  • Harness setup
  • Redacted warnings
  • Safe labs

Product

  • Install Guard
  • Pricing
  • Open dashboard
HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

HOL LogoHOL
Overview
InstallPricingEnterpriseAffiliatesDocsOpen App
Docs
  • API Reference
  • Run in Postman
  • OpenAPI Spec
  • Standards
  • Submit ERC-8004 Contract
  • Feature Your Agent
Best Agents
  • Best ERC-8004 Agents
  • Best Virtuals Agents
  • Best MCP Servers
  • Best A2A Agents
  • Best x402 Payable
  • All Categories
Community
  • Telegram
  • X
More
  • Blog
  • GitHub
  • Privacy Policy
  • Terms of Service
Settings

Copyright © 2026 HOL DAO LLC. All rights reserved.

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 10, 2026, 1:30 AM 16,370 active 1,443 known exploited

Catalog summary

16,370

Active CVEs

Active CVEs

Search active, non-withdrawn CVEs in the HOL Guard feed, then open the matching HOL analysis.

Feed liveLast checked Aug 10, 2026, 1:30 AM 16,370 active 1,443 known exploited

Catalog summary

16,370

Active CVEs

8,461

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 4,351–4,400 of 16,370 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-55596High
    Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
    CVSS 8.7
    udecode/plategeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  2. CVE-2026-56669High
    Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict
    CVSS 7.5
    elysiajs/elysiageneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  3. CVE-2026-58494Medium
    Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
    CVSS 6.5
    bytecodealliance/wasmtimegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  4. CVE-2026-14896Medium
    Nomad vulnerable to cross-namespace host volume claim deletion
    CVSS 4.2
    HashiCorp/Nomad, HashiCorp/Nomad Enterprisegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  5. CVE-2026-58208Medium
    NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
    CVSS 6.8
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  6. CVE-2026-58211Medium
    NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
    CVSS 5.4
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  7. CVE-2026-58207High
    NATS Server: Remote crash via integer overflow in Connz pagination
    CVSS 7.7
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  8. CVE-2026-0288High
    PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent
    CVSS 7.5
    Palo Alto Networks/PAN-OS, Palo Alto Networks/Prisma Accessgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  9. CVE-2026-58210High
    NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
    CVSS 7.5
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  10. CVE-2026-58209Medium
    NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
    CVSS 4.3
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  11. CVE-2026-14361Medium
    Consul-template is vulnerable to path redirection in writeToFile through symlink attack
    CVSS 4.7
    HashiCorp/Toolinggeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  12. CVE-2026-14891High
    Nomad vulnerable to sandbox escape in Docker task driver
    CVSS 8.7
    HashiCorp/Nomad, HashiCorp/Nomad Enterprisegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  13. CVE-2026-58214Medium
    NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
    CVSS 4.3
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  14. CVE-2026-58254Medium
    NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
    CVSS 5.3
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  15. CVE-2026-8801Low
    File Extension Restriction Bypass in MOVEit Transfer
    CVSS 3.5
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  16. CVE-2026-8800Low
    Cross-Org External Token Metadata accessible to AuditUser role
    CVSS 2.7
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  17. CVE-2026-58213High
    NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
    CVSS 7.1
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  18. CVE-2026-15154Medium
    Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex
    CVSS 6.5
    Affected software not mappedEcosystem not listed
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  19. CVE-2026-8651Low
    IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer
    CVSS 3.7
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  20. CVE-2026-58250High
    NATS Server: Pre-auth server crash via double INFO in leafnode handshake
    CVSS 7.5
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  21. CVE-2026-8650Medium
    Authenticated Path Traversal allows MOVEit admins to view arbitrary system files
    CVSS 4.5
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  22. CVE-2026-58252Medium
    NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
    CVSS 6.5
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  23. CVE-2026-59807Medium
    Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts
    CVSS 6.8
    ComposioHQ/composiogeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  24. CVE-2026-59806High
    Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint
    CVSS 7.4
    gradio-app/gradiogeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  25. CVE-2026-58253High
    NATS Server: Route API Auth Bypass
    CVSS 8.8
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  26. CVE-2026-59805Medium
    Gumroad < 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController
    CVSS 6.5
    antiwork/gumroadgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  27. CVE-2026-59804Medium
    Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket
    CVSS 6.8
    web-infra-dev/midscenegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  28. CVE-2026-59803High
    rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol
    CVSS 7.5
    smallnest/rpcxgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  29. CVE-2026-8649Medium
    Institution scope bypass vulnerability in custom reports
    CVSS 6.4
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  30. CVE-2026-58251Medium
    NATS Server: Queue Subscribe Authz Bypass
    CVSS 6.5
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  31. CVE-2026-55404High
    yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
    CVSS 7.5
    yt-dlp/yt-dlpgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  32. CVE-2026-59936High
    pypdf: Possible infinite loop for not terminated inline images
    CVSS 8.7
    py-pdf/pypdfgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  33. CVE-2026-59935High
    pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
    CVSS 8.7
    py-pdf/pypdfgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  34. CVE-2026-59939High
    httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
    CVSS 7.5
    httplib2, httplib2/httplib2generic · pypi
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 25, 2026 Fix availableView HOL analysis
  35. CVE-2026-59947Medium
    Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
    CVSS 4.7
    composer/composergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  36. CVE-2026-59948High
    Composer: Arbitrary file write outside vendor via malicious transitive package name
    CVSS 7.0
    composer/composergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  37. CVE-2026-59819Medium
    LiteLLM: Local file read via request-supplied OIDC file references
    CVSS 4.9
    BerriAI/litellmgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  38. CVE-2026-59946Medium
    Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
    CVSS 6.1
    composer/composergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  39. CVE-2026-59822High
    LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
    CVSS 8.8
    BerriAI/litellmgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  40. CVE-2026-44332Medium
    Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
    CVSS 5.3
    github.com/gofiber/fiber/v3, gofiber/fibergeneric · go
    PublishedJul 8, 2026First seen at HOL Jul 2, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  41. CVE-2026-59820Medium
    LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    CVSS 6.5
    BerriAI/litellmgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  42. CVE-2026-53624Medium
    Fiber: HSTS header never set in helmet middleware due to incorrect protocol check
    CVSS 4.8
    github.com/gofiber/fiber, gofiber/fibergeneric · go
    PublishedJul 8, 2026First seen at HOL Jul 6, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  43. CVE-2026-44512Medium
    ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
    CVSS 5.5
    onnx, onnx/onnxgeneric · pip · pypi
    PublishedJul 8, 2026First seen at HOL Jul 7, 2026Updated Jul 16, 2026 Fix availableView HOL analysis
  44. CVE-2026-55575High
    LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
    CVSS 8.2
    harttle/liquidjsgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  45. CVE-2026-58501Medium
    Zeep SSRF because Settings.forbid_external is not enforced
    CVSS 5.9
    mvantellingen/python-zeepgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  46. CVE-2026-55760High
    handlebars.java FileTemplateLoader Path Traversal
    CVSS 7.5
    com.github.jknack:handlebars, jknack/handlebars.javageneric · maven
    PublishedJul 8, 2026First seen at HOL Jun 19, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  47. CVE-2026-45045Medium
    Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward
    CVSS 5.3
    github.com/gofiber/fiber/v2, github.com/gofiber/fiber/v3 +1generic · go
    PublishedJul 8, 2026First seen at HOL Jul 2, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  48. CVE-2026-59821High
    LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
    CVSS 7.2
    BerriAI/litellmgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  49. CVE-2026-14373High
    Nomad Docker driver Linux host namespace bypass
    CVSS 7.7
    HashiCorp/Nomad, HashiCorp/Nomad Enterprisegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  50. CVE-2026-59937Medium
    pypdf: Possible long runtimes for repeated malformed cross-reference entries
    CVSS 6.9
    py-pdf/pypdfgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
Page 88 of 328
Previous8687888990Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard

8,461

Critical + high

1,443

Known exploited

12

Ecosystems

Search and filter active CVEs

Filters & sort
Severity
Clear

Showing 4,351–4,400 of 16,370 active CVEs

Sorted by Published (newest)

Active CVE results

Select a result for the HOL analysis
IdentityRiskAffected softwarePublished
  1. CVE-2026-55596High
    Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
    CVSS 8.7
    udecode/plategeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  2. CVE-2026-56669High
    Elysia: Inefficient Algorithmic Complexity and Interpretation Conflict
    CVSS 7.5
    elysiajs/elysiageneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  3. CVE-2026-58494Medium
    Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
    CVSS 6.5
    bytecodealliance/wasmtimegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  4. CVE-2026-14896Medium
    Nomad vulnerable to cross-namespace host volume claim deletion
    CVSS 4.2
    HashiCorp/Nomad, HashiCorp/Nomad Enterprisegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  5. CVE-2026-58208Medium
    NATS Server: MQTT-over-WebSocket Path Can Crash WebSocket-Only JetStream Servers Before MQTT Is Enabled
    CVSS 6.8
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  6. CVE-2026-58211Medium
    NATS Server: `no_auth_user` pre-CONNECT fast path bypasses user connection restrictions
    CVSS 5.4
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  7. CVE-2026-58207High
    NATS Server: Remote crash via integer overflow in Connz pagination
    CVSS 7.7
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  8. CVE-2026-0288High
    PAN-OS: Buffer Overflow Vulnerabilities in User-ID Terminal Server Agent
    CVSS 7.5
    Palo Alto Networks/PAN-OS, Palo Alto Networks/Prisma Accessgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  9. CVE-2026-58210High
    NATS Server: MQTT partial CONNECT packets can exhaust pre-auth memory
    CVSS 7.5
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  10. CVE-2026-58209Medium
    NATS Server: MQTT retained and QoS replay bypass subscribe deny filters
    CVSS 4.3
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  11. CVE-2026-14361Medium
    Consul-template is vulnerable to path redirection in writeToFile through symlink attack
    CVSS 4.7
    HashiCorp/Toolinggeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  12. CVE-2026-14891High
    Nomad vulnerable to sandbox escape in Docker task driver
    CVSS 8.7
    HashiCorp/Nomad, HashiCorp/Nomad Enterprisegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  13. CVE-2026-58214Medium
    NATS Server: MQTT subscribe ACL bypass via $MQTT.deliver.pubrel prefix (incomplete fix for CVE-2026-33217)
    CVSS 4.3
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  14. CVE-2026-58254Medium
    NATS Server: Incomplete fix for CVE-2026-33249: Leaf node connections bypass Nats-Trace-Dest permission check
    CVSS 5.3
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  15. CVE-2026-8801Low
    File Extension Restriction Bypass in MOVEit Transfer
    CVSS 3.5
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  16. CVE-2026-8800Low
    Cross-Org External Token Metadata accessible to AuditUser role
    CVSS 2.7
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  17. CVE-2026-58213High
    NATS Server: MQTT SUBSCRIBE Protocol Injection via Leaf Node/Route Forwarding allows arbitrary NATS command injection
    CVSS 7.1
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  18. CVE-2026-15154Medium
    Guardrails-detectors: guardrails-detectors: unauthenticated regular-expression denial of service (redos) via detector_params.regex
    CVSS 6.5
    Affected software not mappedEcosystem not listed
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  19. CVE-2026-8651Low
    IPv6 Loopback Spoof via Trusted Host Header Bypasses Origin Check in MOVEit Transfer
    CVSS 3.7
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  20. CVE-2026-58250High
    NATS Server: Pre-auth server crash via double INFO in leafnode handshake
    CVSS 7.5
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  21. CVE-2026-8650Medium
    Authenticated Path Traversal allows MOVEit admins to view arbitrary system files
    CVSS 4.5
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  22. CVE-2026-58252Medium
    NATS Server: Subscribe Authz Bypass via Wildcard-Overlap
    CVSS 6.5
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  23. CVE-2026-59807Medium
    Composio SDK < 0.2.32-beta.283 - Sensitive File Upload via tool-file-uploads.ts
    CVSS 6.8
    ComposioHQ/composiogeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  24. CVE-2026-59806High
    Gradio < 6.20.0 - Open Redirect and SSRF via /gradio_api/file= endpoint
    CVSS 7.4
    gradio-app/gradiogeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  25. CVE-2026-58253High
    NATS Server: Route API Auth Bypass
    CVSS 8.8
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  26. CVE-2026-59805Medium
    Gumroad < 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController
    CVSS 6.5
    antiwork/gumroadgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  27. CVE-2026-59804Medium
    Midscene Bridge Server - Session Hijack via Unauthenticated WebSocket
    CVSS 6.8
    web-infra-dev/midscenegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  28. CVE-2026-59803High
    rpcx - Denial of Service via Gzip Decompression Bomb in Wire Protocol
    CVSS 7.5
    smallnest/rpcxgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  29. CVE-2026-8649Medium
    Institution scope bypass vulnerability in custom reports
    CVSS 6.4
    Progress/MOVEit Transfergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  30. CVE-2026-58251Medium
    NATS Server: Queue Subscribe Authz Bypass
    CVSS 6.5
    nats-io/nats-servergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  31. CVE-2026-55404High
    yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output
    CVSS 7.5
    yt-dlp/yt-dlpgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  32. CVE-2026-59936High
    pypdf: Possible infinite loop for not terminated inline images
    CVSS 8.7
    py-pdf/pypdfgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  33. CVE-2026-59935High
    pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)
    CVSS 8.7
    py-pdf/pypdfgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
  34. CVE-2026-59939High
    httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
    CVSS 7.5
    httplib2, httplib2/httplib2generic · pypi
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 25, 2026 Fix availableView HOL analysis
  35. CVE-2026-59947Medium
    Composer: URL-embedded HTTP-Basic username leaks to verbose logs (GitHub PAT exposure)
    CVSS 4.7
    composer/composergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  36. CVE-2026-59948High
    Composer: Arbitrary file write outside vendor via malicious transitive package name
    CVSS 7.0
    composer/composergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  37. CVE-2026-59819Medium
    LiteLLM: Local file read via request-supplied OIDC file references
    CVSS 4.9
    BerriAI/litellmgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  38. CVE-2026-59946Medium
    Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
    CVSS 6.1
    composer/composergeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  39. CVE-2026-59822High
    LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
    CVSS 8.8
    BerriAI/litellmgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  40. CVE-2026-44332Medium
    Fiber: Username Enumeration via Timing Oracle in BasicAuth Default Authorizer
    CVSS 5.3
    github.com/gofiber/fiber/v3, gofiber/fibergeneric · go
    PublishedJul 8, 2026First seen at HOL Jul 2, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  41. CVE-2026-59820Medium
    LiteLLM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
    CVSS 6.5
    BerriAI/litellmgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  42. CVE-2026-53624Medium
    Fiber: HSTS header never set in helmet middleware due to incorrect protocol check
    CVSS 4.8
    github.com/gofiber/fiber, gofiber/fibergeneric · go
    PublishedJul 8, 2026First seen at HOL Jul 6, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  43. CVE-2026-44512Medium
    ONNX: Null Pointer Dereference in Upsample Version Converter Adapter (Zero Inputs)
    CVSS 5.5
    onnx, onnx/onnxgeneric · pip · pypi
    PublishedJul 8, 2026First seen at HOL Jul 7, 2026Updated Jul 16, 2026 Fix availableView HOL analysis
  44. CVE-2026-55575High
    LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce
    CVSS 8.2
    harttle/liquidjsgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  45. CVE-2026-58501Medium
    Zeep SSRF because Settings.forbid_external is not enforced
    CVSS 5.9
    mvantellingen/python-zeepgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 10, 2026View HOL analysis
  46. CVE-2026-55760High
    handlebars.java FileTemplateLoader Path Traversal
    CVSS 7.5
    com.github.jknack:handlebars, jknack/handlebars.javageneric · maven
    PublishedJul 8, 2026First seen at HOL Jun 19, 2026Updated Jul 10, 2026 Fix availableView HOL analysis
  47. CVE-2026-45045Medium
    Fiber: X-Real-IP Spoofing via Header.Add() in BalancerForward
    CVSS 5.3
    github.com/gofiber/fiber/v2, github.com/gofiber/fiber/v3 +1generic · go
    PublishedJul 8, 2026First seen at HOL Jul 2, 2026Updated Aug 4, 2026 Fix availableView HOL analysis
  48. CVE-2026-59821High
    LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
    CVSS 7.2
    BerriAI/litellmgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 13, 2026View HOL analysis
  49. CVE-2026-14373High
    Nomad Docker driver Linux host namespace bypass
    CVSS 7.7
    HashiCorp/Nomad, HashiCorp/Nomad Enterprisegeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026 Fix availableView HOL analysis
  50. CVE-2026-59937Medium
    pypdf: Possible long runtimes for repeated malformed cross-reference entries
    CVSS 6.9
    py-pdf/pypdfgeneric
    PublishedJul 8, 2026First seen at HOL Jul 8, 2026Updated Jul 9, 2026View HOL analysis
Page 88 of 328
Previous8687888990Next
How this catalog works

Active means a non-withdrawn CVE List record with a validated alias, English description, publication date, and source reference. Published is the CVE Program date; First seen at HOL is when this feed first indexed the record; Modified and Source checked describe later feed activity. Severity uses the reported source value when present, otherwise a valid CVSS score supplies the displayed band. Unmapped records do not imply package coverage.

Put Guard beside your supply-chain workflow.

Explore HOL Guard