CVEs
Browse the synced catalog, newest first.
- CVE-2026-85742FreeScout: Conditional stored admin XSS via failed-job detailsfreescout-help-desk freescout
- CVE-2026-123748chenyme grok2api WebSocket Proxy voice_ws_handler.go proxyVoiceWebSocket resource consumptionchenyme grok2api
- CVE-2026-103985FreeScout: a restricted agent can lift their own admin-imposed "see only assigned conversations" restriction via profile savefreescout-help-desk freescout
- CVE-2026-123962In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys…Debian FreedomBox
- CVE-2026-122193OS command injection in the example SSM documents in Trusted Remote Execution (REX)AWS trusted-remote-execution
- CVE-2026-103984FreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PIIfreescout-help-desk freescout
- CVE-2026-85743FreeScout: Server-side request forgery via incomplete outbound host validation and unguarded download sinksfreescout-help-desk freescout
- CVE-2026-85744FreeScout: Conversation Merge Cross-Mailbox Authorization Bypassfreescout-help-desk freescout
- CVE-2026-62850FreeScout: Administrative tools.php endpoint is accessible to low-privileged users, enabling filesystem enumeration and unthrottled…freescout-help-desk freescout
- CVE-2026-62852FreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through…freescout-help-desk freescout
- CVE-2026-62855FreeScout: Path Traversal in App Logs Viewer Exposes Arbitrary Local Filesfreescout-help-desk freescout
- CVE-2026-106128Prototype Pollution in Progress Software Kendo UI for VueProgress Software @progress/kendo-vue-common
- CVE-2026-62851FreeScout: Cross-mailbox conversation existence / internal-id disclosure via the search-by-number (`#`) shortcut (missing mailbox…freescout-help-desk freescout
- CVE-2026-106127Prototype Pollution in Progress Software KendoReactProgress Software @progress/kendo-react-common
- CVE-2026-62856FreeScout: Cross-User Notification Data Disclosure via LIKE Wildcard Injection in Polycast Channel Queryfreescout-help-desk freescout
- CVE-2026-106144Prototype Pollution in Progress Software Kendo UI for AngularProgress Software @progress/kendo-angular-common · Progress…
- CVE-2026-106143Cross-Site Scripting in Progress Software Kendo UI for VueProgress Software @progress/kendo-vue-editor
- CVE-2026-106142Cross-Site Scripting in Progress Software KendoReactProgress Software @progress/kendo-react-editor
- CVE-2026-106141Cross-Site Scripting in Progress Software Kendo UI for AngularProgress Software @progress/kendo-angular-editor
- CVE-2026-106136Cross-Site Scripting in Progress Software KendoReactProgress Software @progress/kendo-react-conversational-ui
- CVE-2026-62854FreeScout: Stored XSS in mailbox signature via same-origin JS uploadfreescout-help-desk freescout
- CVE-2026-106134Cross-Site Scripting in Progress Software KendoReactProgress Software @progress/kendo-react-layout
- CVE-2026-106135Cross-Site Scripting in Progress Software Kendo UI for AngularProgress Software @progress/kendo-angular-conversational-ui
- CVE-2026-122053Symfony: ObjectNormalizer Dotted-Key Property-Path Traversal Bypasses #[Ignore] on Nested Objectssensiolabs symfony/serializer
- CVE-2026-104656Cross-site Scripting in Progress Telerik Fiddler EverywhereProgress Software Progress® Telerik® Fiddler® Everywhere
- CVE-2026-104657Missing Integrity Verification in Progress Software Fiddler Download & Setup SkillProgress Software Fiddler Download & Setup Skill
- CVE-2026-118515Symfony: The Serializer Builds UploadedFile Objects From Request Data, Letting a Client Point an Upload at Any Server Filesensiolabs symfony/serializer
- CVE-2026-123859SQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)snowflake-connector-python
- CVE-2026-123858In JetBrains PhpStorm before 2026.3 project files could be automatically uploaded to a deployment server from untrusted projectsJetBrains PhpStorm
- CVE-2026-123857In JetBrains PhpStorm before 2026.3 xXE was possible in untrusted projects via PHPMD ruleset autodetectionJetBrains PhpStorm