CVE Vulnerabilities - 18 July 2026

An attacker can access internal or administrative paths on a server protected by a Fastify HTTP proxy if the proxy is configured to rewrite a URL prefix that contains encoded characters. To fix this, ...

VMware Avi Load Balancer versions 31.1.1 to 31.2.2 and earlier versions 30.1.1 to 30.2.6 and 22.1.1 to 22.1.7 may allow unauthorized access to the system. This is a security risk because a malicious u...

A vulnerability in SurrealDB allows an authenticated user with the right permissions to inject malicious code into the database. This can lead to unauthorized access and even a complete takeover of th...

SurrealDB's backup export and import process can be exploited by a malicious user with OWNER or EDITOR roles to gain root access to the database. This risk is particularly high for SurrealDB instances...

SurrealDB versions 1.5.5 and earlier, and 2.0.0-beta versions before 2.0.0-beta.3, do not properly check data sent to signin and signup operations. This allows an attacker to execute unauthorized data...

SurrealDB versions prior to 1.0.1 have a default permission setting that allows anyone with database access to perform various operations on tables without explicit permission. This means attackers or...

OpenPLC_v3, a software used for process control, has a security flaw that allows an attacker to crash the system and disrupt its operation. This issue affects the web interface and can be exploited by...

An attacker could use SurrealDB's RPC API to gain access to sensitive data and perform actions on a user's account if the API is exposed to untrusted users. This is possible if the SurrealDB owner has...

Any user who can access SurrealDB can create, read, update and delete data in tables without explicit permissions. This is a concern for public-facing SurrealDB instances where anyone can access the d...

A security flaw in Shibby Tomato 1.28 allows hackers to access sensitive router configuration data remotely. This can lead to unauthorized changes to the router settings. We recommend updating to a ne...

The Shibby Tomato 1.28 Scheduler Name Handler has a vulnerability that could allow an attacker to overflow the system's memory, potentially leading to system crashes or unauthorized access. This issue...

A flaw in Shibby Tomato's setup process allows a remote attacker to potentially execute malicious code on the router. This issue affects users who have not updated to a newer version of the software, ...

Red Hat Hardened Images, used for secure Linux containers, has been updated to fix security issues and improve performance. This update is important for organizations using these images, as it ensures...

The VMware Avi Load Balancer has a security flaw that allows a malicious user with a valid account to access parts of the system they shouldn't be able to. This could lead to unauthorized changes or d...

A vulnerability in Parisneo Lollms allows an attacker to send malicious messages to another user's inbox. This could lead to the attacker taking control of the victim's account, accessing sensitive in...

Fastify Reply-From versions 8.3.1 to 12.6.4 have a bug that can cause data to be accessed from the wrong server. This can happen when using the default settings. To fix the issue, upgrade to version 1...

The Fastify HTTP Proxy software has a security flaw that allows attackers to access sensitive information by manipulating URLs. This issue affects versions 9.4.0 to 11.5.0 and can be exploited by cert...

An attacker with access to the Avi Load Balancer can inject and run malicious code, potentially taking control of the system. This affects multiple versions of the software and can be mitigated by upg...

The VMware Avi Load Balancer is vulnerable to a security flaw that could allow an attacker to execute code remotely on the system. This means an attacker could potentially take control of the system. ...

SurrealDB servers with scripting enabled can be exploited if an attacker injects specific input into a scripting function. This could allow an attacker to read sensitive information or run malicious c...

An outdated version of SurrealDB contains a security flaw that lets attackers access sensitive information or take control of the database. This affects SurrealDB versions before 1.1.1, and it's essen...

A malicious actor on the network can access some Avi Load Balancer features without permission. This could allow them to view or modify certain settings. VMware has released patches to fix this issue,...

An attacker can steal an existing QueryWeaver account by knowing the victim's email address. This can happen because QueryWeaver does not properly check if an email is already linked to an account bef...

A security issue in Debian Linux allows attackers to run malicious code without needing permission. This can happen when a user visits a compromised website or opens a malicious email attachment. To f...

The urwid web display backend generates session IDs that can be easily predicted by attackers, allowing them to read sensitive information, inject keystrokes, and even take control of a user's session...