Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
30289
Total
2415
Critical
9078
High
9425
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-34981 | MEDIUM | 5.8 | The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileService.download_from_url() in app/services/file_service.py calls requests.get(url) with zero URL validation. … | Apr 06, 2026 |
| CVE-2026-34977 | UNKNOWN | — | Aperi'Solve is an open-source steganalysis web platform. Prior to 3.2.1, when uploading a JPEG, a user can specify an optional password to accompany the JPEG. … | Apr 06, 2026 |
| CVE-2026-34976 | CRITICAL | 10.0 | Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing from the authorization middleware config (admin.go), making it … | Apr 06, 2026 |
| CVE-2026-34975 | HIGH | 8.5 | Plunk is an open-source email platform built on top of AWS SES. Prior to 0.8.0, a CRLF header injection vulnerability was discovered in SESService.ts, where … | Apr 06, 2026 |
| CVE-2026-34841 | CRITICAL | 9.8 | Bruno is an open source IDE for exploring and testing APIs. Prior to 3.2.1, Bruno was affected by a supply chain attack involving compromised versions … | Apr 06, 2026 |
| CVE-2026-34783 | HIGH | 8.1 | Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a … | Apr 06, 2026 |
| CVE-2026-31313 | UNKNOWN | — | An authenticated stored cross-site scripting (XSS) vulnerability in the creation/editing module of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via … | Apr 06, 2026 |
| CVE-2026-5704 | MEDIUM | 5.0 | A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully … | Apr 06, 2026 |
| CVE-2026-5666 | MEDIUM | 5.3 | A vulnerability was detected in code-projects Online FIR System 1.0. Affected by this issue is some unknown functionality of the file /complaints.sql of the component … | Apr 06, 2026 |
| CVE-2026-5665 | HIGH | 7.3 | A security vulnerability has been detected in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/checklogin.php of … | Apr 06, 2026 |
| CVE-2026-34982 | HIGH | 8.2 | Vim is an open source, command line text editor. Prior to version 9.2.0276, a modeline sandbox bypass in Vim allows arbitrary OS command execution when … | Apr 06, 2026 |
| CVE-2026-34969 | UNKNOWN | — | Nhost is an open source Firebase alternative with GraphQL. Prior to 0.48.0, the auth service's OAuth provider callback flow places the refresh token directly into … | Apr 06, 2026 |
| CVE-2026-34951 | UNKNOWN | — | Workbench is a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs. Prior to 65.0.0, Workbench contains a … | Apr 06, 2026 |
| CVE-2026-34950 | CRITICAL | 9.1 | fast-jwt provides fast JSON Web Token (JWT) implementation. In 6.1.0 and earlier, the publicKeyPemMatcher regex in fast-jwt/src/crypto.js uses a ^ anchor that is defeated by … | Apr 06, 2026 |
| CVE-2026-34940 | UNKNOWN | — | KubeAI is an AI inference operator for kubernetes. Prior to 0.23.2, the ollamaStartupProbeScript() function in internal/modelcontroller/engine_ollama.go constructs a shell command string using fmt.Sprintf with unsanitized … | Apr 06, 2026 |
| CVE-2026-34764 | LOW | 2.3 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 33.0.0-alpha.1 to before 39.8.5, 40.8.5, 41.1.0, and 42.0.0-alpha.5, apps that … | Apr 06, 2026 |
| CVE-2026-34756 | MEDIUM | 6.5 | vLLM is an inference and serving engine for large language models (LLMs). From 0.1.0 to before 0.19.0, a Denial of Service vulnerability exists in the … | Apr 06, 2026 |
| CVE-2026-34755 | MEDIUM | 6.5 | vLLM is an inference and serving engine for large language models (LLMs). From 0.7.0 to before 0.19.0, the VideoMediaIO.load_base64() method at vllm/multimodal/media/video.py splits video/jpeg data … | Apr 06, 2026 |
| CVE-2026-34753 | MEDIUM | 5.4 | vLLM is an inference and serving engine for large language models (LLMs). From 0.16.0 to before 0.19.0, a server-side request forgery (SSRF) vulnerability in download_bytes_from_url … | Apr 06, 2026 |
| CVE-2026-34589 | UNKNOWN | — | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before … | Apr 06, 2026 |
| CVE-2026-34588 | UNKNOWN | — | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.1.0 to before … | Apr 06, 2026 |
| CVE-2026-34444 | UNKNOWN | — | Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in … | Apr 06, 2026 |
| CVE-2026-34402 | HIGH | 8.1 | ChurchCRM is an open-source church management system. Prior to 7.1.0, authenticated users with Edit Records or Manage Groups permissions can exploit a time-based blind SQL … | Apr 06, 2026 |
| CVE-2026-34380 | MEDIUM | 5.9 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before … | Apr 06, 2026 |
| CVE-2026-34379 | HIGH | 7.1 | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From 3.2.0 to before … | Apr 06, 2026 |