Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
10846
Total
736
Critical
3127
High
3471
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-40199 | UNKNOWN | — | Net::CIDR::Lite versions before 0.23 for Perl mishandles IPv4 mapped IPv6 addresses, which may allow IP ACL bypass. _pack_ipv6() includes the sentinel byte from _pack_ipv4() when … | Apr 10, 2026 |
| CVE-2026-40198 | UNKNOWN | — | Net::CIDR::Lite versions before 0.23 for Perl does not validate IPv6 group count, which may allow IP ACL bypass. _pack_ipv6() does not check that uncompressed IPv6 … | Apr 10, 2026 |
| CVE-2026-33119 | MEDIUM | 5.4 | User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | Apr 10, 2026 |
| CVE-2026-33118 | MEDIUM | 4.3 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | Apr 10, 2026 |
| CVE-2026-5724 | UNKNOWN | — | The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and … | Apr 10, 2026 |
| CVE-2026-40252 | UNKNOWN | — | FastGPT is an AI Agent building platform. Prior to 4.14.10.4, Broken Access Control vulnerability (IDOR/BOLA) allows any authenticated team to access and execute applications belonging … | Apr 10, 2026 |
| CVE-2026-40242 | HIGH | 7.2 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs … | Apr 10, 2026 |
| CVE-2026-40194 | LOW | 3.7 | phpseclib is a PHP secure communications library. Prior to 3.0.51, 2.0.53, and 1.0.28, phpseclib\Net\SSH2::get_binary_packet() uses PHP's != operator to compare a received SSH packet HMAC … | Apr 10, 2026 |
| CVE-2026-40191 | UNKNOWN | — | ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.4-beta-1f46165, ClearanceKit's Endpoint Security event handler only checked the source path … | Apr 10, 2026 |
| CVE-2026-40190 | MEDIUM | 5.6 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.5.18, the LangSmith JavaScript/TypeScript SDK (langsmith) contains an incomplete prototype pollution fix … | Apr 10, 2026 |
| CVE-2026-40189 | UNKNOWN | — | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listings and file reads, but … | Apr 10, 2026 |
| CVE-2026-40188 | HIGH | 7.7 | goshs is a SimpleHTTPServer written in Go. From 1.0.7 to before 2.0.0-beta.4, the SFTP command rename sanitizes only the source path and not the destination, … | Apr 10, 2026 |
| CVE-2026-40185 | HIGH | 7.1 | TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is fixed … | Apr 10, 2026 |
| CVE-2026-40184 | LOW | 3.7 | TREK is a collaborative travel planner. Prior to 2.7.2, TREK served uploaded photos without requiring authentication. This vulnerability is fixed in 2.7.2. | Apr 10, 2026 |
| CVE-2026-40180 | UNKNOWN | — | Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs generation. Prior to 2.16.0 and 2.15.0-lts, the unzip() method in ApicurioCodegenWrapper.java … | Apr 10, 2026 |
| CVE-2026-40178 | UNKNOWN | — | ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a … | Apr 10, 2026 |
| CVE-2026-40177 | UNKNOWN | — | ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass … | Apr 10, 2026 |
| CVE-2026-40175 | CRITICAL | 10.0 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack … | Apr 10, 2026 |
| CVE-2026-40168 | HIGH | 8.2 | Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied … | Apr 10, 2026 |
| CVE-2026-39922 | UNKNOWN | — | GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to … | Apr 10, 2026 |
| CVE-2026-39921 | UNKNOWN | — | GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger … | Apr 10, 2026 |
| CVE-2026-32252 | HIGH | 7.7 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a … | Apr 10, 2026 |
| CVE-2026-30232 | UNKNOWN | — | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew … | Apr 10, 2026 |
| CVE-2026-3446 | UNKNOWN | — | When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to … | Apr 10, 2026 |
| CVE-2026-33737 | MEDIUM | 5.3 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NOENT flag, arbitrary server files … | Apr 10, 2026 |