Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
26101
Total
1954
Critical
7968
High
8216
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-32847 | HIGH | 7.5 | DeepCode through commit c991dc2 contains a path traversal vulnerability in the SPA catch-all route in new_ui/backend/main.py that allows unauthenticated attackers to read arbitrary files by … | May 28, 2026 |
| CVE-2026-4944 | HIGH | 8.8 | vllm-project/vllm version 0.14.1 contains a vulnerability where the `trust_remote_code=True` parameter is hardcoded in two model implementation files (`vllm/model_executor/models/nemotron_vl.py` and `vllm/model_executor/models/kimi_k25.py`). This bypasses the user's explicit … | May 28, 2026 |
| CVE-2026-47337 | LOW | 3.3 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AF_INET/AF_INET6 socket mediation. The bug can … | May 28, 2026 |
| CVE-2026-47336 | LOW | 3.3 | Ubuntu Linux 6.8 contains SAUCE patches with a possible use of an uninitialized variable in AppArmor AF_INET/AF_INET6 socket mediation code. The bug can be triggered … | May 28, 2026 |
| CVE-2026-47335 | MEDIUM | 5.5 | Ubuntu Linux 6.8 contains SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be triggered by an … | May 28, 2026 |
| CVE-2026-47334 | MEDIUM | 5.5 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly sleep while holding a spinlock in notification handling code. The bug can be … | May 28, 2026 |
| CVE-2026-47333 | HIGH | 7.8 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which can potentially incorrectly compute the size of an internal buffer, leading to a heap … | May 28, 2026 |
| CVE-2026-47332 | MEDIUM | 5.5 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly validate the size of an internal structure, leading to an out-of-bounds read in … | May 28, 2026 |
| CVE-2026-47331 | HIGH | 7.8 | Ubuntu Linux 6.8 contains AppArmor SAUCE patches which fail to acquire a lock when modifying a linked list. An unprivileged local user could trigger the … | May 28, 2026 |
| CVE-2026-47330 | LOW | 3.3 | Ubuntu Linux 6.8, 7.17 and 7.0 contain AppArmor SAUCE patches which can, under certain circumstances, use an uninitialized variable in notification handling code. The bug … | May 28, 2026 |
| CVE-2026-47329 | LOW | 3.3 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches which fail to validate invalid sizes of the name field in AppAmor notification responses. The bug … | May 28, 2026 |
| CVE-2026-47328 | MEDIUM | 6.1 | Ubuntu Linux 6.8, 6.17 and 7.0 contain AppArmor SAUCE patches which incorrectly attempt to free a pointer which was not previously kmalloc()d, while at the … | May 28, 2026 |
| CVE-2026-47327 | LOW | 3.3 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a possible NULL pointer dereference in the handling of AppArmor notifications. The bug can be … | May 28, 2026 |
| CVE-2026-47326 | MEDIUM | 5.5 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can … | May 28, 2026 |
| CVE-2026-47136 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rustfs/console/license returns parsed license metadata without requiring … | May 28, 2026 |
| CVE-2026-46685 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request … | May 28, 2026 |
| CVE-2026-46526 | MEDIUM | 5.0 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.10, the URL checking logic in local-deep-research has a logical flaw … | May 28, 2026 |
| CVE-2026-46509 | HIGH | 8.2 | deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must … | May 28, 2026 |
| CVE-2026-45332 | HIGH | 7.5 | Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve … | May 28, 2026 |
| CVE-2026-45044 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, … | May 28, 2026 |
| CVE-2026-45042 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the UploadPartCopy operation allows copying objects across buckets without … | May 28, 2026 |
| CVE-2026-45041 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named … | May 28, 2026 |
| CVE-2026-45040 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the server … | May 28, 2026 |
| CVE-2026-45039 | CRITICAL | 9.8 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using … | May 28, 2026 |
| CVE-2026-44394 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly … | May 28, 2026 |