Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
26101
Total
1954
Critical
7968
High
8216
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-43979 | MEDIUM | 5.0 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdown_to_html() constructs an HTML document by interpolating user-controlled values — … | May 28, 2026 |
| CVE-2026-43000 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a … | May 28, 2026 |
| CVE-2026-42999 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the … | May 28, 2026 |
| CVE-2026-42998 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication … | May 28, 2026 |
| CVE-2026-30761 | HIGH | 7.3 | An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to execute arbitrary code via uploading a crafted image … | May 28, 2026 |
| CVE-2026-30760 | HIGH | 7.3 | An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a crafted XAJAX call. | May 28, 2026 |
| CVE-2026-46561 | MEDIUM | 5.0 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based private IP check was not applied to HTTPRequest (used … | May 28, 2026 |
| CVE-2026-45787 | UNKNOWN | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality … | May 28, 2026 |
| CVE-2026-45374 | CRITICAL | 9.6 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell … | May 28, 2026 |
| CVE-2026-45373 | HIGH | 7.4 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, … | May 28, 2026 |
| CVE-2026-45353 | UNKNOWN | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0. | May 28, 2026 |
| CVE-2026-45348 | HIGH | 8.7 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into … | May 28, 2026 |
| CVE-2026-45323 | CRITICAL | 9.6 | MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node … | May 28, 2026 |
| CVE-2026-45311 | CRITICAL | 9.6 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, … | May 28, 2026 |
| CVE-2026-45310 | HIGH | 7.4 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a … | May 28, 2026 |
| CVE-2026-45307 | MEDIUM | 6.1 | Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-login redirect targets applied … | May 28, 2026 |
| CVE-2026-45306 | MEDIUM | 6.5 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, … | May 28, 2026 |
| CVE-2026-45297 | UNKNOWN | — | OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ … | May 28, 2026 |
| CVE-2026-45296 | HIGH | 7.7 | OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, OpenReplay's Python API exposes several app_apikey routes that trust a caller-provided projectKey after validating only … | May 28, 2026 |
| CVE-2026-45058 | UNKNOWN | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. In 3.8.8 and earlier, there is persistent local-pty code execution via imported bookmarks or compromised sync targets. Affects users … | May 28, 2026 |
| CVE-2026-45021 | UNKNOWN | — | Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.25, 2.9.15, 2.11.13, 2.12.10, and … | May 28, 2026 |
| CVE-2026-44798 | HIGH | 7.1 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, a user with access to add/change a GitRepository record … | May 28, 2026 |
| CVE-2026-44797 | HIGH | 8.5 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot's Webhook data model and associated feature set could … | May 28, 2026 |
| CVE-2026-44796 | MEDIUM | 6.5 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, Nautobot UI object-bulk-rename endpoints (for example, /dcim/interfaces/rename/) were vulnerable … | May 28, 2026 |
| CVE-2026-44794 | MEDIUM | 5.4 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a … | May 28, 2026 |