Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
26383
Total
1955
Critical
7969
High
8219
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-9739 | UNKNOWN | — | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. … | May 27, 2026 |
| CVE-2026-46544 | MEDIUM | 5.3 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO accepts client-supplied session_id values in WebSocket task messages and reuses … | May 27, 2026 |
| CVE-2026-46538 | MEDIUM | 5.9 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's constellation client tracks pending task responses by session_id only and … | May 27, 2026 |
| CVE-2026-46416 | MEDIUM | 6.3 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocketHandler instance and reuses it for multiple … | May 27, 2026 |
| CVE-2026-46414 | HIGH | 8.8 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trusts client-supplied identity and role fields in … | May 27, 2026 |
| CVE-2026-46402 | HIGH | 8.1 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_name value directly when constructing session log … | May 27, 2026 |
| CVE-2026-45322 | HIGH | 7.8 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection … | May 27, 2026 |
| CVE-2026-9208 | HIGH | 8.8 | Tanium addressed an unauthorized code execution vulnerability in Connect. | May 27, 2026 |
| CVE-2026-45152 | HIGH | 7.8 | uniget is a universal installer and updater for (container) tools. Prior to 0.27.1, a command injection vulnerability exists in uniget due to unsafe execution of … | May 27, 2026 |
| CVE-2026-45083 | CRITICAL | 9.8 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi … | May 27, 2026 |
| CVE-2026-44720 | UNKNOWN | — | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access … | May 27, 2026 |
| CVE-2026-44247 | MEDIUM | 6.8 | Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming … | May 27, 2026 |
| CVE-2026-47270 | MEDIUM | 6.3 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, … | May 27, 2026 |
| CVE-2026-47269 | HIGH | 7.4 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request … | May 27, 2026 |
| CVE-2026-45137 | HIGH | 8.2 | Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to … | May 27, 2026 |
| CVE-2026-45136 | UNKNOWN | — | claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly … | May 27, 2026 |
| CVE-2026-44713 | HIGH | 8.8 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and … | May 27, 2026 |
| CVE-2026-44712 | HIGH | 8.2 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE … | May 27, 2026 |
| CVE-2026-44711 | HIGH | 7.9 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and … | May 27, 2026 |
| CVE-2026-44710 | MEDIUM | 4.6 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to … | May 27, 2026 |
| CVE-2026-44709 | HIGH | 7.8 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, pamusb-pinentry reads the PINENTRY_FALLBACK_APP environment variable and executes it directly without any … | May 27, 2026 |
| CVE-2026-44660 | UNKNOWN | — | UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+. Prior to 5.12.1, when ujson.dump() writes to a … | May 27, 2026 |
| CVE-2026-21785 | MEDIUM | 4.0 | A misconfigured Content Security Policy (CSP) in HCL BigFix Remote Control Server WebUI (versions 10.1.0.0442 and earlier) fails to define directives without fallbacks, allowing attackers … | May 27, 2026 |
| CVE-2026-9759 | MEDIUM | 5.5 | ROHC protocol dissector crash in Wireshark 4.6.0 to 4.6.5 and 4.4.0 to 4.4.15 allows denial of service | May 27, 2026 |
| CVE-2026-8364 | CRITICAL | 9.8 | Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes remote HTTP messages with URL paths starting with /resources, /status, … | May 27, 2026 |