Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
26391
Total
1955
Critical
7971
High
8223
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-48896 | UNKNOWN | — | Insufficient state checks lead to a vector that allows to bypass 2FA checks. | May 26, 2026 |
| CVE-2026-48864 | HIGH | 7.8 | A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input … | May 26, 2026 |
| CVE-2026-48697 | HIGH | 7.4 | FastNetMon Community Edition through 1.2.9 does not verify TLS certificates on outbound HTTPS connections. The execute_web_request_secure() function in src/fast_library.cpp creates a boost::asio::ssl::context with tls_client mode … | May 26, 2026 |
| CVE-2026-48693 | MEDIUM | 5.5 | FastNetMon Community Edition through 1.2.9 is vulnerable to a local symlink attack via predictable file paths in /tmp. The statistics file path defaults to '/tmp/fastnetmon.dat' … | May 26, 2026 |
| CVE-2026-48691 | CRITICAL | 9.8 | FastNetMon Community Edition through 1.2.9 contains an integer overflow in the BGP AS_PATH attribute encoder. In src/bgp_protocol.hpp, the IPv4UnicastAnnounce::get_attributes() function computes attribute_length as 'sizeof(bgp_as_path_segment_element_t) + … | May 26, 2026 |
| CVE-2026-48690 | HIGH | 7.1 | FastNetMon Community Edition through 1.2.9 contains an integer overflow vulnerability in the packet capture buffer allocation. In src/packet_storage.hpp, the allocate_buffer() function computes memory_size_in_bytes as 'buffer_size_in_packets … | May 26, 2026 |
| CVE-2026-48126 | HIGH | 8.2 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at … | May 26, 2026 |
| CVE-2026-48091 | UNKNOWN | — | Rejected reason: Further research determined the issue is not a vulnerability. | May 26, 2026 |
| CVE-2026-47728 | MEDIUM | 4.3 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink resolved sourcemaps and debug files by debug ID without scoping that lookup to the … | May 26, 2026 |
| CVE-2026-47716 | LOW | 3.1 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, In affected versions, the issue list view authorizes access through the project in the URL, … | May 26, 2026 |
| CVE-2026-47715 | LOW | 3.1 | Bugsink is a self-hosted error tracking tool. Prior to 2.2.0, Bugsink issue event pages accept a direct event identifier from the URL and, in affected … | May 26, 2026 |
| CVE-2026-46431 | MEDIUM | 4.3 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server's Access-Control-Allow-Origin response header was hardcoded to the wildcard * regardless … | May 26, 2026 |
| CVE-2026-46430 | MEDIUM | 4.3 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent … | May 26, 2026 |
| CVE-2026-45836 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_get_sndtimeo_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() … | May 26, 2026 |
| CVE-2026-45835 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() … | May 26, 2026 |
| CVE-2026-45834 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb() Add the same NULL guard already present in l2cap_sock_resume_cb() … | May 26, 2026 |
| CVE-2026-45728 | HIGH | 7.5 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode … | May 26, 2026 |
| CVE-2026-45721 | CRITICAL | 9.0 | Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is asked for any URL path that resolves to a directory without … | May 26, 2026 |
| CVE-2026-44729 | HIGH | 8.7 | Twenty is an open source CRM. In 1.18.0 and earlier, the file serving endpoints in Twenty CRM at /files/* and /file/:fileFolder/:id serve uploaded files using … | May 26, 2026 |
| CVE-2026-44723 | MEDIUM | 5.0 | Vowpal Wabbit is a machine learning system. The workflow .github/workflows/python_checks.yml embeds ${{ github.event.pull_request.title }} directly inside double-quoted bash strings in four separate steps across four … | May 26, 2026 |
| CVE-2026-44680 | HIGH | 7.6 | MikroORM is a TypeScript ORM for Node.js based on Data Mapper, Unit of Work and Identity Map patterns. Prior to @mikro-orm/knex 6.6.14 and @mikro-orm/sql 7.0.14, … | May 26, 2026 |
| CVE-2026-44502 | MEDIUM | 4.3 | Bugsink is a self-hosted error tracking tool. Prior to 2.1.3, Bugsink’s webhook URL validation could be (partially) bypassed because of a mismatch in URL parsing. … | May 26, 2026 |
| CVE-2026-44314 | MEDIUM | 4.3 | Traccar is an open source GPS tracking system. Prior to 6.13.0, DeviceResource.uploadImage authorizes the target device only through Condition.Permission(User.class, getUserId(), Device.class) and then immediately streams … | May 26, 2026 |
| CVE-2026-43982 | UNKNOWN | — | Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check … | May 26, 2026 |
| CVE-2026-43981 | UNKNOWN | — | Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, in engine/luahandler.go, the sync.RWMutex protecting LoadCommonFunctions is released before L.Push() and L.PCall() execute. Since … | May 26, 2026 |