Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
26897
Total
1982
Critical
8080
High
8318
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-44482 | CRITICAL | 9.6 | soundcloud-rpc is a SoundCloud Client with Discord Rich Presence, Dark Mode, Last.fm and AdBlock support. Prior to 0.1.8, a track title containing an HTML payload … | May 14, 2026 |
| CVE-2026-44375 | HIGH | 7.5 | Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can … | May 14, 2026 |
| CVE-2026-44374 | MEDIUM | 4.3 | Backstage is an open framework for building developer portals. Prior to 0.6.11, the unprocessed entities read endpoints in @backstage/plugin-catalog-backend-module-unprocessed do not enforce permission authorization checks. … | May 14, 2026 |
| CVE-2026-44371 | UNKNOWN | — | Open OnDemand is an open-source high-performance computing portal. Prior to 4.0.11, 4.1.5, and 4.2.2, specially crafted filenames can execute javascript in the file browser This … | May 14, 2026 |
| CVE-2026-44308 | UNKNOWN | — | Spring Cloud AWS simplifies using AWS managed services in a Spring and Spring Boot applications. From 3.0.0 to 4.0.1, pplications using Spring Cloud AWS SNS … | May 14, 2026 |
| CVE-2026-44216 | UNKNOWN | — | Wasmtime is a runtime for WebAssembly. From 30.0.0 to 36.0.8, 43.0.2, and 44.0.1, Wasmtime's allocation logic for a WebAssembly table contained checked arithmetic which panicked … | May 14, 2026 |
| CVE-2026-42881 | UNKNOWN | — | STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges … | May 14, 2026 |
| CVE-2026-42559 | HIGH | 8.8 | RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not … | May 14, 2026 |
| CVE-2026-42457 | CRITICAL | 9.0 | vCluster Platform provides a Kubernetes platform for managing virtual clusters, multi-tenancy, and cluster sharing. Prior to 4.4.3, 4.5.5, 4.6.2, 4.7.1, and 4.8.0, there is a … | May 14, 2026 |
| CVE-2026-42186 | UNKNOWN | — | OpenBao is an open source identity-based secrets management system. Prior to 2.5.3, when OpenBao's initial namespace deletion fails, subsequent retries fail to properly remove all … | May 14, 2026 |
| CVE-2026-41937 | HIGH | 7.2 | Vvveb before 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading … | May 14, 2026 |
| CVE-2026-41935 | HIGH | 7.1 | Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion … | May 14, 2026 |
| CVE-2026-41933 | MEDIUM | 5.3 | Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by accessing multiple paths lacking proper … | May 14, 2026 |
| CVE-2026-41932 | MEDIUM | 6.1 | Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow where the Signup::addUser() controller copies raw POST username values into the … | May 14, 2026 |
| CVE-2026-24712 | UNKNOWN | — | Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection. | May 14, 2026 |
| CVE-2026-24711 | UNKNOWN | — | Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control. | May 14, 2026 |
| CVE-2026-24710 | MEDIUM | 6.1 | Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS. | May 14, 2026 |
| CVE-2026-21730 | UNKNOWN | — | Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login logging mechanism. When an unauthenticated remote attacker attempts to log in using … | May 14, 2026 |
| CVE-2025-69443 | UNKNOWN | — | Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf of the … | May 14, 2026 |
| CVE-2025-62628 | UNKNOWN | — | Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potentially resulting in arbitrary code execution. | May 14, 2026 |
| CVE-2025-62625 | UNKNOWN | — | Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthorized access … | May 14, 2026 |
| CVE-2025-62619 | UNKNOWN | — | Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, potentially leading … | May 14, 2026 |
| CVE-2026-6638 | LOW | 3.7 | SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. … | May 14, 2026 |
| CVE-2026-6637 | HIGH | 8.8 | Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A … | May 14, 2026 |
| CVE-2026-6575 | MEDIUM | 4.3 | Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows … | May 14, 2026 |