Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
28078
Total
2162
Critical
8456
High
8753
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-33975 | UNKNOWN | — | Twenty is an open source CRM built with NestJS (Node.js). In versions 1.18.0 and earlier, the SSRF protection in twenty-server's SecureHttpClientService can be bypassed using … | May 05, 2026 |
| CVE-2026-33489 | UNKNOWN | — | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a … | May 05, 2026 |
| CVE-2026-33420 | UNKNOWN | — | Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details) is missing the has_full_access() authorization check that … | May 05, 2026 |
| CVE-2026-33324 | UNKNOWN | — | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to … | May 05, 2026 |
| CVE-2026-33190 | UNKNOWN | — | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the tsig plugin can be bypassed on non-plain-DNS transports (DoT, DoH, DoH3, … | May 05, 2026 |
| CVE-2026-32936 | UNKNOWN | — | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-HTTPS (DoH) GET path accepts oversized dns= query parameter values and … | May 05, 2026 |
| CVE-2026-32934 | UNKNOWN | — | CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the DNS-over-QUIC (DoQ) server can be driven into unbounded goroutine and memory … | May 05, 2026 |
| CVE-2026-32699 | UNKNOWN | — | FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter during a POST … | May 05, 2026 |
| CVE-2026-32603 | UNKNOWN | — | Sandboxie is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, a local denial of service vulnerability exists in the Sandboxie … | May 05, 2026 |
| CVE-2026-31893 | UNKNOWN | — | Tunnelblick is an open source graphic user interface for OpenVPN on macOS. In versions 3.3beta26 through 9.0beta01, any local user can read arbitrary root-owned files … | May 05, 2026 |
| CVE-2024-52911 | HIGH | 7.5 | Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. The earliest affected version is 0.14. | May 05, 2026 |
| CVE-2026-7855 | HIGH | 8.8 | A vulnerability was detected in D-Link DI-8100 16.07.26A1. Affected by this issue is the function tggl_asp of the file /tggl.asp of the component HTTP Request … | May 05, 2026 |
| CVE-2026-7854 | CRITICAL | 9.8 | A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function url_rule_asp of the file /url_rule.asp of the component … | May 05, 2026 |
| CVE-2026-42997 | HIGH | 7.7 | An issue was discovered in idrac in OpenStack Ironic before 35.0.1. During import, a user invoking molds can request authorization to be sent to a … | May 05, 2026 |
| CVE-2026-38428 | CRITICAL | 9.8 | Kestra v1.3.3 and before is vulnerable to SQL Injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL … | May 05, 2026 |
| CVE-2026-31835 | UNKNOWN | — | Vaultwarden is a Bitwarden-compatible server written in Rust. In versions 1.35.4 and earlier, the WebAuthn authentication flow in `validate_webauthn_login()` updates persistent credential metadata (1backup_eligible1 and … | May 05, 2026 |
| CVE-2026-30923 | UNKNOWN | — | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Libmodsecurity is one component of the ModSecurity v3 … | May 05, 2026 |
| CVE-2026-27960 | CRITICAL | 9.8 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. In versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability … | May 05, 2026 |
| CVE-2026-7853 | CRITICAL | 9.8 | A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp of the component HTTP Handler. This manipulation … | May 05, 2026 |
| CVE-2026-7851 | HIGH | 7.2 | A vulnerability was identified in D-Link DI-8100 16.07.26A1. This affects the function sprintf of the file yyxz.asp. The manipulation of the argument ID leads to … | May 05, 2026 |
| CVE-2026-7847 | LOW | 2.6 | A vulnerability was found in chatchat-space Langchain-Chatchat up to 0.3.1.3. The affected element is the function _get_file_id of the file libs/chatchat-server/chatchat/server/api_server/openai_routes.py of the component Uploaded … | May 05, 2026 |
| CVE-2026-43002 | MEDIUM | 5.3 | An issue was discovered in OpenStack Horizon 25.6 and 25.7 before 25.7.3. There is a write operation to the session storage backend before authentication and … | May 05, 2026 |
| CVE-2026-38432 | MEDIUM | 6.1 | ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email … | May 05, 2026 |
| CVE-2026-38431 | CRITICAL | 9.8 | ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions … | May 05, 2026 |
| CVE-2026-38429 | UNKNOWN | — | OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied … | May 05, 2026 |