Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
30387
Total
2427
Critical
9093
High
9467
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-4872 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Apr 21, 2026 |
| CVE-2026-4821 | UNKNOWN | — | An improper neutralization of special elements vulnerability was identified in GitHub Enterprise Server that allowed an authenticated Management Console administrator to execute arbitrary OS commands … | Apr 21, 2026 |
| CVE-2026-4296 | UNKNOWN | — | An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect URI validation. An attacker with knowledge … | Apr 21, 2026 |
| CVE-2026-41063 | MEDIUM | 5.4 | WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete XSS fix in AVideo's `ParsedownSafeWithLinks` class overrides `inlineMarkup` for raw … | Apr 21, 2026 |
| CVE-2026-41062 | MEDIUM | 6.5 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fix introduced in commit 2375eb5e0 for `objects/aVideoEncoderReceiveImage.json.php` only checks … | Apr 21, 2026 |
| CVE-2026-41061 | MEDIUM | 5.4 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isValidDuration()` regex at `objects/video.php:918` uses `/^[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}/` without a `$` end anchor, … | Apr 21, 2026 |
| CVE-2026-41060 | HIGH | 7.7 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that … | Apr 21, 2026 |
| CVE-2026-41058 | HIGH | 8.1 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVideo's CloneSite `deleteDump` parameter does not apply path … | Apr 21, 2026 |
| CVE-2026-41057 | HIGH | 7.1 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e64aad` is incomplete. Two separate … | Apr 21, 2026 |
| CVE-2026-41056 | HIGH | 8.1 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll=true)` function in `objects/functions.php` reflects any arbitrary `Origin` header back in … | Apr 21, 2026 |
| CVE-2026-41055 | HIGH | 8.6 | WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but … | Apr 21, 2026 |
| CVE-2026-40935 | MEDIUM | 5.3 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/getCaptcha.php` accepts the CAPTCHA length (`ql`) directly from the query string with … | Apr 21, 2026 |
| CVE-2026-40929 | MEDIUM | 5.4 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no … | Apr 21, 2026 |
| CVE-2026-40928 | MEDIUM | 5.4 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and … | Apr 21, 2026 |
| CVE-2026-40926 | HIGH | 7.1 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — `objects/categoryAddNew.json.php`, `objects/categoryDelete.json.php`, and `objects/pluginRunUpdateScript.json.php` — enforce only … | Apr 21, 2026 |
| CVE-2026-3307 | UNKNOWN | — | An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning … | Apr 21, 2026 |
| CVE-2026-6832 | HIGH | 8.1 | Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint that allows authenticated attackers to delete files outside the session directory by supplying … | Apr 21, 2026 |
| CVE-2026-6830 | LOW | 3.3 | nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next … | Apr 21, 2026 |
| CVE-2026-6829 | MEDIUM | 6.3 | nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspace to an arbitrary existing directory on disk … | Apr 21, 2026 |
| CVE-2026-6799 | MEDIUM | 6.3 | A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is some unknown functionality of the file /cgi-bin/mbox-config?method=SET§ion=ping_config of the component … | Apr 21, 2026 |
| CVE-2026-41527 | MEDIUM | 6.9 | KDE Kleopatra before 26.08.0 on Windows allows local users to obtain the privileges of a Kleopatra user, because there is an error in the mechanism … | Apr 21, 2026 |
| CVE-2026-40946 | UNKNOWN | — | Oxia is a metadata store and coordination system. Prior to 0.16.2, the OIDC authentication provider unconditionally sets SkipClientIDCheck: true in the go-oidc verifier configuration, disabling … | Apr 21, 2026 |
| CVE-2026-40945 | UNKNOWN | — | Oxia is a metadata store and coordination system. Prior to 0.16.2, when OIDC authentication fails, the full bearer token is logged at DEBUG level in … | Apr 21, 2026 |
| CVE-2026-40944 | UNKNOWN | — | Oxia is a metadata store and coordination system. Prior to 0.16.2, the trustedCertPool() function in the TLS configuration only parses the first PEM block from … | Apr 21, 2026 |
| CVE-2026-40943 | UNKNOWN | — | Oxia is a metadata store and coordination system. Prior to 0.16.2, a race condition between session heartbeat processing and session closure can cause the server … | Apr 21, 2026 |