Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
13055
Total
867
Critical
3775
High
4128
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-40177 | UNKNOWN | — | ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass … | Apr 10, 2026 |
| CVE-2026-40175 | CRITICAL | 10.0 | Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0, the Axios library is vulnerable to a specific "Gadget" attack … | Apr 10, 2026 |
| CVE-2026-40168 | HIGH | 8.2 | Postiz is an AI social media scheduling tool. Prior to 2.21.5, the /api/public/stream endpoint is vulnerable to SSRF. Although the application validates the initially supplied … | Apr 10, 2026 |
| CVE-2026-39922 | UNKNOWN | — | GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability in the service registration endpoint that allows authenticated attackers to … | Apr 10, 2026 |
| CVE-2026-39921 | UNKNOWN | — | GeoNode versions 4.0 before 4.4.5 and 5.0 before 5.0.2 contain a server-side request forgery vulnerability that allows authenticated users with document upload permissions to trigger … | Apr 10, 2026 |
| CVE-2026-32252 | HIGH | 7.7 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.9.0, a … | Apr 10, 2026 |
| CVE-2026-30232 | UNKNOWN | — | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 4.8.5, Chartbrew … | Apr 10, 2026 |
| CVE-2026-3446 | UNKNOWN | — | When calling base64.b64decode() or related functions the decoding process would stop after encountering the first padded quad regardless of whether there was more information to … | Apr 10, 2026 |
| CVE-2026-33737 | MEDIUM | 5.3 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, multiple files use simplexml_load_string() without XXE protection. With LIBXML_NOENT flag, arbitrary server files … | Apr 10, 2026 |
| CVE-2026-33736 | MEDIUM | 6.5 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, any authenticated user (including ROLE_STUDENT) can enumerate all platform users and access personal information (email, … | Apr 10, 2026 |
| CVE-2026-33710 | HIGH | 7.5 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, REST API keys are generated using md5(time() + (user_id * 5) - rand(10000, … | Apr 10, 2026 |
| CVE-2026-33708 | MEDIUM | 6.5 | Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first name, last name, user ID, … | Apr 10, 2026 |
| CVE-2026-33707 | CRITICAL | 9.4 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, the default password reset mechanism generates tokens using sha1($email) with no random component, … | Apr 10, 2026 |
| CVE-2026-33706 | HIGH | 7.1 | Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user with a REST API key can modify their own status field via … | Apr 10, 2026 |
| CVE-2026-33705 | MEDIUM | 5.3 | Chamilo LMS is a learning management system. Prior to 1.11.38, Twig template files (.tpl) under /main/template/default/ are directly accessible without authentication via HTTP GET requests. … | Apr 10, 2026 |
| CVE-2026-33704 | HIGH | 7.1 | Chamilo LMS is a learning management system. Prior to 1.11.38, any authenticated user (including students) can write arbitrary content to files on the server via … | Apr 10, 2026 |
| CVE-2026-33703 | UNKNOWN | — | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the /social-network/personal-data/{userId} endpoint allows any authenticated user … | Apr 10, 2026 |
| CVE-2026-33702 | HIGH | 7.1 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an Insecure Direct Object Reference (IDOR) vulnerability in the Learning … | Apr 10, 2026 |
| CVE-2026-33698 | UNKNOWN | — | Chamilo LMS is a learning management system. Prior to 1.11.38, a chained attack can enable otherwise-blocked PHP code from the main/install/ directory and allow an … | Apr 10, 2026 |
| CVE-2026-33618 | HIGH | 8.8 | Chamilo LMS is a learning management system. Prior to .0.0-RC.3, the PlatformConfigurationController::decodeSettingArray() method uses PHP's eval() to parse platform settings from the database. An attacker … | Apr 10, 2026 |
| CVE-2026-27460 | MEDIUM | 6.5 | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.5, a critical Denial of Service (DoS) vulnerability was … | Apr 10, 2026 |
| CVE-2026-5483 | HIGH | 8.5 | A flaw was found in odh-dashboard in Red Hat Openshift AI. This vulnerability in the `odh-dashboard` component of Red Hat OpenShift AI (RHOAI) allows for … | Apr 10, 2026 |
| CVE-2026-40163 | HIGH | 8.2 | Saltcorn is an extensible, open source, no-code database application builder. Prior to 1.4.5, 1.5.5, and 1.6.0-beta.4, the POST /sync/offline_changes endpoint allows an unauthenticated attacker to … | Apr 10, 2026 |
| CVE-2026-40162 | HIGH | 7.1 | Bugsink is a self-hosted error tracking tool. In 2.1.0, an authenticated file write vulnerability was identified in Bugsink 2.1.0 in the artifact bundle assembly flow. … | Apr 10, 2026 |
| CVE-2026-33141 | MEDIUM | 6.5 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allows any … | Apr 10, 2026 |