Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
26832
Total
1978
Critical
8053
High
8297
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-47838 | MEDIUM | 6.8 | SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully … | Jun 10, 2026 |
| CVE-2026-46545 | HIGH | 7.5 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote, unauthenticated denial-of-service vulnerability … | Jun 10, 2026 |
| CVE-2026-46543 | MEDIUM | 5.3 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote peer can crash … | Jun 10, 2026 |
| CVE-2026-46542 | MEDIUM | 4.3 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a denial-of-service vulnerability exists in … | Jun 10, 2026 |
| CVE-2026-46541 | HIGH | 7.5 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, iIn handle_dht_get(), the DhtResults accumulator … | Jun 10, 2026 |
| CVE-2026-46540 | MEDIUM | 6.5 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, when LightBlockchain::rebranch() adopts a fork … | Jun 10, 2026 |
| CVE-2026-46539 | MEDIUM | 5.9 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, a logic flaw in BlockInclusionProof::is_block_proven … | Jun 10, 2026 |
| CVE-2026-46518 | HIGH | 7.7 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in … | Jun 10, 2026 |
| CVE-2026-46517 | HIGH | 7.8 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user … | Jun 10, 2026 |
| CVE-2026-46491 | HIGH | 8.6 | SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. Prior to version 7.0.3, simplesamlphp-module-casserver builds file paths … | Jun 10, 2026 |
| CVE-2026-46432 | HIGH | 7.8 | LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, LMDeploy is vulnerable to arbitrary code execution through … | Jun 10, 2026 |
| CVE-2026-46411 | MEDIUM | 6.5 | FlashMQ is a MQTT broker/server, designed for multi-CPU environments. Prior to version 1.26.2, authorized clients have the ability to exceed the permitted over-commit of their … | Jun 10, 2026 |
| CVE-2026-45782 | UNKNOWN | — | Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. From version 21.0 to before version 51.2, a guest can cause a use-after-free in the … | Jun 10, 2026 |
| CVE-2026-44716 | HIGH | 7.5 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From version 0.0.90 to before version 1.2.0, a path traversal vulnerability … | Jun 10, 2026 |
| CVE-2026-44505 | MEDIUM | 5.3 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. network-libp2p handles kad get-record query progress in handle_dht_get (network-libp2p/src/swarm.rs). … | Jun 10, 2026 |
| CVE-2026-41837 | MEDIUM | 5.3 | Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. … | Jun 10, 2026 |
| CVE-2026-41732 | HIGH | 8.1 | JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty … | Jun 10, 2026 |
| CVE-2026-41731 | HIGH | 8.1 | JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its … | Jun 10, 2026 |
| CVE-2026-41730 | MEDIUM | 5.3 | Spring Data REST serializes the full exception cause chain into HTTP error response bodies, potentially exposing persistence-layer internals to HTTP clients. Affected versions: Spring Data … | Jun 10, 2026 |
| CVE-2026-41729 | HIGH | 8.1 | Spring Data REST is vulnerable to SpEL expression injection through map-typed properties when processing JSON Patch (application/json-patch+json) requests. When a persistent entity exposes a Map-typed … | Jun 10, 2026 |
| CVE-2026-41728 | HIGH | 7.5 | Spring Data REST's JSON Patch (application/json-patch+json) implementation does not apply the write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: … | Jun 10, 2026 |
| CVE-2026-41727 | MEDIUM | 6.5 | Spring Kafka's retry topic infrastructure did not sufficiently validate user-controlled header values before acting on them. A producer could send a record with a crafted … | Jun 10, 2026 |
| CVE-2026-41726 | MEDIUM | 6.5 | When an application opts into DelegatingDeserializer, a producer can grow the consumer's heap without bound by sending records with unique random spring.kafka.serialization.selector header values, eventually … | Jun 10, 2026 |
| CVE-2026-41721 | MEDIUM | 5.9 | Spring Data Commons contains a vulnerability that can lead to a Denial of Service (DoS) condition if Spring Data Web Support is enabled in conjunction … | Jun 10, 2026 |
| CVE-2026-41719 | MEDIUM | 6.4 | A SpEL Injection vulnerability exists in the Spring Data KeyValue if unsanitized user input is passed as Sort into a repository query method that delegates … | Jun 10, 2026 |