Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
28363
Total
2182
Critical
8512
High
8835
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-47326 | MEDIUM | 5.5 | Ubuntu Linux 6.8, 6.17 and 7.0 contain SAUCE patches with a memory leak in the handling of big responses to AppArmor notifications. The bug can … | May 28, 2026 |
| CVE-2026-47136 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the RustFS console endpoint GET /rustfs/console/license returns parsed license metadata without requiring … | May 28, 2026 |
| CVE-2026-46685 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, when RUSTFS_CORS_ALLOWED_ORIGINS is unset, the RustFS S3 listener's ConditionalCorsLayer reflects any request … | May 28, 2026 |
| CVE-2026-46526 | MEDIUM | 5.0 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.10, the URL checking logic in local-deep-research has a logical flaw … | May 28, 2026 |
| CVE-2026-46509 | HIGH | 8.2 | deepobj provides get, set, delete deep objects in javascript. Prior to 1.0.3, prototype pollution is possible when property paths contain __proto__/constructor/prototype. The property path must … | May 28, 2026 |
| CVE-2026-45332 | HIGH | 7.5 | Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve … | May 28, 2026 |
| CVE-2026-45044 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, … | May 28, 2026 |
| CVE-2026-45042 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the UploadPartCopy operation allows copying objects across buckets without … | May 28, 2026 |
| CVE-2026-45041 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named … | May 28, 2026 |
| CVE-2026-45040 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the server … | May 28, 2026 |
| CVE-2026-45039 | CRITICAL | 9.8 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using … | May 28, 2026 |
| CVE-2026-44394 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly … | May 28, 2026 |
| CVE-2026-43979 | MEDIUM | 5.0 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdown_to_html() constructs an HTML document by interpolating user-controlled values — … | May 28, 2026 |
| CVE-2026-43000 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a … | May 28, 2026 |
| CVE-2026-42999 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the … | May 28, 2026 |
| CVE-2026-42998 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication … | May 28, 2026 |
| CVE-2026-30761 | HIGH | 7.3 | An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to execute arbitrary code via uploading a crafted image … | May 28, 2026 |
| CVE-2026-30760 | HIGH | 7.3 | An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a crafted XAJAX call. | May 28, 2026 |
| CVE-2026-46561 | MEDIUM | 5.0 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based private IP check was not applied to HTTPRequest (used … | May 28, 2026 |
| CVE-2026-45787 | UNKNOWN | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality … | May 28, 2026 |
| CVE-2026-45374 | CRITICAL | 9.6 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell … | May 28, 2026 |
| CVE-2026-45373 | HIGH | 7.4 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, … | May 28, 2026 |
| CVE-2026-45353 | UNKNOWN | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0. | May 28, 2026 |
| CVE-2026-45348 | HIGH | 8.7 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into … | May 28, 2026 |
| CVE-2026-45323 | CRITICAL | 9.6 | MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node … | May 28, 2026 |