Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
28433
Total
2190
Critical
8535
High
8856
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-45332 | HIGH | 7.5 | Automad is a flat-file content management system and template engine. From 2.0.0-alpha.1 to 2.0.0-beta.27, a Broken Access Control vulnerability allows an unauthenticated attacker to retrieve … | May 28, 2026 |
| CVE-2026-45044 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the admin router explicitly whitelists /profile/cpu and /profile/memory from the authentication layer, … | May 28, 2026 |
| CVE-2026-45042 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, improper authorization in the UploadPartCopy operation allows copying objects across buckets without … | May 28, 2026 |
| CVE-2026-45041 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, crates/appauth/src/token.rs ships a 2048-bit RSA private key as a string constant named … | May 28, 2026 |
| CVE-2026-45040 | UNKNOWN | — | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, RustFS suffers from sensitive information leakage in log outputs. When the server … | May 28, 2026 |
| CVE-2026-45039 | CRITICAL | 9.8 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.2, the internode RPC layer authenticates every request with an HMAC-SHA256 signature using … | May 28, 2026 |
| CVE-2026-44394 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly … | May 28, 2026 |
| CVE-2026-43979 | MEDIUM | 5.0 | Local Deep Research is an AI-powered research assistant for deep, iterative research. Prior to 1.6.0, PDFService._markdown_to_html() constructs an HTML document by interpolating user-controlled values — … | May 28, 2026 |
| CVE-2026-43000 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an attacker with the member role on a … | May 28, 2026 |
| CVE-2026-42999 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the raw JSON request body into the … | May 28, 2026 |
| CVE-2026-42998 | MEDIUM | 6.0 | An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication … | May 28, 2026 |
| CVE-2026-30761 | HIGH | 7.3 | An arbitrary file upload vulnerability in the pages/admin.uploadmapimg.php component of SourceBans Material Admin v1.1.6 allows attackers to execute arbitrary code via uploading a crafted image … | May 28, 2026 |
| CVE-2026-30760 | HIGH | 7.3 | An issue in SourceBans Material Admin before v.1.1.6 (3ecd95e) allows attackers to manipulate arbitrary user data in the web app via a crafted XAJAX call. | May 28, 2026 |
| CVE-2026-46561 | MEDIUM | 5.0 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the PREREQFUNCTION-based private IP check was not applied to HTTPRequest (used … | May 28, 2026 |
| CVE-2026-45787 | UNKNOWN | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.9.5, deterministic AES-192-CBC with a fixed zero IV, constant KDF salt, and no MAC leads to confidentiality … | May 28, 2026 |
| CVE-2026-45374 | CRITICAL | 9.6 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, the task_create tool spawns durable sub-agents that inherit two insecure defaults, allow_shell … | May 28, 2026 |
| CVE-2026-45373 | HIGH | 7.4 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.26, although SSRF is validated against hostnames that resolve to private IPv6 addresses, … | May 28, 2026 |
| CVE-2026-45353 | UNKNOWN | — | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0. | May 28, 2026 |
| CVE-2026-45348 | HIGH | 8.7 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into … | May 28, 2026 |
| CVE-2026-45323 | CRITICAL | 9.6 | MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node … | May 28, 2026 |
| CVE-2026-45311 | CRITICAL | 9.6 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. From 0.3.0 to 0.8.23, the run_tests tool executes cargo test in the workspace with ApprovalRequirement::Auto, … | May 28, 2026 |
| CVE-2026-45310 | HIGH | 7.4 | CodeWhale is a DeepSeek + MiMo coding agent in terminal. Prior to 0.8.22, the fetch_url tool validates the initial URL's resolved IP address against a … | May 28, 2026 |
| CVE-2026-45307 | MEDIUM | 6.1 | Speakr is a personal, self-hosted web application designed for transcribing audio recordings. Prior to 0.8.20-alpha, the is_safe_url() helper used to validate post-login redirect targets applied … | May 28, 2026 |
| CVE-2026-45306 | MEDIUM | 6.5 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the fix for CVE-2026-33509 prevents setting storage_folder inside PKGDIR or userdir, … | May 28, 2026 |
| CVE-2026-45297 | UNKNOWN | — | OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via {project_id} case mismatch. ProjectAuthorizer.__call__ … | May 28, 2026 |