Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
28438
Total
2190
Critical
8535
High
8856
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-32995 | HIGH | 7.5 | The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it directly … | May 28, 2026 |
| CVE-2026-2374 | HIGH | 7.2 | The Login No Captcha reCAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `$_SERVER['PHP_SELF']` superglobal in all versions up to, and including, … | May 28, 2026 |
| CVE-2026-9789 | UNKNOWN | — | A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to 3.01.3052. The vulnerability stems from the the PSAdminAgent service, which creates a … | May 28, 2026 |
| CVE-2026-8915 | HIGH | 8.8 | Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers. This issue affects Escargot: 36f5fb58366a67b713c02f6fd985e924fcc09e31. | May 28, 2026 |
| CVE-2026-4888 | MEDIUM | 4.3 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to … | May 28, 2026 |
| CVE-2026-9739 | UNKNOWN | — | Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. … | May 27, 2026 |
| CVE-2026-46544 | MEDIUM | 5.3 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO accepts client-supplied session_id values in WebSocket task messages and reuses … | May 27, 2026 |
| CVE-2026-46538 | MEDIUM | 5.9 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's constellation client tracks pending task responses by session_id only and … | May 27, 2026 |
| CVE-2026-46416 | MEDIUM | 6.3 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocketHandler instance and reuses it for multiple … | May 27, 2026 |
| CVE-2026-46414 | HIGH | 8.8 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trusts client-supplied identity and role fields in … | May 27, 2026 |
| CVE-2026-46402 | HIGH | 8.1 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_name value directly when constructing session log … | May 27, 2026 |
| CVE-2026-45322 | HIGH | 7.8 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection … | May 27, 2026 |
| CVE-2026-9208 | HIGH | 8.8 | Tanium addressed an unauthorized code execution vulnerability in Connect. | May 27, 2026 |
| CVE-2026-45152 | HIGH | 7.8 | uniget is a universal installer and updater for (container) tools. Prior to 0.27.1, a command injection vulnerability exists in uniget due to unsafe execution of … | May 27, 2026 |
| CVE-2026-45083 | CRITICAL | 9.8 | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi … | May 27, 2026 |
| CVE-2026-44720 | UNKNOWN | — | OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access … | May 27, 2026 |
| CVE-2026-44247 | MEDIUM | 6.8 | Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming … | May 27, 2026 |
| CVE-2026-47270 | MEDIUM | 6.3 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb is a PAM module loaded into the host process (sudo, login, … | May 27, 2026 |
| CVE-2026-47269 | HIGH | 7.4 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.9.0, pam_usb's deny_remote feature checks utmpx ut_addr_v6 to detect whether an authentication request … | May 27, 2026 |
| CVE-2026-45137 | HIGH | 8.2 | Anchor is a framework providing several convenient developer tools for writing Solana programs. From 1.0.0 to before 1.0.2, an logic error causes anchor programs to … | May 27, 2026 |
| CVE-2026-45136 | UNKNOWN | — | claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh (introduced in v3.5.0) interpolates Claude Code's hook stdin payload directly … | May 27, 2026 |
| CVE-2026-44713 | HIGH | 8.8 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/tmux.c reads the user's $TMUX environment variable, splits it on commas, and … | May 27, 2026 |
| CVE-2026-44712 | HIGH | 8.2 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, a crafted UUID such as $(id>/tmp/rce) in the config causes root RCE … | May 27, 2026 |
| CVE-2026-44711 | HIGH | 7.9 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, symlink attacks on pad directory and pad files enable authentication bypass and … | May 27, 2026 |
| CVE-2026-44710 | MEDIUM | 4.6 | pam_usb provides hardware authentication for Linux using ordinary removable media. Prior to 0.8.7, src/device.c passed the return values of udisks_drive_get_serial(), udisks_drive_get_vendor(), and udisks_drive_get_model() directly to … | May 27, 2026 |