Total CVEs

139,442

Critical Severity

3,643

High Severity

13,079

Last 7 Days

1,413
Quick preset (or use dates below)
Clear Filters
Showing 3,321 - 3,340 of 13,079 CVEs
CVE-2026-46597 HIGH - 7.5

An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.

Vendor: golang.org/x/crypto
Product: golang.org/x/crypto/ssh
Published: May 22, 2026
Source: NVD
CVE-2026-39829 HIGH - 7.5

The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key...

Vendor: golang.org/x/crypto
Product: golang.org/x/crypto/ssh
Published: May 22, 2026
Source: NVD
CVE-2026-34911 HIGH - 7.7

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information.

Published: May 22, 2026
Source: NVD
CVE-2026-46701 HIGH - 7.6

Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

Vendor: npm
Product: network-ai
Published: May 21, 2026
Source: GitHub
CVE-2026-8434 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Y...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8433 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan D...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8432 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Dro...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8427 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N....

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8416 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id). The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Th...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8415 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Tha...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8414 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan ...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8413 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8412 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8411 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8410 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete.  The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yo...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-8409 HIGH - 8.8

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete.  The The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

Vendor: concretecms
Product: concrete_cms
Published: May 21, 2026
Source: NVD
CVE-2026-46681 HIGH

@nevware21/ts-utils: Prototype Pollution in objDeepCopy/objCopyProps via for...in without hasOwnProperty

Vendor: npm
Product: @nevware21/ts-utils
Published: May 21, 2026
Source: GitHub
CVE-2026-46680 HIGH

containerd user ID handling bypass allows runAsNonRoot evasion

Vendor: go
Product: github.com/containerd/containerd
Published: May 21, 2026
Source: GitHub
CVE-2026-46679 HIGH - 7.5

libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.js heap of any gossipsub node with default options. This issue has been patched in version 15.0.23.

Vendor: npm
Product: @libp2p/gossipsub
Published: May 21, 2026
Source: GitHub
CVE-2026-46640 HIGH

Twig: Arbitrary PHP code execution via `_self.(<string>)` macro-reference compilation

Vendor: composer
Product: twig/twig
Published: May 21, 2026
Source: GitHub