Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
6.5 MEDIUM
CVE-2026-5470 — mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extract…

A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractC…

Remote | Server-Side Request Forgery
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
8.7 HIGH
CVE-2026-35218 — Budibase: Stored XSS via unsanitized entity names rendered with {@html} in Builder Comman…

Budibase is an open-source low-code platform. Prior to version 3.32.5, Budibase's Builder Command Palette renders entity names (tables, views, queries, automations) using Svelte's {@html} directive w…

Remote | Cross-Site Scripting
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
9.0 CRITICAL
CVE-2026-35216 — Budibase: Unauthenticated Remote Code Execution via Webhook Trigger and Bash Automation S…

Budibase is an open-source low-code platform. Prior to version 3.33.4, an unauthenticated attacker can achieve Remote Code Execution (RCE) on the Budibase server by triggering an automation that cont…

Remote | Authentication
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
8.7 HIGH
CVE-2026-35214 — Budibase: Path traversal in plugin file upload enables arbitrary directory deletion and f…

Budibase is an open-source low-code platform. Prior to version 3.33.4, the plugin file upload endpoint (POST /api/plugin/upload) passes the user-supplied filename directly to createTempFolder() witho…

Remote | Path Traversal
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
9.6 CRITICAL
CVE-2026-31818 — Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist

Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase's REST datasource connector. The platform's SSRF protectio…

Remote | Server-Side Request Forgery
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31404 — NFSD: Defer sub-object cleanup in export put callbacks

In the Linux kernel, the following vulnerability has been resolved: NFSD: Defer sub-object cleanup in export put callbacks svc_export_put() calls path_put() and auth_domain_put() immediately when t…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31403 — NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd

In the Linux kernel, the following vulnerability has been resolved: NFSD: Hold net reference for the lifetime of /proc/fs/nfs/exports fd The /proc/fs/nfs/exports proc entry is created at module ini…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31402 — nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache The NFSv4.0 replay cache uses a fixed 112-byte inline buffer (rp_ibuf[NFSD4_…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31401 — HID: bpf: prevent buffer overflow in hid_hw_request

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: prevent buffer overflow in hid_hw_request right now the returned value is considered to be always valid. However, when …

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31400 — sunrpc: fix cache_request leak in cache_release

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix cache_request leak in cache_release When a reader's file descriptor is closed while in the middle of reading a cache_…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31399 — nvdimm/bus: Fix potential use after free in asynchronous initialization

In the Linux kernel, the following vulnerability has been resolved: nvdimm/bus: Fix potential use after free in asynchronous initialization Dingisoul with KASAN reports a use after free if device_a…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31398 — mm/rmap: fix incorrect pte restoration for lazyfree folios

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix incorrect pte restoration for lazyfree folios We batch unmap anonymous lazyfree folios by folio_unmap_pte_batch. If…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31397 — mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd()

In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix use of NULL folio in move_pages_huge_pmd() move_pages_huge_pmd() handles UFFDIO_MOVE for both normal THPs and…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31396 — net: macb: fix use-after-free access to PTP clock

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix use-after-free access to PTP clock PTP clock is registered on every opening of the interface and destroyed on ever…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31395 — bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix OOB access in DBG_BUF_PRODUCER async event handler The ASYNC_EVENT_CMPL_EVENT_ID_DBG_BUF_PRODUCER handler in bnxt_as…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31394 — mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations

In the Linux kernel, the following vulnerability has been resolved: mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations ieee80211_chan_bw_change() iterates all stations and accesse…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31393 — Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access l2cap_information_rsp() checks that cmd_len covers the fix…

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31392 — smb: client: fix krb5 mount with username option

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix krb5 mount with username option Customer reported that some of their krb5 mounts were failing against a single s…

| Authentication
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31391 — crypto: atmel-sha204a - Fix OOM ->tfm_count leak

In the Linux kernel, the following vulnerability has been resolved: crypto: atmel-sha204a - Fix OOM ->tfm_count leak If memory allocation fails, decrement ->tfm_count to avoid blocking future reads.

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
0.0 NA
CVE-2026-31390 — drm/xe: Fix memory leak in xe_vm_madvise_ioctl

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix memory leak in xe_vm_madvise_ioctl When check_bo_args_are_sane() validation fails, jump to the new free_vmas cleanup …

| Memory Corruption
Apr 03, 2026 Apr 03, 2026
Apr 03, 2026
Apr 03, 2026
Showing 20 of 6329 Results