Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
4.8 MEDIUM
CVE-2026-40606 — ProxyAuth Addon LDAP Injection in mitmproxy

mitmproxy is a interactive TLS-capable intercepting HTTP proxy for penetration testers and software developers and mitmweb is a web-based interface for mitmproxy. In mitmproxy 12.2.1 and below, the b…

mitmproxy | Remote | Authentication
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
8.2 HIGH
CVE-2026-40604 — ClearanceKit: opfilter system extension can be suspended or signalled by a root process, …

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.6, the opfilter Endpoint Security system extension (bundle ID uk.craigbass.clearancek…

| Denial of Service
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
5.6 MEDIUM
CVE-2026-40602 — hass-cli: Handling of user-supplied Jinja2 templates

The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates inste…

| Injection
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
8.4 HIGH
CVE-2026-40599 — ClearanceKit: Ad-hoc signed binaries can spoof Apple process identities in the global all…

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to 5.0.5, ClearanceKit incorrectly treats a process with an empty Team ID and a non-empty Si…

| Authorization
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
4.8 MEDIUM
CVE-2026-40594 — pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing…

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py reads the X-Forwa…

pyload-ng | Remote | Race Condition
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
8.1 HIGH
CVE-2026-40588 — blueprintUE: Authenticated Password Change Does Not Verify Current Password

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the password change form at /profile/{slug}/edit/ does not include a current_password field and does not verify the user's exis…

Remote | Authentication
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
6.5 MEDIUM
CVE-2026-40587 — blueprintUE: Active Sessions Are Not Invalidated After Password Change or Reset

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a user changes their password via the profile edit page, or when a password reset is completed via the reset link, neither…

Remote | Authentication
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
5.1 MEDIUM
CVE-2026-6743 — WebSystems WebTOTUM Calendar cross site scripting

A vulnerability has been found in WebSystems WebTOTUM 2026. This impacts an unknown function of the component Calendar. The manipulation leads to cross site scripting. The attack may be initiated rem…

Remote | Cross-Site Scripting
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
9.0 CRITICAL
CVE-2026-5652 — Authorization Bypass Through User-Controlled Key in Crafty Controller

An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permiss…

crafty_controller | Remote | Authorization
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
7.1 HIGH
CVE-2026-41191 — FreeScout's signature only mailbox permission allows unauthorized mailbox chat setting ch…

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, `MailboxesController::updateSave()` persists `chat_start_new` outside the allowed-field filter. A user with onl…

Remote | Authorization
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
7.1 HIGH
CVE-2026-41190 — FreeScout has assigned-only visibility bypass via save_draft that allows hidden conversat…

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, when `APP_SHOW_ONLY_ASSIGNED_CONVERSATIONS` is enabled, direct conversation view correctly blocks users who are…

Remote | Authorization
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
7.1 HIGH
CVE-2026-41189 — FreeScout has assigned-only visibility bypass that allows editing hidden customer-authore…

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, customer-thread editing is authorized through `ThreadPolicy::edit()`, which checks mailbox access but does not …

Remote | Authorization
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
4.3 MEDIUM
CVE-2026-41183 — FreeScout allows non-folder conversation queries to disclose assigned-only hidden convers…

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the assigned-only restriction is applied to direct conversation view and folder queries, but not to non-folder …

Remote | Authorization
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
5.9 MEDIUM
CVE-2026-40592 — FreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound…

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks only whether the current user can view th…

Remote | Authorization
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
7.1 HIGH
CVE-2026-40591 — FreeScout: Improper Authorization in Phone Conversation Creation Enables Cross-Mailbox Hi…

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the phone-conversation creation flow accepts attacker-controlled `customer_id`, `name`, `to_email`, and `phone`…

Remote | Authorization
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
4.3 MEDIUM
CVE-2026-40590 — FreeScout's Customer AJAX Create Modifies Hidden Existing Customer

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the Change Customer modal exposes a “Create a new customer” flow via POST /customers/ajax with action=create. U…

Remote | Authentication
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
7.6 HIGH
CVE-2026-40589 — FreeScout has Customer Edit Cross-Mailbox Email Takeover

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, a low-privileged agent can edit a visible customer and add an email address already owned by a hidden customer …

Remote | Authorization
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
7.5 HIGH
CVE-2026-40586 — blueprintUE: Login Endpoint Has No Rate Limiting, Lockout, or Brute-Force Protection

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, the login form handler performs no throttling of any kind. Failed authentication attempts are processed at full network speed w…

Remote | Authentication
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
7.4 HIGH
CVE-2026-40585 — blueprintUE: Password Reset Tokens Have No Expiry Window

blueprintUE is a tool to help Unreal Engine developers. Prior to 4.2.0, when a password reset is initiated, a 128-character CSPRNG token is generated and stored alongside a password_reset_at timestam…

Remote | Authentication
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
6.9 MEDIUM
CVE-2026-40584 — RansomLook - Improper Filtering of Private Location Entries in API Endpoints Leads to Inf…

RansomLook is a tool to monitor Ransomware groups and markets and extract their victims. Prior to 1.9.0, the API in the affected application improperly filters private location entries in website/web…

Remote | Information Disclosure
Apr 21, 2026 Apr 21, 2026
Apr 21, 2026
Apr 21, 2026
Showing 20 of 6316 Results