Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
8.5 HIGH
CVE-2026-41455 — WeKan < 8.35 SSRF via Webhook URL

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the url schema field accepts any string without protocol restriction or destination va…

Remote | Server-Side Request Forgery
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
8.7 HIGH
CVE-2026-41454 — WeKan < 8.35 Missing Authorization via Integration REST API

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privile…

Remote | Authorization
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
4.8 MEDIUM
CVE-2026-41314 — pypdf: Manipulated FlateDecode image dimensions can exhaust RAM

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires…

| Denial of Service
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
4.8 MEDIUM
CVE-2026-41313 — pypdf: Possible long runtimes for wrong size values in incremental mode

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to long runtimes. This requires loading a…

| Denial of Service
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
4.8 MEDIUM
CVE-2026-41312 — pypdf: Manipulated FlateDecode predictor parameters can exhaust RAM

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.2 can craft a PDF which leads to the RAM being exhausted. This requires…

| Denial of Service
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
5.5 MEDIUM
CVE-2026-41177 — Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interact…

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the Squidex Restore API is vulnerable to Blind Server-Side Request Forgery (SSRF). Th…

Remote | Server-Side Request Forgery
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
8.1 HIGH
CVE-2026-41175 — Statamic: Unsafe method invocation via query value resolution allows data destruction

Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.20 and 6.13.0, manipulating query parameters on Control Panel and REST API endpoints, or arguments in Gra…

Remote | Authorization
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
7.3 HIGH
CVE-2026-41172 — Squidex vulnerable to Server-Side Request Forgery (SSRF) via URL-based asset upload (/api…

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, an SSRF vulnerability allows a user with asset upload permission to force the server …

Remote | Server-Side Request Forgery
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
7.3 HIGH
CVE-2026-41171 — SSRF via Jint Scripting Engine HTTP Functions Due to Missing SSRF Protection on "Jint" Ht…

Squidex is an open source headless content management system and content management hub. Versions prior to 7.23.0 have a Server-Side Request Forgery (SSRF) vulnerability due to missing SSRF protectio…

Remote | Server-Side Request Forgery
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
7.2 HIGH
CVE-2026-41170 — Squidex has SSRF via Backup Restore Endpoint — Admin-Controlled URL Download Allows Inter…

Squidex is an open source headless content management system and content management hub. Prior to version 7.23.0, the `RestoreController.PostRestoreJob` endpoint allows an administrator to supply an …

Remote | Server-Side Request Forgery
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
8.4 HIGH
CVE-2026-40517 — radare2 < 6.1.4 Command Injection via PDB Parser Symbol Names

radare2 prior to 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by crafting a malicious PDB file with …

| Injection
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
6.9 MEDIUM
CVE-2026-41168 — pypdf has possible long runtimes for wrong size values in cross-reference and object stre…

pypdf is a free and open-source pure-python PDF library. An attacker who uses a vulnerability present in versions prior to 6.10.1 can craft a PDF which leads to long runtimes. This requires cross-ref…

Remote | Denial of Service
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
9.1 CRITICAL
CVE-2026-41167 — Jellystat has SQL Injection that leads to to Remote Code Execution

Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields direct…

Remote | Injection
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
7.0 HIGH
CVE-2026-41166 — OpenRemote has Improper Access Control via updateUserRealmRoles function

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has `write:admin` in one Keycloak realm can call the Manager API to update Keycloak realm roles for users…

Remote | Authorization
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
7.3 HIGH
CVE-2026-41134 — Kiota: Code Generation Literal Injection

Kiota is an OpenAPI based HTTP Client code generator. Versions prior to 1.31.1 are affected by a code-generation literal injection vulnerability in multiple writer sinks (for example: serialization/d…

| Injection
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
8.3 HIGH
CVE-2026-40937 — RustFS missing admin authorization on notification target endpoints, which allows unauthe…

RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/handlers/event.rs` use a `check_permissions…

Remote | Authorization
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
7.6 HIGH
CVE-2026-40882 — OpenRemote has XXE in Velbus Asset Import

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.0, the Velbus asset import path parses attacker-controlled XML without explicit XXE hardening. An authenticated user wh…

Remote | XML External Entity
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
4.6 MEDIUM
CVE-2026-3837 — Frappe Framework 16.10.0 - Stored DOM XSS in Multiple Field Formatters

An authenticated attacker can persist crafted values in multiple field types and trigger client-side script execution when another user opens the affected document in Desk. The vulnerable formatter i…

Remote | Cross-Site Scripting
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
6.8 MEDIUM
CVE-2026-34068 — nimiq-transaction: UpdateValidator transactions allows voting key change without proof-of…

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, the staking contract accepts `UpdateValidator` transactions that set `new_votin…

Remote | Authentication
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
3.1 LOW
CVE-2026-34067 — nimiq-transaction vulnerable to panic via `HistoryTreeProof` length mismatch

nimiq-transaction provides the transaction primitive to be used in Nimiq's Rust implementation. Prior to version 1.3.0, `HistoryTreeProof::verify` panics on a malformed proof where `history.len() != …

Remote | Denial of Service
Apr 22, 2026 Apr 22, 2026
Apr 22, 2026
Apr 22, 2026
Showing 20 of 6460 Results