NVD Vulnerability Information Top

Show Search Menu

Vendor Name
プロダクト・サービス名
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
In descending order of publication date
In descending order of update date
Number of items displayed

NVD Vulnerability Information Top

You can search the list of vulnerabilities managed by the NVD (National Vulnerability Database).
Since vulnerability information is often updated before JVN (Japan Vulnerability Note), vulnerabilities that are not listed in JVN may be updated.

If there is a vulnerability related to JVN (Japan Vulnerability Note), the information will be displayed on the detail page.

To search by CWE, please refer to the CWE Overview and check the CWE number.

CRITICAL
HIGH
MEDIUM
LOW

Update Date:June 13, 2026, 4:20 a.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Show Affected	Exploit PoC Search
501	8.8	HIGH Network	-	-	Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker. Prior to version 6.6.1, Pi-hole FTL contains a race condition vulnerability in the HTTP session manageme… New	CWE-362 Race Condition	CVE-2026-44693	2026-06-12 02:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

502	8.6	HIGH Network	-	-	Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.… New	CWE-918 Server-Side Request Forgery (SSRF)	CVE-2026-44492	2026-06-12 02:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

503	3.7	LOW Network	-	-	Axios is a promise based HTTP client for the browser and Node.js. From 1.15.2 to before 1.16.0, nested objects created by utils.merge() (e.g., config.proxy) are still constructed as plain {} with Obj… New	CWE-113 CWE-1321 HTTP Response Splitting Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')	CVE-2026-44489	2026-06-12 02:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

504	7.5	HIGH Network	-	-	Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetc… New	CWE-770 Allocation of Resources Without Limits or Throttling	CVE-2026-44488	2026-06-12 02:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

505	-	-	-	-	Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during speci… New	CWE-201 Insertion of Sensitive Information Into Sent Data	CVE-2026-44487	2026-06-12 02:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

506	7.5	HIGH Network	-	-	Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a … New	CWE-200 Information Exposure	CVE-2026-44486	2026-06-12 02:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

507	6.4	MEDIUM Network	-	-	PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-value pair. If a superuse… New	CWE-89 SQL Injection	CVE-2026-11945	2026-06-12 02:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

508	8.1	HIGH Network	-	-	Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`. The functions `filter_safe_tarinfos()` and `fil… New	CWE-22 Path Traversal	CVE-2026-11816	2026-06-12 02:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

509	7.8	HIGH Local	adobe	indesign	InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation … Update	CWE-787 Out-of-bounds Write	CVE-2026-48293	2026-06-12 02:14	2026-06-10	Show	GitHub Exploit DB Packet Storm

510	7.8	HIGH Local	microsoft	windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2022 windows_server_2025	Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally. Update	CWE-287 Improper Authentication	CVE-2026-44810	2026-06-12 02:13	2026-06-10	Show	GitHub Exploit DB Packet Storm

511	7.8	HIGH Local	sqlite	sqlite	SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by… Update	CWE-122 Heap-based Buffer Overflow	CVE-2026-11822	2026-06-12 02:12	2026-06-10	Show	GitHub Exploit DB Packet Storm

512	7.8	HIGH Local	sqlite	sqlite	SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted… Update	CWE-122 Heap-based Buffer Overflow	CVE-2026-11824	2026-06-12 02:12	2026-06-10	Show	GitHub Exploit DB Packet Storm

513	7.8	HIGH Local	microsoft	windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2025	Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. Update	CWE-416 Use After Free	CVE-2026-44809	2026-06-12 02:07	2026-06-10	Show	GitHub Exploit DB Packet Storm

514	7.8	HIGH Local	microsoft	windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2012 windows_server_2016 w…	Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability Update	CWE-197 Numeric Truncation Error	CVE-2026-40409	2026-06-12 02:06	2026-06-10	Show	GitHub Exploit DB Packet Storm

515	7.5	HIGH Network	vmware	spring_hateoas	Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type deserializers, performs bean property binding via reflection without consult… Update	CWE-284 NVD-CWE-noinfo Improper Access Control	CVE-2026-41006	2026-06-12 02:05	2026-06-9	Show	GitHub Exploit DB Packet Storm

516	7.8	HIGH Local	microsoft	windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2012 windows_server_2016 w…	Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally. Update	CWE-284 Improper Access Control	CVE-2026-41092	2026-06-12 02:04	2026-06-10	Show	GitHub Exploit DB Packet Storm

517	7.0	HIGH Local	microsoft	windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2012 windows_server_2016 w…	Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally. Update	CWE-122 Heap-based Buffer Overflow	CVE-2026-41108	2026-06-12 02:03	2026-06-10	Show	GitHub Exploit DB Packet Storm

518	7.8	HIGH Local	microsoft	windows_11_24h2 windows_11_25h2 windows_11_26h1	Improper access control in Windows Administrator Protection allows an authorized attacker to bypass a security feature locally. Update	CWE-284 Improper Access Control	CVE-2026-42829	2026-06-12 02:02	2026-06-10	Show	GitHub Exploit DB Packet Storm

519	7.0	HIGH Local	microsoft	windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2012 windows_server_2016 w…	Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally. Update	CWE-362 CWE-416 Race Condition Use After Free	CVE-2026-42836	2026-06-12 02:01	2026-06-10	Show	GitHub Exploit DB Packet Storm

520	7.8	HIGH Local	microsoft	windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2019 windows_server_2022 windows_server_2025	Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. Update	CWE-362 CWE-416 Race Condition Use After Free	CVE-2026-42979	2026-06-12 02:00	2026-06-10	Show	GitHub Exploit DB Packet Storm

521	7.5	HIGH Network	vmware	spring_hateoas	Spring HATEOAS maintains an unbounded static cache of StringLinkRelation instances keyed on attacker-supplied strings. Affected versions: Spring HATEOAS 1.5.0 through 1.5.6; 2.3.0 through 2.3.4; 2.4… Update	CWE-770 Allocation of Resources Without Limits or Throttling	CVE-2026-41007	2026-06-12 01:58	2026-06-9	Show	GitHub Exploit DB Packet Storm

522	7.8	HIGH Local	microsoft	windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2012 windows_server_2016 w…	Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally. Update	CWE-122 CWE-191 Heap-based Buffer Overflow Integer Underflow (Wrap or Wraparound)	CVE-2026-42980	2026-06-12 01:58	2026-06-10	Show	GitHub Exploit DB Packet Storm

523	8.1	HIGH Network	microsoft	windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2022 windows_server_2025	Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network. Update	CWE-191 Integer Underflow (Wrap or Wraparound)	CVE-2026-42981	2026-06-12 01:55	2026-06-10	Show	GitHub Exploit DB Packet Storm

524	7.8	HIGH Local	microsoft	windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2019 windows_server_2022 windows_server_2025	Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. Update	CWE-416 Use After Free	CVE-2026-42983	2026-06-12 01:54	2026-06-10	Show	GitHub Exploit DB Packet Storm

525	7.5	HIGH Network	vmware	spring_framework	IDs for WebSocket sessions in the spring-websocket module are not cryptographically unpredictable, which may be possible to exploit in combination with inadequate authorization rules. Affected versi… Update	CWE-330 Use of Insufficiently Random Values	CVE-2026-41838	2026-06-12 01:53	2026-06-9	Show	GitHub Exploit DB Packet Storm

526	7.8	HIGH Local	microsoft	windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2019 windows_server_2022 windows_server_2025	Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally. Update	CWE-125 Out-of-bounds Read	CVE-2026-42837	2026-06-12 01:51	2026-06-10	Show	GitHub Exploit DB Packet Storm

527	6.1	MEDIUM Network	vmware	spring_framework	A Spring MVC or Spring WebFlux application which configures a mapping for "/**" where the view name is not explicitly specified allows an attacker to craft a link resulting in a 302 redirect to an ar… Update	CWE-601 Open Redirect	CVE-2026-41844	2026-06-12 01:19	2026-06-9	Show	GitHub Exploit DB Packet Storm

528	6.5	MEDIUM Network	microsoft	windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2012 windows_server_2016 w…	Null pointer dereference in Windows Kerberos allows an authorized attacker to deny service over a network. Update	CWE-476 NULL Pointer Dereference	CVE-2026-42903	2026-06-12 01:17	2026-06-10	Show	GitHub Exploit DB Packet Storm

529	-	-	-	-	openSIS Classic 9.3 contains an insecure direct object reference vulnerability in the messaging module. Any authenticated user with access to the messaging module can request sent-message details fro… New	CWE-639 Authorization Bypass Through User-Controlled Key	CVE-2026-8406	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

530	8.8	HIGH Network	-	-	IBM i 7.6, 7.5, 7.4, and 7.3 could allow a user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. New	CWE-427 Uncontrolled Search Path Element	CVE-2026-7870	2026-06-12 01:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

531	7.5	HIGH Network	-	-	IBM Langflow OSS 1.0.0 through 1.9.1 could allow an authenticated user to read or modify sensitive information by bypassing authentication using insecure direct object references. New	CWE-639 Authorization Bypass Through User-Controlled Key	CVE-2026-7787	2026-06-12 01:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

532	8.8	HIGH Network	-	-	Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz allows a low-privileged authenticated user with Content/DataResource editing privileges to perform template inj… New	CWE-94 Code Injection	CVE-2026-50223	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

533	8.6	HIGH Network	-	-	Fedify is a TypeScript library for building federated server apps powered by ActivityPub. Fedify previously addressed SSRF/internal network access in GHSA-p9cg-vqcc-grcx by adding public URL validati… New	CWE-918 CWE-1286 CWE-1389 Server-Side Request Forgery (SSRF) Improper Validation of Syntactic Correctness of Input	CVE-2026-50131	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

534	6.5	MEDIUM Network	-	-	IBM DevOps Plan 3.0.0 through 3.0.6 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against… New	CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax	CVE-2026-4096	2026-06-12 01:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

535	3.7	LOW Network	-	-	Shopware is an open commerce platform. Prior to versions 6.6.10.18 and 6.7.10.1, an attacker is able to enumerate the usernames of administrator users by performing a timing attack. Versions 6.6.10.1… New	CWE-208 Information Exposure Through Timing Discrepancy	CVE-2026-48011	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

536	5.3	MEDIUM Network	-	-	Russh is a Rust SSH client & server library. From version 0.34.0-beta.1 to before version 0.61.0, the russh server authentication path keeps internal userauth state across SSH_MSG_USERAUTH_REQUEST me… New	CWE-287 Improper Authentication	CVE-2026-46705	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

537	7.5	HIGH Network	-	-	libp2p is a JavaScript Implementation of libp2p networking stack. Prior to version 15.0.23, three cooperating omissions in @libp2p/gossipsub allow an unauthenticated single peer to exhaust the Node.j… New	CWE-20 CWE-400 CWE-401 Improper Input Validation Uncontrolled Resource Consumption Missing Release of Memory after Effective Lifetime	CVE-2026-46679	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

538	7.5	HIGH Network	-	-	Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh rele… New	CWE-770 Allocation of Resources Without Limits or Throttling	CVE-2026-46673	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

539	-	-	-	-	OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theor… New	CWE-20 Improper Input Validation	CVE-2026-46669	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

540	3.6	LOW Local	-	-	bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.12, a one-byte off-by-one error in SafeOutPathBuilder::restoreSymlink() allo… New	CWE-22 CWE-193 Path Traversal Off-by-one Error	CVE-2026-45380	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

541	5.4	MEDIUM Network	-	-	IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, pote… New	CWE-918 Server-Side Request Forgery (SSRF)	CVE-2026-3341	2026-06-12 01:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

542	9.8	CRITICAL Network	-	-	SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy/ezform.php (line 14) … New	CWE-89 SQL Injection	CVE-2026-38581	2026-06-12 01:16	2026-06-11	Show	GitHub Exploit DB Packet Storm

543	9.9	CRITICAL Network	-	-	Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell to a Web Server. This issue affects Rotaban: from V2026.06.… New	CWE-434 Unrestricted Upload of File with Dangerous Type	CVE-2026-11839	2026-06-12 01:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

544	4.1	MEDIUM Local	-	-	IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user. New	CWE-256 Plaintext Storage of a Password	CVE-2024-45636	2026-06-12 01:16	2026-06-12	Show	GitHub Exploit DB Packet Storm

545	9.6	CRITICAL Adjacent	microsoft	windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2022 windows_server_2025	Heap-based buffer overflow in Windows TCP/IP allows an unauthorized attacker to elevate privileges over an adjacent network. Update	CWE-122 Heap-based Buffer Overflow	CVE-2026-42904	2026-06-12 01:15	2026-06-10	Show	GitHub Exploit DB Packet Storm

546	7.8	HIGH Local	microsoft	windows_10_1607 windows_10_1809 windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2012 windows_server_2016 w…	Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. Update	CWE-416 Use After Free	CVE-2026-42905	2026-06-12 01:14	2026-06-10	Show	GitHub Exploit DB Packet Storm

547	5.5	MEDIUM Local	microsoft	windows_10_21h2 windows_10_22h2 windows_11_23h2 windows_11_24h2 windows_11_25h2 windows_11_26h1 windows_server_2022 windows_server_2025	Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information locally. Update	CWE-200 Information Exposure	CVE-2026-42906	2026-06-12 01:13	2026-06-10	Show	GitHub Exploit DB Packet Storm

548	6.1	MEDIUM Network	vmware	spring_framework	Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape() may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting (XSS) vulnerability. Af… Update	CWE-79 Cross-site Scripting	CVE-2026-41845	2026-06-12 01:12	2026-06-9	Show	GitHub Exploit DB Packet Storm

549	6.1	MEDIUM Network	vmware	spring_framework	Spring MVC applications which accept user-supplied values in the cssClass, cssErrorClass, or cssStyle attributes of JSP form tags allow arbitrary HTML/JavaScript code injection, potentially resulting… Update	CWE-79 Cross-site Scripting	CVE-2026-41846	2026-06-12 01:10	2026-06-9	Show	GitHub Exploit DB Packet Storm

550	5.3	MEDIUM Network	vmware	spring_framework	Spring WebFlux applications may be vulnerable to a security bypass when using the Kotlin Router DSL. Affected versions: Spring Framework 5.3.0 through 5.3.48. Update	CWE-284 NVD-CWE-noinfo Improper Access Control	CVE-2026-41847	2026-06-12 01:08	2026-06-9	Show	GitHub Exploit DB Packet Storm