U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
Icon for New NVD Communications and Status Updates Page
New Communications Page
The NVD now supports CVSS version 4.0!
CVSS v4.0 Support
The letters N V D typed out in binary
2.0 APIs

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics.

For information on how to cite the NVD, including the database's Digital Object Identifier (DOI), please consult NIST's Public Data Repository.

Last 20 Scored Vulnerability IDs & Summaries CVSS Severity

  • CVE-2026-35471 - goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, tdeleteFile() missing return after path traversal check. This vulnerability is fixed in 2.0.0-beta.3.
    Published: April 06, 2026; 6:16:23 PM -0400

  • CVE-2026-35393 - goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, the POST multipart upload directory not sanitized. This vulnerability is fixed in 2.0.0-beta.3.
    Published: April 06, 2026; 5:16:21 PM -0400

  • CVE-2026-35392 - goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.3, PUT upload in httpserver/updown.go has no path sanitization. This vulnerability is fixed in 2.0.0-beta.3.
    Published: April 06, 2026; 5:16:21 PM -0400

  • CVE-2023-53959 - FileZilla Client 3.63.1 contains a DLL hijacking vulnerability that allows attackers to execute malicious code by placing a crafted TextShaping.dll in the application directory. Attackers can generate a reverse shell payload using msfvenom and rep... read CVE-2023-53959
    Published: December 19, 2025; 4:15:53 PM -0500

  • CVE-2025-14979 - AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.24.6.
    Published: January 06, 2026; 11:15:51 AM -0500

    V3.1: 7.8 HIGH

  • CVE-2026-27885 - Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability was discovered in Piwigo affecting the Activity List API endpoint. This vulnerability allows an authenticated administrator to e... read CVE-2026-27885
    Published: April 03, 2026; 6:16:26 PM -0400

  • CVE-2026-27834 - Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, a SQL Injection vulnerability exists in the pwg.users.getList Web Service API method. The filter parameter is directly concatenated into a SQL query without p... read CVE-2026-27834
    Published: April 03, 2026; 6:16:26 PM -0400

  • CVE-2026-27833 - Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the pwg.history.search API method in Piwigo is registered without the admin_only option, allowing unauthenticated users to access the full browsing history of... read CVE-2026-27833
    Published: April 03, 2026; 6:16:25 PM -0400

  • CVE-2026-27634 - Piwigo is an open source photo gallery application for the web. Prior to version 16.3.0, the four date filter parameters (f_min_date_available, f_max_date_available, f_min_date_created, f_max_date_created) in ws_std_image_sql_filter() are concaten... read CVE-2026-27634
    Published: April 03, 2026; 6:16:25 PM -0400

    V3.1: 9.8 CRITICAL

  • CVE-2026-34834 - Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the verifyIdentity() function contained logic that returned true if no session cookies were present. This allowed unauthenticated attackers to bypas... read CVE-2026-34834
    Published: April 02, 2026; 4:16:27 PM -0400

    V3.1: 7.5 HIGH

  • CVE-2026-34833 - Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to version 1.4.10, the GET /api/auth/session endpoint previously included the user's plaintext password in the JSON response. This exposed credentials to browser logs,... read CVE-2026-34833
    Published: April 02, 2026; 4:16:27 PM -0400

    V3.1: 7.5 HIGH

  • CVE-2026-3089 - Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments (../) can escape the i... read CVE-2026-3089
    Published: March 09, 2026; 10:16:10 AM -0400

    V3.1: 6.5 MEDIUM

  • CVE-2026-35391 - Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the getClientIP() function in lib/admin/session.ts trusted the first (leftmost) entry of the X-Forwarded-For header, which is fully controlled by the client... read CVE-2026-35391
    Published: April 06, 2026; 5:16:20 PM -0400

    V3.1: 7.5 HIGH

  • CVE-2026-35389 - Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, S/MIME signature verification did not validate the certificate trust chain (checkChain: false). Any email signed with a self-signed or untrusted certificate... read CVE-2026-35389
    Published: April 06, 2026; 5:16:20 PM -0400

    V3.1: 7.5 HIGH

  • CVE-2025-54659 - An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unaut... read CVE-2025-54659
    Published: March 10, 2026; 2:17:58 PM -0400

    V3.1: 7.5 HIGH

  • CVE-2026-22627 - A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or comman... read CVE-2026-22627
    Published: March 10, 2026; 2:18:12 PM -0400

  • CVE-2026-22628 - An improper access control vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an authenticated admin to execute system commands via a specifically crafted SSH config file.
    Published: March 10, 2026; 2:18:12 PM -0400

    V3.1: 6.7 MEDIUM

  • CVE-2026-35390 - Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the reverse proxy (proxy.ts) set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This means cross-si... read CVE-2026-35390
    Published: April 06, 2026; 5:16:20 PM -0400

    V3.1: 5.4 MEDIUM

  • CVE-2026-35414 - OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.
    Published: April 02, 2026; 2:16:34 PM -0400

    V3.1: 7.5 HIGH

  • CVE-2025-61648 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/ShowIPBu... read CVE-2025-61648
    Published: February 02, 2026; 8:15:58 PM -0500

    V3.1: 6.1 MEDIUM

Created September 20, 2022 , Updated August 27, 2024