U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
Icon for NVD Communications and Status Updates Page
Communications Page
The NVD now supports CVSS version 4.0!
CVSS v4.0 Support
The letters N V D typed out in binary
2.0 APIs

The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security-related software flaws, product names, and impact metrics.

For information on how to cite the NVD, including the database's Digital Object Identifier (DOI), please consult NIST's Public Data Repository.

Last 20 Scored Vulnerability IDs & Summaries CVSS Severity

  • CVE-2026-27291 - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that ... read CVE-2026-27291
    Published: April 14, 2026; 1:16:48 PM -0400

    V3.1: 7.8 HIGH

  • CVE-2026-34628 - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in... read CVE-2026-34628
    Published: April 14, 2026; 2:17:37 PM -0400

    V3.1: 7.8 HIGH

  • CVE-2026-34629 - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in... read CVE-2026-34629
    Published: April 14, 2026; 2:17:37 PM -0400

    V3.1: 7.8 HIGH

  • CVE-2025-70873 - An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier allows attackers to obtain heap memory via supplying a crafted ZIP file.
    Published: March 12, 2026; 3:16:15 PM -0400

  • CVE-2026-34627 - InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in... read CVE-2026-34627
    Published: April 14, 2026; 2:17:36 PM -0400

    V3.1: 7.8 HIGH

  • CVE-2026-35592 - pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev97, the _safe_extractall() function in src/pyload/plugins/extractors/UnTar.py uses os.path.commonprefix() for its path traversal check, which performs charact... read CVE-2026-35592
    Published: April 07, 2026; 1:16:34 PM -0400

    V3.1: 6.5 MEDIUM

  • CVE-2008-3909 - The administration application in Django 0.91, 0.95, and 0.96 stores unauthenticated HTTP POST requests and processes them after successful authentication occurs, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks a... read CVE-2008-3909
    Published: September 04, 2008; 1:41:00 PM -0400

    V2.0: 5.8 MEDIUM

  • CVE-2006-0749 - nsHTMLContentSink.cpp in Mozilla Firefox and Thunderbird 1.x before 1.5 and 1.0.x before 1.0.8, Mozilla Suite before 1.7.13, and SeaMonkey before 1.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code ... read CVE-2006-0749
    Published: April 14, 2006; 6:02:00 AM -0400

    V2.0: 9.3 HIGH

  • CVE-2012-3442 - The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-s... read CVE-2012-3442
    Published: July 31, 2012; 1:55:01 PM -0400

    V2.0: 4.3 MEDIUM

  • CVE-2016-8747 - An information disclosure issue was discovered in Apache Tomcat 8.5.7 to 8.5.9 and 9.0.0.M11 to 9.0.0.M15 in reverse-proxy configurations. Http11InputBuffer.java allows remote attackers to read data that was intended to be associated with a differ... read CVE-2016-8747
    Published: March 14, 2017; 5:59:00 AM -0400

    V3.1: 7.5 HIGH
     V2.0: 5.0 MEDIUM

  • CVE-2026-35627 - OpenClaw before 2026.3.22 performs cryptographic and dispatch operations on inbound Nostr direct messages before enforcing sender and pairing policy validation. Attackers can trigger unauthorized pre-authentication computation by sending crafted D... read CVE-2026-35627
    Published: April 09, 2026; 6:16:31 PM -0400

    V3.1: 8.2 HIGH

  • CVE-2026-39977 - flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-files manifest key takes an array of paths to user defined licence files relative to the source directory of the module. The paths from that array are... read CVE-2026-39977
    Published: April 09, 2026; 4:16:26 PM -0400

    V3.1: 6.3 MEDIUM

  • CVE-2026-3872 - A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to the thef... read CVE-2026-3872
    Published: April 02, 2026; 9:16:26 AM -0400

  • CVE-2026-4282 - A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to... read CVE-2026-4282
    Published: April 02, 2026; 9:16:26 AM -0400

  • CVE-2026-35634 - OpenClaw before 2026.3.23 contains an authentication bypass vulnerability in the Canvas gateway where authorizeCanvasRequest() unconditionally allows local-direct requests without validating bearer tokens or canvas capabilities. Attackers can send... read CVE-2026-35634
    Published: April 09, 2026; 6:16:32 PM -0400

    V3.1: 5.1 MEDIUM

  • CVE-2026-4325 - A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed a... read CVE-2026-4325
    Published: April 02, 2026; 9:16:26 AM -0400

  • CVE-2026-4634 - A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high resource ... read CVE-2026-4634
    Published: April 02, 2026; 9:16:27 AM -0400

  • CVE-2026-4636 - A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, ev... read CVE-2026-4636
    Published: April 02, 2026; 9:16:27 AM -0400

  • CVE-2026-35063 - OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, including administrators, by specifying their user ID or they can create new accounts with ... read CVE-2026-35063
    Published: April 09, 2026; 4:16:25 PM -0400

    V3.1: 8.8 HIGH

  • CVE-2026-35556 - OpenPLC_V3 is vulnerable to a Plaintext Storage of a Password vulnerability that could allow an attacker to retrieve credentials and access sensitive information.
    Published: April 09, 2026; 3:16:25 PM -0400

    V3.1: 7.5 HIGH

Created September 20, 2022 , Updated August 27, 2024