U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database

NVD Dashboard

CVEs Received and Processed

CVEs Received and Processed

Please Wait

CVE Status Count

Please Wait

CVSS Score Spread

Please Wait

CVSS V3 Score Distribution

Severity Number of Vulns

CVSS V2 Score Distribution

Severity Number of Vulns


For information on how to the cite the NVD, including the database's Digital Object Identifier (DOI), please consult NIST's Public Data Repository.

Last 20 Scored Vulnerability IDs & Summaries CVSS Severity

  • CVE-2026-61280 - Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Outlook Sync Win 32). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with net... read CVE-2026-61280
    Published: July 21, 2026; 6:18:58 PM -0400

  • CVE-2026-21713 - A flaw in Node.js HMAC verification uses a non-constant-time comparison when validating user-provided signatures, potentially leaking timing information proportional to the number of matching bytes. Under certain threat models where high-resolutio... read CVE-2026-21713
    Published: March 30, 2026; 4:16:19 PM -0400

  • CVE-2026-21714 - A memory leak occurs in Node.js HTTP/2 servers when a client sends WINDOW_UPDATE frames on stream 0 (connection-level) that cause the flow control window to exceed the maximum value of 2³¹-1. The server correctly sends a GOAWAY frame, but the Http... read CVE-2026-21714
    Published: March 30, 2026; 4:16:19 PM -0400

  • CVE-2026-61277 - Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP ... read CVE-2026-61277
    Published: July 21, 2026; 6:18:57 PM -0400

  • CVE-2026-61275 - Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Role Based Security). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network acc... read CVE-2026-61275
    Published: July 21, 2026; 6:18:57 PM -0400

  • CVE-2026-61274 - Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via... read CVE-2026-61274
    Published: July 21, 2026; 6:18:57 PM -0400

  • CVE-2026-21715 - A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permis... read CVE-2026-21715
    Published: March 30, 2026; 4:16:19 PM -0400

  • CVE-2026-9816 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate BoardMember.Scheme* fields server-side on insert and archive-import paths which allows a board editor or non-guest team member to grant board admin to arb... read CVE-2026-9816
    Published: August 17, 2026; 6:17:27 PM -0400

  • CVE-2026-9859 - Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to enforce PermissionManageBoardRoles on the channelId field of the batch endpoint, which allows an authenticated board editor to relink any board they can edit to an... read CVE-2026-9859
    Published: August 17, 2026; 6:17:27 PM -0400

  • CVE-2026-21716 - An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. ... read CVE-2026-21716
    Published: March 30, 2026; 4:16:19 PM -0400

  • CVE-2026-9693 - Mattermost versions 10.11.x <= 10.11.20, 11.7.x <= 11.7.5 Mattermost fails to remove thread membership records when a user is removed from or leaves a team, which allows a previously removed user who is later re-invited to the team to view private... read CVE-2026-9693
    Published: August 17, 2026; 7:16:52 PM -0400

  • CVE-2026-21717 - A flaw in V8's string hashing mechanism causes integer-like strings to be hashed to their numeric value, making hash collisions trivially predictable. By crafting a request that causes many such collisions in V8's internal string table, an attacke... read CVE-2026-21717
    Published: March 30, 2026; 4:16:20 PM -0400

    V3.1: 5.9 MEDIUM

  • CVE-2026-8367 - aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.
    Published: May 13, 2026; 12:17:04 PM -0400

    V3.1: 5.3 MEDIUM

  • CVE-2026-14681 - Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may ex... read CVE-2026-14681
    Published: August 13, 2026; 9:17:45 AM -0400

  • CVE-2026-14680 - Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutua... read CVE-2026-14680
    Published: August 13, 2026; 9:17:45 AM -0400

  • CVE-2026-14679 - Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 ... read CVE-2026-14679
    Published: August 13, 2026; 9:17:45 AM -0400

  • CVE-2026-14678 - Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17... read CVE-2026-14678
    Published: August 13, 2026; 9:17:45 AM -0400

  • CVE-2026-14677 - Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating syste... read CVE-2026-14677
    Published: August 13, 2026; 9:17:45 AM -0400

  • CVE-2026-14673 - Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling ... read CVE-2026-14673
    Published: August 13, 2026; 9:17:44 AM -0400

  • CVE-2026-14676 - Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions bef... read CVE-2026-14676
    Published: August 13, 2026; 9:17:44 AM -0400