U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database

NVD Dashboard

CVEs Received and Processed

CVEs Received and Processed

Please Wait

CVE Status Count

Please Wait

CVSS Score Spread

Please Wait

CVSS V3 Score Distribution

Severity Number of Vulns

CVSS V2 Score Distribution

Severity Number of Vulns


For information on how to the cite the NVD, including the database's Digital Object Identifier (DOI), please consult NIST's Public Data Repository.

Last 20 Scored Vulnerability IDs & Summaries CVSS Severity

  • CVE-2026-43910 - Appium Java Client is the Java language binding for writing Appium tests that conform to the W3C WebDriver protocol. From 8.2.1 until 10.1.1, when directConnect(true) is enabled, AppiumCommandExecutor.setDirectConnect() reads the directConnectHost... read CVE-2026-43910
    Published: July 28, 2026; 12:18:12 PM -0400

  • CVE-2026-66032 - libssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heap of any authenticated client opening an SFTP session. When a serv... read CVE-2026-66032
    Published: July 24, 2026; 1:17:35 PM -0400

  • CVE-2026-66036 - FFmpeg through 8.1.2, fixed in commit 5d7112c, contains a heap out-of-bounds write vulnerability in the vf_hqdn3d filter that allows attackers to corrupt heap memory by supplying a crafted video whose frame resolution increases between frames when... read CVE-2026-66036
    Published: July 24, 2026; 4:18:20 PM -0400

    V3.1: 8.8 HIGH

  • CVE-2026-66037 - FFmpeg through 8.1.2, fixed in commit 5d7112c, contains an uncontrolled resource consumption vulnerability in the IAMF demuxer that allows an unauthenticated attacker to cause multi-gigabyte memory allocation from a 17-byte input file by supplying... read CVE-2026-66037
    Published: July 24, 2026; 4:18:20 PM -0400

    V3.1: 5.5 MEDIUM

  • CVE-2026-66038 - FFmpeg through 8.1.2, fixed in commit 8670835, contains an information disclosure vulnerability in the LCL/ZLIB video decoder that allows attackers to expose uninitialized heap memory by supplying a valid zlib stream that inflates to fewer bytes t... read CVE-2026-66038
    Published: July 24, 2026; 4:18:20 PM -0400

    V3.1: 6.5 MEDIUM

  • CVE-2026-66039 - FFmpeg through 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder that allows attackers to corrupt heap memory by supplying a crafted CAF file with a malicious bytes_per_packet value. Attack... read CVE-2026-66039
    Published: July 24, 2026; 4:18:20 PM -0400

    V3.1: 7.8 HIGH

  • CVE-2026-66040 - FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders that allows remote attackers to corrupt heap memory by supplying a crafted PNG image with a malicious eXIf chunk. ... read CVE-2026-66040
    Published: July 24, 2026; 4:18:21 PM -0400

    V3.1: 8.8 HIGH

  • CVE-2026-66041 - FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter that allows an attacker to corrupt heap memory by supplying a crafted PGS/SUP subtitle file with mismatched frame dimension... read CVE-2026-66041
    Published: July 24, 2026; 4:18:21 PM -0400

    V3.1: 7.8 HIGH

  • CVE-2026-65706 - FFmpeg versions 3.0 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_swaprect video filter that allows attackers to corrupt heap memory by supplying a crafted NV12 video frame with odd width dimensions. The filter_frame() funct... read CVE-2026-65706
    Published: July 23, 2026; 4:17:22 PM -0400

  • CVE-2026-65705 - FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vf_floodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled v... read CVE-2026-65705
    Published: July 23, 2026; 4:17:22 PM -0400

  • CVE-2026-65703 - FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file that changes frame dimensions across TDSF frames. The td... read CVE-2026-65703
    Published: July 23, 2026; 4:17:21 PM -0400

  • CVE-2026-65704 - FFmpeg through 8.1.2 contains an out-of-bounds write vulnerability that allows attackers to cause heap corruption by supplying a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size ... read CVE-2026-65704
    Published: July 23, 2026; 4:17:21 PM -0400

  • CVE-2026-45623 - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string ... read CVE-2026-45623
    Published: July 27, 2026; 2:16:55 PM -0400

    V3.1: 9.1 CRITICAL

  • CVE-2026-66759 - A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file con... read CVE-2026-66759
    Published: July 27, 2026; 3:17:23 PM -0400

  • CVE-2026-66758 - A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product... read CVE-2026-66758
    Published: July 27, 2026; 3:17:23 PM -0400

  • CVE-2026-59898 - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting... read CVE-2026-59898
    Published: July 29, 2026; 3:16:48 PM -0400

    V3.1: 7.5 HIGH

  • CVE-2026-59920 - Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's STOMP encoder ( StompSubframeEncoder ) does not escape or validate header values in  CONNECT  and  CONNECTED  frames... read CVE-2026-59920
    Published: July 29, 2026; 2:16:56 PM -0400

  • CVE-2026-59919 - Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.136.Final and 4.2.16.Final, Netty's HAProxy encoder ( HAProxyMessageEncoder ) writes AF_UNIX source and destination socket addresses into the HAProxy V1... read CVE-2026-59919
    Published: July 29, 2026; 2:16:56 PM -0400

  • CVE-2026-59901 - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in Netty's compression codec pipeline is vulnerable to a denial-of-service attack through a malforme... read CVE-2026-59901
    Published: July 29, 2026; 2:16:56 PM -0400

    V3.1: 7.5 HIGH

  • CVE-2026-59900 - Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to ded... read CVE-2026-59900
    Published: July 29, 2026; 2:16:56 PM -0400

    V3.1: 5.3 MEDIUM