Every CVE of the last six months, updated daily.
Published vulnerabilities straight from the National Vulnerability Database, with severity, CWE class and affected products. Search it, filter it, and see what landed today.
- 516 published in the last 24 hours
- 2,392 in the last 7 days
- 58,812 in the last six months
Source: NVD (National Vulnerability Database) · Updated Sep 25, 2026
Showing 6 of 6
An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the targ
CWE-420cyrus imapTor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022.
CWE-420torproject torWhen configured, IP-based access restrictions for httpd do not cover all endpoints, which may allow connections from blocked addresses. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CWE-420f5 big-ip_access_policy_managerf5 big-ip_advanced_firewall_managerf5 big-ip_advanced_web_application_firewallAn issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_proxy65 is enabled. Because mod_proxy65 mishandles access control in the activation scenario, relaying of unauthenticated traffic can occur.
CWE-420prosody prosodyLiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.
OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.
CWE-420openbsd openssh
Find the bug before an attacker does.
Sign in with GitHub and run your first audit in under a minute. The free plan needs no credit card.