CVE-2026-62055Medium 4.3
Research and translation in progress – available shortly.
CVE tracker
New vulnerabilities – clearly explained
Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA and the probability of exploitation (EPSS) – each one researched individually: what is affected, what helps, what to do.
2published today
3424in the last 7 days
248of them critical
9newly exploited (7 days)
3424 vulnerabilities
CVE-2026-61826Critical 10.0
Bazarr: Missing authentication on Plex OAuth API allows config tampering and SSRF
Bazarr, a companion application to Sonarr and Radarr, did not require authentication on several Plex OAuth API endpoints. An unauthenticated attacker who can reach the web interface can clear the Plex credentials, set an attacker-chosen API key, or bind an attacker-controlled Plex account, and can change the Plex server URL. Attacker-controlled URLs then receive the configured API key in the X-Plex-Token header, which enables server-side request forgery and credential exposure. No user interaction is required.
morpheus65535 · Bazarr
CVE-2026-61806Medium 5.3
Research and translation in progress – available shortly.
CVE-2026-61805Medium 5.3
Research and translation in progress – available shortly.
CVE-2026-61804High 8.1
Research and translation in progress – available shortly.
CVE-2026-61803Medium 5.3
Research and translation in progress – available shortly.
CVE-2026-61789Medium 6.1
Research and translation in progress – available shortly.
CVE-2026-55551Medium 6.5
Research and translation in progress – available shortly.
CVE-2026-50000Medium 5.0
Research and translation in progress – available shortly.
CVE-2026-39375Medium 5.1
Research and translation in progress – available shortly.
CVE-2026-37468Not rated
Research and translation in progress – available shortly.
CVE-2026-119466Medium 5.4
Research and translation in progress – available shortly.
CVE-2026-119367Medium 5.4
Research and translation in progress – available shortly.
CVE-2026-119365Medium 6.5
Research and translation in progress – available shortly.
CVE-2026-119300Medium 6.5
Research and translation in progress – available shortly.
CVE-2026-119299Medium 5.9
Research and translation in progress – available shortly.
CVE-2026-119298Medium 4.2
Research and translation in progress – available shortly.
CVE-2026-119148High 8.2
Research and translation in progress – available shortly.
CVE-2026-119116High 8.7
Research and translation in progress – available shortly.
CVE-2026-115642High 8.3
Research and translation in progress – available shortly.
CVE-2026-112816Critical 10.0
Canonical LXD: Improper certificate validation allows cluster access
Improper certificate validation in the HTTPS listener of Canonical LXD allows an attacker who can reach the HTTPS API to authenticate as any trusted client. The attacker needs the public certificate of a trusted client, which does not have to be secret. A successful attack grants full access to the LXD cluster and the managed virtual machines, and depending on the impersonated user's privileges, root on the host. The CVE record gives a CVSS v4.0 score of 10.0 (Critical).
Canonical · LXD
CVE-2026-104623Medium 6.3
Research and translation in progress – available shortly.
CVE-2025-49602Not rated
Research and translation in progress – available shortly.
CVE-2026-62141Medium 5.4
Research and translation in progress – available shortly.
CVE-2026-119722High 8.5
Research and translation in progress – available shortly.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.
Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.