NVD Recent CVEs
The National Vulnerability Database (NVD), run by NIST, is the reference database for CVE records with CVSS scoring. It is a high-volume firehose rather than a curated advisory stream, so CSIRTS.com keeps it out of the default browse view but fully searchable — and uses it to build permanent CVE index records with severity and KEV status.
CSIRTS.com ingests NVD Recent CVEs every 3 hours, normalizes each advisory into a common schema and cross-references every CVE against the CISA KEV catalog and public exploit datasets. Publishes newly published and updated CVE records. Also available via RSS, JSON API and the MCP server.
Latest from NVD Recent CVEs
CVE-2026-79912: A vulnerability was detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The impacted element is the function getCurrentTime of the file /cgi-bin/cstecgi.cgi. Performing a manipulati
CVE-2026-79911: A security vulnerability has been detected in TOTOLINK N600R 4.3.0cu.7647_B20210106. The affected element is the function setSystemConfig of the file /cgi-bin/cstecgi.cgi of the co
CVE-2026-70665: Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) e
CVE-2026-55805: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions:
CVE-2026-54757: Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, Trestle is v
CVE-2026-44476: Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can auth
CVE-2026-41707: Spring Security's DPoPProofJwtDecoderFactory contains a cache-based replay attack vulnerability. The internal cache storing JWT ID claims has a strict size limit, allowing attacker
CVE-2026-18985: Incorrect Authorization vulnerability in Drupal Edit in-place field allows Forceful Browsing. This issue affects Edit in-place field versions: from 0.0.0 to 2.1.1.
CVE-2026-18261: Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.
CVE-2026-18260: Vulnerability in Drupal Disable Login Page. This issue affects Disable Login Page versions: *.*.
CVE-2026-18259: Observable Timing Discrepancy vulnerability in Drupal Token Content Access allows Brute Force. This issue affects Token Content Access versions: from 0.0.0 to 3.1.2.
CVE-2026-16646: Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.
CVE-2026-16645: Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript
CVE-2026-16644: Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects Webform REST versions: from 0.0.0 to 4.1.0.
CVE-2026-16643: Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.
CVE-2026-16642: Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
CVE-2026-16641: Vulnerability in Drupal Commerce Elavon. This issue affects Commerce Elavon versions: *.*.
CVE-2026-16640: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search
CVE-2026-16639: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects Internationali
CVE-2026-16638: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versi
CVE-2026-15917: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupa
CVE-2026-15916: Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.
CVE-2026-15088: Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
CVE-2026-80186: A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended In
Browse all 21,980 advisories from NVD Recent CVEs →
Never miss a NVD Recent CVEs advisory. The daily briefing covers every new advisory from this source — alongside the other feeds we watch for you. Subscribe free — one email every morning after 06:00 UTC, one-click unsubscribe. Tracking specific products instead? Watch them from any product page and get alerted only when they ship a new advisory.