|
1331
|
3.3 |
LOW
Local
|
-
|
-
|
NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser in NanaZip. The vulnerability is triggered when …
|
CWE-369
Divide By Zero
|
CVE-2026-42443
|
2026-05-14 01:26 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1332
|
- |
|
-
|
-
|
Rejected reason: This CVE ID has been rejected or withdrawn.
|
-
|
CVE-2026-8449
|
2026-05-14 01:17 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1333
|
4.3 |
MEDIUM
Network
|
-
|
-
|
Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted re…
|
CWE-862
Missing Authorization
|
CVE-2026-8407
|
2026-05-14 01:17 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1334
|
7.2 |
HIGH
Network
|
-
|
-
|
Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to
execute arbitrary commands via a specific interface,
potentially enabling the attacker to acc…
|
CWE-89
SQL Injection
|
CVE-2026-6888
|
2026-05-14 01:17 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1335
|
4.3 |
MEDIUM
Network
|
-
|
-
|
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session v…
|
CWE-862
Missing Authorization
|
CVE-2026-5146
|
2026-05-14 01:17 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1336
|
8.1 |
HIGH
Network
|
-
|
-
|
ChurchCRM is an open-source church management system. Prior to 7.3.2, top-level cross-site GET navigation from an attacker-controlled page to FundRaiserDelete.php, PropertyTypeDelete.php, or NoteDele…
|
CWE-352
CWE-650
Origin Validation Error
Trusting HTTP Permission Methods on the Server Side
|
CVE-2026-44548
|
2026-05-14 01:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1337
|
9.6 |
CRITICAL
Network
|
-
|
-
|
ChurchCRM is an open-source church management system. From 7.2.0 to 7.2.2, The fix for CVE-2026-4058 is incomplete. The hardening commit was merged and then silently stripped from src/api/routes/publ…
|
CWE-287
CWE-304
Improper Authentication
Missing Critical Step in Authentication
|
CVE-2026-44547
|
2026-05-14 01:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1338
|
- |
|
-
|
-
|
Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Prior to 1.2.3, Broken Access Control allows reading of sketch logs f…
|
CWE-284
Improper Access Control
|
CVE-2026-44352
|
2026-05-14 01:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1339
|
8.1 |
HIGH
Network
|
-
|
-
|
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the readonly flag set on the <efw:elFinder> JSP tag is intended to prevent file modifications. When protected=true, elfinder_checkRisk en…
|
CWE-863
Incorrect Authorization
|
CVE-2026-44260
|
2026-05-14 01:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1340
|
4.6 |
MEDIUM
Network
|
-
|
-
|
efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, the previewServlet serves files with their detected MIME type based on file extension, without any content sanitization or security heade…
|
CWE-80
Basic XSS
|
CVE-2026-44259
|
2026-05-14 01:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
