|
651
|
7.1 |
HIGH
Local
|
-
|
-
|
ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.
|
CWE-23
Relative Path Traversal
|
CVE-2026-22070
|
2026-05-1 00:48 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
652
|
- |
|
-
|
-
|
LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter. The application unsafely
processes the parameter on the client side, allowing an attacker to execute arbitrary
JavaScript …
|
CWE-79
Cross-site Scripting
|
CVE-2026-1493
|
2026-05-1 00:48 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
653
|
- |
|
-
|
-
|
Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server a…
|
CWE-611
XXE
|
CVE-2024-13971
|
2026-05-1 00:48 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
654
|
- |
|
-
|
-
|
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution…
|
CWE-20
CWE-94
Improper Input Validation
Code Injection
|
CVE-2025-14576
|
2026-05-1 00:48 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
655
|
5.9 |
MEDIUM
Network
|
-
|
-
|
Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely.
The session id is generated from summing the character codepoints of the absolute pathname with the proce…
|
CWE-338
CWE-340
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Generation of Predictable Numbers or Identifiers
|
CVE-2026-5080
|
2026-05-1 00:48 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
656
|
5.4 |
MEDIUM
Network
|
-
|
-
|
When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully func…
|
CWE-425
Direct Request ('Forced Browsing')
|
CVE-2026-7500
|
2026-05-1 00:48 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
657
|
4.0 |
MEDIUM
Local
|
-
|
-
|
Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-42798
|
2026-05-1 00:48 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
658
|
4.4 |
MEDIUM
Local
|
-
|
-
|
AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowing attackers to bypass trust-boun…
|
CWE-346
Origin Validation Error
|
CVE-2026-7439
|
2026-05-1 00:44 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
659
|
8.8 |
HIGH
Network
|
-
|
-
|
AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path parameter to the POST /api/runs …
|
CWE-94
Code Injection
|
CVE-2026-7466
|
2026-05-1 00:44 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
660
|
8.2 |
HIGH
Network
|
-
|
-
|
XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the id parameter. Attackers c…
|
CWE-89
SQL Injection
|
CVE-2018-25300
|
2026-05-1 00:44 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
