|
621
|
7.5 |
HIGH
Network
|
-
|
-
|
libais through 0.15 VdmStream::AddLine uses an unchecked sentinel value as a vector index when processing AIS sentences with empty or out-of-range sequential message IDs. Remote attackers can crash s…
New
|
CWE-129
Improper Validation of Array Index
|
CVE-2026-56770
|
2026-06-26 04:48 |
2026-06-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
622
|
6.5 |
MEDIUM
Local
|
-
|
-
|
An out-of-bounds heap read and integer underflow in the TCP urgent data handling (sosendoob) in freedesktop.org libslirp version before v4.9.2 on hypervisor host environments (e.g., QEMU) allows a pr…
New
|
CWE-125
Out-of-bounds Read
|
CVE-2026-9539
|
2026-06-26 04:26 |
2026-06-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
623
|
8.2 |
HIGH
Network
|
-
|
-
|
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attacker…
New
|
CWE-79
Cross-site Scripting
|
CVE-2026-56785
|
2026-06-26 04:25 |
2026-06-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
624
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Tiptap for PHP before version 2.1.1 contains an input validation vulnerability that allows authenticated attackers to cause a denial of service by submitting Tiptap JSON with the attrs.href field set…
New
|
CWE-241
Improper Handling of Unexpected Data Type
|
CVE-2026-47110
|
2026-06-26 04:25 |
2026-06-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
625
|
7.5 |
HIGH
Network
|
-
|
-
|
Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences …
New
|
CWE-22
Path Traversal
|
CVE-2026-56122
|
2026-06-26 04:25 |
2026-06-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
626
|
8.1 |
HIGH
Network
|
-
|
-
|
HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfil…
New
|
CWE-22
Path Traversal
|
CVE-2026-45233
|
2026-06-26 04:25 |
2026-06-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
627
|
8.1 |
HIGH
Network
|
-
|
-
|
ProFTPD through 1.3.9b and 1.3.10rc2 contains an access control bypass vulnerability that allows authenticated FTP users to circumvent Directory ACL restrictions by prefixing paths with /proc/self/ro…
New
|
CWE-59
Link Following
|
CVE-2026-35025
|
2026-06-26 04:25 |
2026-06-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
628
|
9.1 |
CRITICAL
Network
|
-
|
-
|
Marlin Firmware through 2.1.2.7, fixed in commit 1f255d1, when built with MESH_BED_LEVELING enabled, contains an out-of-bounds write vulnerability in the M421 G-code handler that allows attackers to …
New
|
CWE-129
Improper Validation of Array Index
|
CVE-2026-56111
|
2026-06-26 04:25 |
2026-06-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
629
|
7.1 |
HIGH
Network
|
-
|
-
|
pnpm is a package manager. From 11.3.0 until 11.5.3, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selec…
New
|
CWE-22
CWE-73
Path Traversal
External Control of File Name or Path
|
CVE-2026-55700
|
2026-06-26 04:16 |
2026-06-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
630
|
6.5 |
MEDIUM
Network
|
-
|
-
|
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, Manifest bin object keys such as "", ".", and ".." passed pnpm's bin-name guard. When a malicious package was installed globally, later global …
New
|
CWE-22
CWE-73
Path Traversal
External Control of File Name or Path
|
CVE-2026-55699
|
2026-06-26 04:16 |
2026-06-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
