|
3811
|
7.8 |
HIGH
Local
|
-
|
-
|
A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privile…
|
CWE-427
Uncontrolled Search Path Element
|
CVE-2026-8637
|
2026-06-11 00:16 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3812
|
- |
|
-
|
-
|
A missing authentication check on the Aix‑DB "/llm/process_llm_out" endpoint allows unauthenticated clients to execute arbitrary "SELECT" SQL queries and retrieve database data, as the endpoint lacks…
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-8335
|
2026-06-11 00:16 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3813
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite sys…
|
CWE-749
Exposed Dangerous Method or Function
|
CVE-2026-7516
|
2026-06-11 00:16 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3814
|
7.0 |
HIGH
Local
|
-
|
-
|
A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.
|
CWE-290
Authentication Bypass by Spoofing
|
CVE-2026-6090
|
2026-06-11 00:16 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3815
|
7.1 |
HIGH
Network
|
-
|
-
|
libnfs through 6.0.2 before 55c18ea does not validate a string size, leading to an integer overflow during a connection to a crafted NFS server. This occurs in libnfs_zdr_string in lib/libnfs-zdr.c.
|
CWE-1284
Improper Validation of Specified Quantity in Input
|
CVE-2026-53689
|
2026-06-11 00:16 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3816
|
9.6 |
CRITICAL
Network
|
-
|
-
|
A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-53470
|
2026-06-11 00:16 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3817
|
9.1 |
CRITICAL
Network
|
-
|
-
|
A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. T…
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-53469
|
2026-06-11 00:16 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3818
|
9.9 |
CRITICAL
Network
|
-
|
-
|
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.before_request → @jwt_required() (app/rout…
|
CWE-639
CWE-862
CWE-863
Authorization Bypass Through User-Controlled Key
Missing Authorization
Incorrect Authorization
|
CVE-2026-45552
|
2026-06-11 00:16 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3819
|
9.8 |
CRITICAL
Network
|
-
|
-
|
DedeCMS V5.7.118 is vulnerable to Command Execution in file_manage_control.php.
|
CWE-78
OS Command
|
CVE-2026-38615
|
2026-06-11 00:16 |
2026-06-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3820
|
9.8 |
CRITICAL
Network
|
-
|
-
|
A lack of cryptographic signature verification in the validateAccessToken function of bookcars v8.3 allows attackers to bypass authentication via a forged JWT token.
|
CWE-347
Improper Verification of Cryptographic Signature
|
CVE-2026-36721
|
2026-06-11 00:16 |
2026-06-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
