|
871
|
6.5 |
MEDIUM
Network
|
-
|
-
|
During the analysis, it was identified that authenticated attackers with Subscriber-level access or higher are able to perform an Insecure Direct Object Reference (IDOR) attack. This vulnerability ex…
Update
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-5337
|
2026-05-5 00:23 |
2026-05-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
872
|
5.3 |
MEDIUM
Network
|
-
|
-
|
The Magic Export & Import WordPress plugin before 1.2.0 stores exported CSV files at a publicly accessible location, making it possible for any visitors to leak sensitive user information.
New
|
CWE-552
Files or Directories Accessible to External Parties
|
CVE-2026-5335
|
2026-05-5 00:23 |
2026-05-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
873
|
4.9 |
MEDIUM
Network
|
-
|
-
|
Velociraptor versions prior to 0.76.4 contain a resource exhaustion vulnerability in the server's agent control channel.
This allows a compromised or rogue Velociraptor client to crash the server …
New
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-6948
|
2026-05-5 00:22 |
2026-05-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
874
|
7.5 |
HIGH
Network
|
-
|
-
|
A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and …
New
|
CWE-130
Improper Handling of Length Parameter Inconsistency
|
CVE-2026-33846
|
2026-05-5 00:22 |
2026-05-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
875
|
8.8 |
HIGH
Local
|
-
|
-
|
A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may res…
New
|
CWE-1386
Insecure Operation on Windows Junction / Mount Point
|
CVE-2025-58074
|
2026-05-5 00:22 |
2026-05-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
876
|
8.3 |
HIGH
Network
|
-
|
-
|
A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on emai…
New
|
CWE-305
Authentication Bypass by Primary Weakness
|
CVE-2026-6266
|
2026-05-5 00:22 |
2026-05-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
877
|
6.5 |
MEDIUM
Network
|
-
|
-
|
An attachment spoofing issue in WhatsApp for Windows prior to v2.3000.1032164386.258709 could have allowed maliciously formatted documents with embedded NUL bytes in the filename to be shown in the a…
Update
|
CWE-158
Improper Neutralization of Null Byte or NUL Character
|
CVE-2026-23863
|
2026-05-5 00:21 |
2026-05-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
878
|
4.3 |
MEDIUM
Network
|
-
|
-
|
Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could have allowed a user to trigg…
Update
|
CWE-940
Improper Verification of Source of a Communication Channel
|
CVE-2026-23866
|
2026-05-5 00:21 |
2026-05-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
879
|
10.0 |
CRITICAL
Network
|
-
|
-
|
GV-VMS V20 is a Video Monitoring Software used to gather the feeds of many surveillance cameras and manage other security devices. It is a native application accessed locally, but it is also possible…
New
|
CWE-787
Out-of-bounds Write
|
CVE-2026-42369
|
2026-05-5 00:21 |
2026-05-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
880
|
7.3 |
HIGH
Network
|
-
|
-
|
A flaw has been found in Jinher OA 1.0. The affected element is an unknown function of the file /C6/JHSoft.Web.PlanSummarize/UserSel.aspx. This manipulation of the argument DeptIDList causes sql inje…
Update
|
CWE-74
CWE-89
Injection
SQL Injection
|
CVE-2026-7670
|
2026-05-5 00:19 |
2026-05-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
