|
2671
|
- |
|
-
|
-
|
Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization …
|
CWE-602
CWE-863
Client-Side Enforcement of Server-Side Security
Incorrect Authorization
|
CVE-2026-42160
|
2026-05-14 02:24 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2672
|
9.9 |
CRITICAL
Network
|
-
|
-
|
FireFighter is an incident management application. Prior to 0.0.54, the POST /api/v2/firefighter/raid/jira_bot endpoint (CreateJiraBotView) is reachable without authentication (permission_classes = […
|
CWE-306
CWE-918
Missing Authentication for Critical Function
Server-Side Request Forgery (SSRF)
|
CVE-2026-42864
|
2026-05-14 02:24 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2673
|
6.8 |
MEDIUM
Adjacent
|
-
|
-
|
Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the…
|
CWE-295
Improper Certificate Validation
|
CVE-2026-44305
|
2026-05-14 02:24 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2674
|
7.3 |
HIGH
Network
|
mozilla
|
firefox
|
JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
|
CWE-119
CWE-686
CWE-843
Incorrect Access of Indexable Resource ('Range Error')
Function Call With Incorrect Argument Type
Type Confusion
|
CVE-2026-8389
|
2026-05-14 02:23 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2675
|
8.8 |
HIGH
Local
|
apple
|
macos
|
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.2. An app may be able to break out of its sandbox.
|
CWE-284
Improper Access Control
|
CVE-2025-43524
|
2026-05-14 02:22 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2676
|
6.3 |
MEDIUM
Network
|
openclaw
|
openclaw
|
OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attacker…
|
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
|
CVE-2026-44112
|
2026-05-14 02:16 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2677
|
6.5 |
MEDIUM
Network
|
-
|
-
|
A vulnerability exists in the undisclosed pages in the Configuration utility that may allow a low-privileged authenticated attacker to access to undisclosed sensitive information. Note: Software ver…
|
CWE-643
XPath Injection
|
CVE-2026-40699
|
2026-05-14 02:16 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2678
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Incorrect permission assignment vulnerabilities exist in iControl REST and TMOS shell (tmsh) undisclosed command which may allow an authenticated attacker to view sensitive information. Note: Softwa…
|
CWE-732
Incorrect Permission Assignment for Critical Resource
|
CVE-2026-40462
|
2026-05-14 02:16 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2679
|
8.8 |
HIGH
Network
|
litellm
|
litellm
|
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templ…
|
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
|
CVE-2026-42203
|
2026-05-14 02:14 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2680
|
5.4 |
MEDIUM
Network
|
langfuse
|
langfuse
|
Langfuse is an open source large language model engineering platform. From version 3.68.0 to before version 3.167.0, there is a role-based-access control flaw in the LLM connection update flow. An a…
|
CWE-284
Improper Access Control
|
CVE-2026-41487
|
2026-05-14 02:12 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
