|
2441
|
7.5 |
HIGH
Network
|
golang
|
go
|
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-39820
|
2026-05-14 00:10 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2442
|
5.3 |
MEDIUM
Local
|
golang
|
go
|
The "go bug" command writes to two files with predictable names in the system temporary directory (for example, "/tmp"). An attacker with access to the temporary directory can create a symlink in one…
|
CWE-59
Link Following
|
CVE-2026-39819
|
2026-05-14 00:05 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2443
|
5.9 |
MEDIUM
Local
|
golang
|
go
|
The "go tool pack" subcommand (usually used only by the compiler as an internal tool with known-good inputs) does not sanitize output filenames. Extracting a malicious archive file with the "pack" su…
|
CWE-787
Out-of-bounds Write
|
CVE-2026-39817
|
2026-05-13 23:59 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2444
|
10.0 |
CRITICAL
Network
|
peerigon
|
angular-expressions
|
Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to 1.5.2, an attacker can write a malicious expression using filters that escapes the sandbox t…
|
CWE-95
Eval Injection
|
CVE-2026-44643
|
2026-05-13 23:54 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2445
|
9.4 |
CRITICAL
Network
|
-
|
-
|
phpVMS is a PHP application to run and simulate an airline. Prior to version 7.0.6, a critical vulnerability in phpVMS allowed unauthenticated access to a legacy import feature. This issue has been p…
|
CWE-284
CWE-306
CWE-862
Improper Access Control
Missing Authentication for Critical Function
Missing Authorization
|
CVE-2026-42569
|
2026-05-13 23:54 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2446
|
8.5 |
HIGH
Local
|
-
|
-
|
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved t…
|
CWE-20
CWE-22
CWE-59
CWE-73
Improper Input Validation
Path Traversal
Link Following
External Control of File Name or Path
|
CVE-2026-43989
|
2026-05-13 23:54 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2447
|
- |
|
-
|
-
|
Craft CMS is a content management system (CMS). From 5.0.0-RC1 to before 5.9.18, AssetsController::actionShowInFolder() fetches an asset by ID and returns its filename and complete folder hierarchy (…
|
CWE-862
Missing Authorization
|
CVE-2026-44012
|
2026-05-13 23:54 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2448
|
9.9 |
CRITICAL
Network
|
openedx
|
openedx
|
Open edX Platform enables the authoring and delivery of online learning at any scale. The sync_provider_data endpoint in SAMLProviderDataViewSet allows authenticated Enterprise Admin users to supply …
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-42858
|
2026-05-13 23:53 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2449
|
8.5 |
HIGH
Network
|
openedx
|
edx-enterprise
|
The Open edx Enterprise Service app provides enterprise features to the Open edX platform. From 7.0.2 to 7.0.4, the sync_provider_data endpoint in SAMLProviderDataViewSet fetches SAML metadata from a…
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-42860
|
2026-05-13 23:50 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2450
|
- |
|
-
|
-
|
Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confide…
|
CWE-693
Protection Mechanism Failure
|
CVE-2024-36315
|
2026-05-13 23:49 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
