|
1551
|
7.7 |
HIGH
Network
|
-
|
-
|
WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSSRFSafeURL() to validat…
New
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-43884
|
2026-05-12 23:50 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1552
|
8.7 |
HIGH
Network
|
-
|
-
|
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, ZipHelper.extract computes the extraction path for each entry by passing a full filesystem path through trimFileAndEx…
New
|
CWE-22
Path Traversal
|
CVE-2026-43888
|
2026-05-12 23:50 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1553
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Outline is a service that allows for collaborative documentation. Prior to 1.7.0, the shares.create API accepts both collectionId and documentId simultaneously and, when published=false, only verifie…
New
|
CWE-863
Incorrect Authorization
|
CVE-2026-43889
|
2026-05-12 23:50 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1554
|
9.6 |
CRITICAL
Network
|
-
|
-
|
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, An incomplete mitigation for CVE-2025-55733 leaves DeepChat vulnerabl…
New
|
CWE-20
Improper Input Validation
|
CVE-2026-43899
|
2026-05-12 23:50 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1555
|
9.3 |
CRITICAL
Network
|
-
|
-
|
DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to v1.0.4-beta.1, a Cross-Site Scripting (XSS) vulnerability exists due to a discrepanc…
New
|
CWE-79
Cross-site Scripting
|
CVE-2026-43900
|
2026-05-12 23:50 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1556
|
8.8 |
HIGH
Network
|
-
|
-
|
Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user-token verification path where the verifyUserToken() function fails to reject payloads containing an admin …
New
|
CWE-290
Authentication Bypass by Spoofing
|
CVE-2026-45223
|
2026-05-12 23:47 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1557
|
7.1 |
HIGH
Local
|
-
|
-
|
Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution that allows attackers to supply absolute or relative paths that resolve outside the inten…
New
|
CWE-22
Path Traversal
|
CVE-2026-45224
|
2026-05-12 23:47 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1558
|
8.1 |
HIGH
Network
|
linuxfoundation
|
dapr
|
Dapr is a portable, event-driven, runtime for building distributed applications across cloud and edge. From versions 1.3.0 to before 1.15.14, 1.16.0-rc.1 to before 1.16.14, and 1.17.0-rc.1 to before …
Update
|
CWE-22
CWE-284
NVD-CWE-noinfo
Path Traversal
Improper Access Control
|
CVE-2026-41491
|
2026-05-12 23:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1559
|
8.2 |
HIGH
Network
|
-
|
-
|
Balbooa Joomla Forms Builder 2.0.6 contains an unauthenticated SQL injection vulnerability in the form submission handler that allows remote attackers to execute arbitrary SQL queries. Attackers can …
Update
|
CWE-89
SQL Injection
|
CVE-2021-47930
|
2026-05-12 23:47 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1560
|
6.4 |
MEDIUM
Network
|
-
|
-
|
Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of files-edi…
Update
|
CWE-79
Cross-site Scripting
|
CVE-2021-47947
|
2026-05-12 23:47 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
