|
1851
|
- |
|
-
|
-
|
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, t…
|
CWE-89
SQL Injection
|
CVE-2026-41889
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1852
|
- |
|
-
|
-
|
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_sh…
|
CWE-94
CWE-502
Code Injection
Deserialization of Untrusted Data
|
CVE-2026-41486
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1853
|
8.1 |
HIGH
Network
|
-
|
-
|
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applica…
|
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
|
CVE-2026-41883
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1854
|
7.5 |
HIGH
Network
|
-
|
-
|
locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener("message", …) handler that dispatches to regist…
|
CWE-79
CWE-346
Cross-site Scripting
Origin Validation Error
|
CVE-2026-41886
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1855
|
9.8 |
CRITICAL
Network
|
-
|
-
|
Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRE…
|
CWE-1392
Use of Default Credentials
|
CVE-2026-42072
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1856
|
5.5 |
MEDIUM
Network
|
-
|
-
|
People is an application to handle users and teams, and distribute permissions across La Suite. Prior to version 1.25.0, a user holding the Administrator role on a mail domain could send a crafted in…
|
CWE-269
Improper Privilege Management
|
CVE-2026-42185
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1857
|
6.5 |
MEDIUM
Network
|
-
|
-
|
nova-toggle-5 enables fliping booleans in the index. Prior to version 1.3.0, the toggle endpoint (POST/nova-vendor/nova-toggle/toggle/{resource}/{resourceId}) was protected only by web + auth:<guard>…
|
CWE-285
Improper Authorization
|
CVE-2026-42202
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1858
|
2.4 |
LOW
Network
|
-
|
-
|
Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player hea…
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-42188
|
2026-05-14 01:32 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1859
|
- |
|
-
|
-
|
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, the execution process is recorded to the c…
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2025-32425
|
2026-05-14 01:32 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1860
|
8.8 |
HIGH
Network
|
-
|
-
|
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed…
|
CWE-88
CWE-602
Argument Injection
Client-Side Enforcement of Server-Side Security
|
CVE-2026-42266
|
2026-05-14 01:32 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
