|
501
|
9.8 |
CRITICAL
Network
|
-
|
-
|
PySyft (Syft Datasite/Server) versions 0.9.5 and earlier are vulnerable to remote code execution due to insufficient validation and sandboxing of user-submitted code. The system allows low-privileged…
Update
|
CWE-94
Code Injection
|
CVE-2026-31220
|
2026-05-16 04:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
502
|
7.5 |
HIGH
Network
|
signalk
|
signal_k_server
|
Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.25.0, the HTTP login endpoints (POST /login and POST /signalk/v1/auth/login) are protected by express-…
Update
|
CWE-307
mproper Restriction of Excessive Authentication Attempts
|
CVE-2026-41893
|
2026-05-16 04:14 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
503
|
5.3 |
MEDIUM
Network
|
apache
|
commons_configuration
|
Uncontrolled Recursion vulnerability in Apache Commons.
When processing an untrusted configuration file, Commons Configuration will throw a StackOverflowError for YAML input with cycles.
This issue …
Update
|
CWE-674
Uncontrolled Recursion
|
CVE-2026-45205
|
2026-05-16 03:40 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
504
|
7.4 |
HIGH
Network
|
microsoft
|
authenticator
|
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.
Update
|
CWE-200
Information Exposure
|
CVE-2026-41615
|
2026-05-16 03:39 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
505
|
8.8 |
HIGH
Network
|
microsoft
|
windows_admin_center
|
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
Update
|
CWE-284
Improper Access Control
|
CVE-2026-41086
|
2026-05-16 03:38 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
506
|
9.1 |
CRITICAL
Network
|
microsoft
|
azure_sdk_for_java
|
Improper authentication in Azure SDK allows an unauthorized attacker to bypass a security feature over a network.
Update
|
CWE-287
CWE-347
Improper Authentication
Improper Verification of Cryptographic Signature
|
CVE-2026-33117
|
2026-05-16 03:38 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
507
|
9.9 |
CRITICAL
Network
|
microsoft
|
dynamics_365_customer_insights
|
Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.
Update
|
CWE-269
Improper Privilege Management
|
CVE-2026-33821
|
2026-05-16 03:26 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
508
|
6.5 |
MEDIUM
Network
|
distribution
|
distribution
|
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: fal…
Update
|
CWE-863
Incorrect Authorization
|
CVE-2026-41888
|
2026-05-16 03:25 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
509
|
7.5 |
HIGH
Network
|
mongoosejs
|
mongoose
|
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.9, 7.8.9, 8.22.1, and 9.1.6, a vulnerability allows bypassing Mongoose’s sanitizeFilter query…
Update
|
CWE-74
Injection
|
CVE-2026-42334
|
2026-05-16 03:25 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
510
|
4.3 |
MEDIUM
Network
|
etcd
|
etcd
|
etcd is a distributed key-value store for the data of a distributed system. Prior to 3.4.44, 3.5.30, and 3.6.11, a vulnerability in etcd allows read access via PrevKv, or lease attachment in Put requ…
Update
|
CWE-863
Incorrect Authorization
|
CVE-2026-44283
|
2026-05-16 03:24 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
