|
1
|
6.5 |
MEDIUM
Local
|
xen
|
xen
|
Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES
command within a transaction due to an assert() triggering.
In case xenstored was built with NDEBUG #defined nothing bad will
hap…
New
|
CWE-617
Reachable Assertion
|
CVE-2026-23557
|
2026-05-20 03:56 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2
|
7.8 |
HIGH
Local
|
xen
|
xen
|
The adjustments made for XSA-379 as well as those subsequently becoming
XSA-387 still left a race window, when a HVM or PVH guest does a grant
table version change from v2 to v1 in parallel with mapp…
New
|
CWE-362
Race Condition
|
CVE-2026-23558
|
2026-05-20 03:55 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3
|
7.5 |
HIGH
Network
|
langgenius
|
dify
|
Dify version 1.14.1 and prior contain an authorization bypass vulnerability in the file preview endpoint that allows any authenticated user to read up to 3,000 characters of any uploaded document acr…
New
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-41949
|
2026-05-20 03:50 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
4
|
7.5 |
HIGH
Network
|
mozilla
|
firefox
thunderbird
|
Incorrect boundary conditions in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
New
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2026-8946
|
2026-05-20 03:50 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5
|
7.3 |
HIGH
Network
|
mozilla
|
firefox
thunderbird
|
Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
New
|
CWE-416
Use After Free
|
CVE-2026-8947
|
2026-05-20 03:47 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
6
|
9.6 |
CRITICAL
Network
|
mozilla
|
firefox
thunderbird
|
Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140…
New
|
CWE-416
Use After Free
|
CVE-2026-8953
|
2026-05-20 03:45 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
7
|
7.5 |
HIGH
Network
|
mozilla
|
firefox
thunderbird
|
Incorrect boundary conditions, integer overflow in the Audio/Video component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
New
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2026-8954
|
2026-05-20 03:42 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
8
|
4.3 |
MEDIUM
Network
|
microsoft
|
365_apps
office
office_long_term_servicing_channel
word
|
External control of file name or path in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
Update
|
CWE-73
External Control of File Name or Path
|
CVE-2026-40421
|
2026-05-20 03:38 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
9
|
7.8 |
HIGH
Local
|
microsoft
|
office
office_long_term_servicing_channel
|
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Update
|
CWE-122
Heap-based Buffer Overflow
|
CVE-2026-42831
|
2026-05-20 03:38 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
10
|
5.5 |
MEDIUM
Local
|
microsoft
|
excel
office
office_long_term_servicing_channel
word
|
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
Update
|
CWE-284
NVD-CWE-noinfo
Improper Access Control
|
CVE-2026-42832
|
2026-05-20 03:38 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
