|
1551
|
7.5 |
HIGH
Network
|
benoitc
|
hackney
|
Improper Neutralization of CRLF Sequences vulnerability in benoitc hackney allows HTTP Request Splitting. hackney does not percent-encode carriage return (\r) or line feed (\n) characters in the URL …
|
CWE-93
CRLF Injection
|
CVE-2026-47075
|
2026-05-29 05:26 |
2026-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1552
|
5.4 |
MEDIUM
Network
|
mozilla
|
firefox
|
Firefox for iOS displayed specially crafted right-to-left (RTL) and internationalized domain names (IDNs) incorrectly in link preview UI surfaces. A crafted RTL hostname could visually reorder portio…
|
CWE-451
User Interface (UI) Misrepresentation of Critical Information
|
CVE-2026-9078
|
2026-05-29 05:20 |
2026-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1553
|
4.9 |
MEDIUM
Network
|
apache
|
syncope
|
Exposure of Sensitive Information Through Data Queries vulnerability in Apache Syncope.
An administrator with adequate entitlements for Derived Schemas can create a malicious JEXL expression which a…
|
CWE-202
Exposure of Sensitive Information Through Data Queries
|
CVE-2026-42797
|
2026-05-29 05:19 |
2026-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1554
|
9.9 |
CRITICAL
Network
|
-
|
-
|
Budibase is an open-source low-code platform. Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router: requireSCIM (checks the Enterprise featu…
|
CWE-862
Missing Authorization
|
CVE-2026-46425
|
2026-05-29 05:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1555
|
7.8 |
HIGH
Local
|
codesys
|
development_system
|
The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the comp…
|
CWE-276 NVD-CWE-noinfo
Incorrect Default Permissions
|
CVE-2026-44468
|
2026-05-29 05:11 |
2026-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1556
|
7.0 |
HIGH
Local
|
codesys
|
development_system
|
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU r…
|
CWE-276
Incorrect Default Permissions
|
CVE-2026-44469
|
2026-05-29 05:09 |
2026-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1557
|
7.8 |
HIGH
Local
|
mediaarea
|
mediainfolib
|
MediaArea MediaInfoLib LXF parsing heap-based buffer overflow vulnerability
|
CWE-191
Integer Underflow (Wrap or Wraparound)
|
CVE-2026-25104
|
2026-05-29 05:06 |
2026-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1558
|
7.8 |
HIGH
Local
|
mediaarea
|
mediainfolib
|
MediaArea MediaInfoLib ID3v2 parsing heap buffer overflow vulnerability
|
CWE-122
Heap-based Buffer Overflow
|
CVE-2026-25713
|
2026-05-29 05:03 |
2026-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1559
|
7.5 |
HIGH
Network
|
joomla
|
joomla\!
|
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
|
CWE-287 NVD-CWE-noinfo
Improper Authentication
|
CVE-2026-48896
|
2026-05-29 04:46 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1560
|
7.5 |
HIGH
Network
|
joomla
|
joomla\!
|
Insufficient state checks lead to a vector that allows to bypass 2FA checks.
|
CWE-287
Improper Authentication
|
CVE-2026-48897
|
2026-05-29 04:40 |
2026-05-27 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|