|
991
|
5.3 |
MEDIUM
Network
|
-
|
-
|
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote a…
New
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-44545
|
2026-06-5 00:21 |
2026-06-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
992
|
3.7 |
LOW
Network
|
-
|
-
|
daphne before 4.2.2 reconstructs a raw HTTP request from Twisted's parsed headers and feeds it to autobahn for WebSocket handshake processing. Twisted does not treat \x0b, \x0c, \x1c, \x1d, \x1e, or …
New
|
CWE-444
HTTP Request Smuggling
|
CVE-2026-44546
|
2026-06-5 00:21 |
2026-06-3 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
993
|
- |
|
-
|
-
|
Net::Async::Statsd::Client versions through 0.005 for Perl allow metric injections.
The metric names are not checked for newlines, colons or pipes. Metrics generated from untrusted sources could inj…
New
|
CWE-93
CRLF Injection
|
CVE-2026-8722
|
2026-06-5 00:21 |
2026-06-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
994
|
7.5 |
HIGH
Network
|
-
|
-
|
HTML::Entities versions before 3.84 for Perl read freed heap memory in _decode_entities.
The XS routine backing HTML::Entities::_decode_entities cached a pointer (repl) into the entity-value SV retu…
New
|
CWE-416
Use After Free
|
CVE-2026-8829
|
2026-06-5 00:21 |
2026-06-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
995
|
7.5 |
HIGH
Network
|
-
|
-
|
Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to a Denial o…
New
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2025-46638
|
2026-06-5 00:21 |
2026-06-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
996
|
- |
|
-
|
-
|
Concrete CMS below 9.5.2 is vulnerable to PHP Object Injection via unserialize() calls in the Workflow, Form block, and File/Set components that lack the allowed_classes restriction. An unauthenticat…
New
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2026-7888
|
2026-06-5 00:20 |
2026-06-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
997
|
9.8 |
CRITICAL
Network
|
-
|
-
|
Authorization bypass through User-Controlled SQL primary key vulnerability in Akmer Informatics Automation Industry and Trade Ltd. Co. TeknoPass allows SQL Injection.
This issue affects TeknoPass: f…
New
|
CWE-89
SQL Injection
|
CVE-2026-4104
|
2026-06-5 00:20 |
2026-06-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
998
|
- |
|
-
|
-
|
An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching template already e…
New
|
CWE-862
Missing Authorization
|
CVE-2026-10855
|
2026-06-5 00:19 |
2026-06-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
999
|
- |
|
-
|
-
|
A URL validation flaw in the MISP dashboard button widget allowed a crafted relative-looking URL to be accepted as a local path while being interpreted by browsers as an external URL. The validation …
New
|
CWE-601
Open Redirect
|
CVE-2026-10856
|
2026-06-5 00:19 |
2026-06-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1000
|
- |
|
-
|
-
|
An open redirect vulnerability existed in MISP UsersController::routeafterlogin() because the value stored in the pre_login_requested_url session key was used as the post-login redirect destination w…
New
|
CWE-601
Open Redirect
|
CVE-2026-10861
|
2026-06-5 00:19 |
2026-06-4 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
