|
441
|
- |
|
-
|
-
|
A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server.
New
|
CWE-36
Absolute Path Traversal
|
CVE-2026-32997
|
2026-05-28 14:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
442
|
- |
|
-
|
-
|
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.
New
|
CWE-532
Inclusion of Sensitive Information in Log Files
|
CVE-2026-32996
|
2026-05-28 14:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
443
|
7.5 |
HIGH
Network
|
-
|
-
|
The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 accepts a client-supplied IMessage object and passes it dir…
New
|
CWE-284
Improper Access Control
|
CVE-2026-32995
|
2026-05-28 14:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
444
|
9.9 |
CRITICAL
Network
|
-
|
-
|
A flaw was found in KubeVirt's virt-handler component. This vulnerability allows an authenticated OpenShift user with edit permissions in a single namespace to exploit improper symlink validation whe…
New
|
CWE-59
Link Following
|
CVE-2026-7374
|
2026-05-28 12:16 |
2026-05-26 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
445
|
- |
|
-
|
-
|
Vulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `allowed-hosts` flags to align with MCP security guidelines. Howev…
New
|
CWE-942
Permissive Cross-domain Policy with Untrusted Domains
|
CVE-2026-9739
|
2026-05-28 08:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
446
|
8.8 |
HIGH
Network
|
-
|
-
|
Tanium addressed an unauthorized code execution vulnerability in Connect.
New
|
CWE-78
OS Command
|
CVE-2026-9208
|
2026-05-28 07:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
447
|
9.8 |
CRITICAL
Network
|
-
|
-
|
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From 4.8.0 to before 26.04.1, the Goobi viewer REST endpoint POST /api/v1/index/stream accepted …
New
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-45083
|
2026-05-28 07:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
448
|
- |
|
-
|
-
|
OpenLearnX is an open-source, decentralized learning and assessment platform. Prior to 2.0.4, a critical authentication vulnerability was identified in OpenLearnX that could allow unauthorized access…
New
|
CWE-287 CWE-347
Improper Authentication Improper Verification of Cryptographic Signature
|
CVE-2026-44720
|
2026-05-28 07:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
449
|
6.8 |
MEDIUM
Adjacent
|
-
|
-
|
Volcano is a Kubernetes-native batch scheduling system. Prior to v1.14.2, v1.13.3, and v1.12.4, the Volcano webhook server does not enforce a size limit on incoming HTTP request bodies. Any in-cluste…
New
|
CWE-400 CWE-770
Uncontrolled Resource Consumption Allocation of Resources Without Limits or Throttling
|
CVE-2026-44247
|
2026-05-28 07:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
450
|
9.8 |
CRITICAL
Network
|
-
|
-
|
Gladinet Triofox Cloud Server Agent Access Service (GladServerAgentService.exe) listens on TCP port 7878 and processes remote HTTP messages with URL paths starting with /resources, /status, /sysinfo,…
New
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-8364
|
2026-05-28 06:16 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|