|
761
|
5.3 |
MEDIUM
Network
|
-
|
-
|
The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows any authenticated user to retrieve the full content of any…
|
CWE-284
Improper Access Control
|
CVE-2026-32994
|
2026-05-19 23:50 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
762
|
6.3 |
MEDIUM
Adjacent
|
-
|
-
|
There is an unauthorized access vulnerability in ZTE MU5250. Due to improper permission control of the Web interface, an unauthorized attacker can modify configuration through the interface.
|
CWE-200
Information Exposure
|
CVE-2026-44408
|
2026-05-19 23:50 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
763
|
4.3 |
MEDIUM
Network
|
-
|
-
|
Missing Authorization vulnerability in Brainstorm Force Presto Player allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Presto Player: from n/a through 4.1.…
|
CWE-862
Missing Authorization
|
CVE-2026-45442
|
2026-05-19 23:50 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
764
|
5.3 |
MEDIUM
Network
|
google
|
chrome
|
Out of bounds read in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory vi…
|
CWE-125
Out-of-bounds Read
|
CVE-2026-8541
|
2026-05-19 23:47 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
765
|
- |
|
-
|
-
|
The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitr…
|
CWE-639
CWE-915
Authorization Bypass Through User-Controlled Key
Improperly Controlled Modification of Dynamically-Determined Object Attributes
|
CVE-2026-46721
|
2026-05-19 23:47 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
766
|
- |
|
-
|
-
|
The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP req…
|
CWE-611
XXE
|
CVE-2026-46722
|
2026-05-19 23:47 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
767
|
- |
|
-
|
-
|
The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data …
|
CWE-668
Exposure of Resource to Wrong Sphere
|
CVE-2026-46723
|
2026-05-19 23:47 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
768
|
- |
|
-
|
-
|
The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system…
|
CWE-22
Path Traversal
|
CVE-2026-46724
|
2026-05-19 23:47 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
769
|
- |
|
-
|
-
|
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to t…
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2026-46725
|
2026-05-19 23:47 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
770
|
- |
|
-
|
-
|
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "…
|
CWE-89
SQL Injection
|
CVE-2026-8726
|
2026-05-19 23:47 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
