|
1241
|
7.5 |
HIGH
Network
|
-
|
-
|
HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address…
|
CWE-348
Use of Less Trusted Source
|
CVE-2026-43634
|
2026-05-20 02:57 |
2026-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1242
|
7.5 |
HIGH
Network
|
-
|
-
|
Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal metho…
|
CWE-862
Missing Authorization
|
CVE-2026-47100
|
2026-05-20 02:57 |
2026-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1243
|
9.8 |
CRITICAL
Network
|
-
|
-
|
Tyler Identity Local (TID-L) uses documented, default administrative credentials. Users are not required to change the credentials before deployment. TID-L has not been distributed since December 202…
|
CWE-1392
Use of Default Credentials
|
CVE-2026-44159
|
2026-05-20 02:57 |
2026-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1244
|
5.8 |
MEDIUM
Network
|
-
|
-
|
Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker in control of a domain can cause a vulnerable system to generate excessive network tr…
|
CWE-405
CWE-406
CWE-770
Asymmetric Resource Consumption (Amplification)
Insufficient Control of Network Message Volume (Network Amplification)
Allocation of Resources Without Limits or Throttling
|
CVE-2026-45557
|
2026-05-20 02:57 |
2026-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1245
|
8.4 |
HIGH
Local
|
-
|
-
|
An improper authentication vulnerability was discovered in the Motorola Factory Test component (com.motorola.motocit). The application contained a reference to a writable file descriptor in external …
|
-
|
CVE-2026-5804
|
2026-05-20 02:57 |
2026-05-20 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1246
|
5.0 |
MEDIUM
Network
|
mattermost
|
mattermost_server
|
Mattermost versions 11.5.x <= 11.5.1, 10.11.x <= 10.11.13 fail to validate the Host header when constructing response URLs for custom slash commands which allows an authenticated attacker to redirect…
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-6333
|
2026-05-20 02:51 |
2026-05-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1247
|
4.8 |
MEDIUM
Network
|
nozominetworks
|
cmc
guardian
|
A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administrative privileges ca…
|
CWE-79
Cross-site Scripting
|
CVE-2025-40901
|
2026-05-20 02:47 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1248
|
9.8 |
CRITICAL
Network
|
h2o
|
h2o
|
A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a…
|
CWE-20
CWE-502
Improper Input Validation
Deserialization of Untrusted Data
|
CVE-2026-8751
|
2026-05-20 02:46 |
2026-05-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1249
|
4.8 |
MEDIUM
Network
|
nozominetworks
|
cmc
guardian
|
A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can create a mal…
|
CWE-79
Cross-site Scripting
|
CVE-2025-40902
|
2026-05-20 02:44 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1250
|
4.8 |
MEDIUM
Network
|
nozominetworks
|
cmc
guardian
|
A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authenticated user with administrative privileg…
|
CWE-79
Cross-site Scripting
|
CVE-2025-40903
|
2026-05-20 02:44 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
