|
651
|
8.2 |
HIGH
Local
|
-
|
-
|
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Versions prior to 3.5.7 contain a path traversal vulnerability in the importer which allows o…
New
|
CWE-24
Path Traversal: '../filedir'
|
CVE-2026-22810
|
2026-05-20 00:03 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
652
|
9.8 |
CRITICAL
Network
|
-
|
-
|
WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.24.0 contain a command injection vulnerability leading to r…
New
|
CWE-78
OS Command
|
CVE-2026-25244
|
2026-05-20 00:03 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
653
|
7.0 |
HIGH
Local
|
-
|
-
|
In mlflow/mlflow versions prior to 3.11.0, the `get_or_create_nfs_tmp_dir()` function in `mlflow/utils/file_utils.py` creates temporary directories with world-writable permissions (0o777), and the `_…
New
|
CWE-378
Creation of Temporary File With Insecure Permissions
|
CVE-2026-4137
|
2026-05-20 00:03 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
654
|
- |
|
-
|
-
|
GLPI is a free asset and IT management software package. In versions 11.0.0 through 11.0.6, an authenticated user with forms READ permission can export the structure of unauthorized forms. This issue…
New
|
CWE-862
Missing Authorization
|
CVE-2026-32312
|
2026-05-20 00:03 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
655
|
7.3 |
HIGH
Local
|
-
|
-
|
Mullvad VPN is a VPN client app for desktop and mobile. When using macOS with versions 2026.1 and below, Mullvad VPN may allow local privilege escalation during installation or upgrade. The installer…
New
|
CWE-269
CWE-345
CWE-427
Improper Privilege Management
Insufficient Verification of Data Authenticity
Uncontrolled Search Path Element
|
CVE-2026-32323
|
2026-05-20 00:03 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
656
|
9.6 |
CRITICAL
Network
|
-
|
-
|
In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests fr…
New
|
CWE-346
Origin Validation Error
|
CVE-2026-2611
|
2026-05-20 00:03 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
657
|
5.4 |
MEDIUM
Network
|
microsoft
|
edge_chromium
|
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Update
|
CWE-20
NVD-CWE-noinfo
Improper Input Validation
|
CVE-2026-45492
|
2026-05-20 00:03 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
658
|
8.8 |
HIGH
Network
|
google
|
chrome
|
Use after free in Media in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
|
CWE-416
Use After Free
|
CVE-2026-8544
|
2026-05-19 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
659
|
3.1 |
LOW
Network
|
google
|
chrome
|
Object corruption in Compositing in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromi…
|
CWE-119
CWE-284
Incorrect Access of Indexable Resource ('Range Error')
Improper Access Control
|
CVE-2026-8545
|
2026-05-19 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
660
|
- |
|
-
|
-
|
A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build…
|
CWE-209
Information Exposure Through an Error Message
|
CVE-2026-7860
|
2026-05-19 23:50 |
2026-05-19 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
