|
411
|
3.1 |
LOW
Network
|
-
|
-
|
Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to bypass site Isolation v…
New
|
CWE-20
Improper Input Validation
|
CVE-2026-8536
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
412
|
3.6 |
LOW
Local
|
-
|
-
|
Vim is an open source, command line text editor. Prior to 9.2.0479, a command injection vulnerability exists in tar#Vimuntar() in
runtime/autoload/tar.vim when decompressing .tgz archives on Unix-lik…
New
|
CWE-78
CWE-88
OS Command
Argument Injection
|
CVE-2026-46483
|
2026-05-16 00:16 |
2026-05-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
413
|
4.3 |
MEDIUM
Network
|
-
|
-
|
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, broken access control in the searchAsset, searchTag, searchWidget, and searchTemplate publish-mode Readers can enumerate…
New
|
CWE-863
Incorrect Authorization
|
CVE-2026-45148
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
414
|
7.5 |
HIGH
Network
|
-
|
-
|
libyang is a YANG data modeling language library. Prior to SO 5.2.15, lyb_read_string() in src/parser_lyb.c contains an integer overflow that results in a heap buffer overflow when parsing a maliciou…
New
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-44673
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
415
|
- |
|
-
|
-
|
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the kernel stores Attribute View (AV / database) names without any HTML escape, then a render template uses raw strings.…
New
|
CWE-79
CWE-94
CWE-1188
Cross-site Scripting
Code Injection
Insecure Default Initialization of Resource
|
CVE-2026-44670
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
416
|
- |
|
-
|
-
|
HRConvert2 is a self-hosted, drag-and-drop & nosql file conversion server & share tool. Prior to 3.3.8, the sanitizeString() function in convertCore.php is missing backtick (`) and tab (\t) from its …
New
|
CWE-78
OS Command
|
CVE-2026-44666
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
417
|
- |
|
-
|
-
|
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, he tooltip mouseover handler in app/src/block/popover.ts reads aria-label via getAttribute and passes it through decode…
New
|
CWE-79
CWE-116
CWE-1188
Cross-site Scripting
Improper Encoding or Escaping of Output
Insecure Default Initialization of Resource
|
CVE-2026-44588
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
418
|
10.0 |
CRITICAL
Network
|
-
|
-
|
Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secr…
New
|
CWE-326
CWE-345
Inadequate Encryption Strength
Insufficient Verification of Data Authenticity
|
CVE-2026-44523
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
419
|
- |
|
-
|
-
|
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an ope…
New
|
CWE-601
Open Redirect
|
CVE-2026-44427
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
420
|
6.5 |
MEDIUM
Network
|
vllm
|
vllm
|
vLLM is an inference and serving engine for large language models (LLMs). From to before 0.20.0, the extract_hidden_states speculative decoding proposer in vLLM returns a tensor with an incorrect sh…
Update
|
CWE-131
CWE-704
Incorrect Calculation of Buffer Size
Incorrect Type Conversion or Cast
|
CVE-2026-44223
|
2026-05-16 00:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
