|
611
|
- |
|
-
|
-
|
Diagram's export module is vulnerable to Path Traversal in src attribute due to lack of HTML sanitization. An unauthenticated user could craft the html payload which could include
local files from t…
|
CWE-22
Path Traversal
|
CVE-2026-7182
|
2026-05-15 23:56 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
612
|
- |
|
-
|
-
|
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.9.7 to before 0.10.79, X509Ref::ocsp_responders returns OCSP responder URLs from a certificate's AIA extension as Open…
|
CWE-20
Improper Input Validation
|
CVE-2026-42327
|
2026-05-15 23:55 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
613
|
- |
|
-
|
-
|
OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem pa…
|
CWE-22
Path Traversal
|
CVE-2026-44647
|
2026-05-15 23:55 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
614
|
7.7 |
HIGH
Network
|
-
|
-
|
python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with …
|
CWE-526
Cleartext Storage of Sensitive Information in an Environment Variable
|
CVE-2026-45370
|
2026-05-15 23:55 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
615
|
- |
|
-
|
-
|
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorr…
|
CWE-122
Heap-based Buffer Overflow
|
CVE-2026-44662
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
616
|
4.7 |
MEDIUM
Network
|
-
|
-
|
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between man…
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-44661
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
617
|
- |
|
-
|
-
|
Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID wi…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-44678
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
618
|
- |
|
-
|
-
|
Tuist is a virtual platform team for Swift app devs. Prior to 1.180.10, the forgot password flow allows an unauthenticated attacker to repeatedly trigger password reset emails for a known account wit…
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-44679
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
619
|
- |
|
-
|
-
|
Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of …
|
CWE-295
Improper Certificate Validation
|
CVE-2026-44700
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
620
|
- |
|
-
|
-
|
Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark application allows authenticated users to upload assets to notes via POST /api/notes/{noteID}/assets, …
|
CWE-20
CWE-22
Improper Input Validation
Path Traversal
|
CVE-2026-44522
|
2026-05-15 23:44 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
