|
391
|
7.5 |
HIGH
Network
|
torproject
|
tor
|
Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit, aka TROVE-2026-009.
Update
|
CWE-837
Improper Enforcement of a Single, Unique Action
|
CVE-2026-44601
|
2026-05-9 02:07 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
392
|
7.5 |
HIGH
Network
|
torproject
|
tor
|
Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order, aka TROVE-2026-006.
Update
|
CWE-476
NULL Pointer Dereference
|
CVE-2026-44602
|
2026-05-9 02:06 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
393
|
9.8 |
CRITICAL
Network
|
frappe
|
erpnext
|
ERPNext v15.103.1 and before is vulnerable to Server-Side Template Injection (SSTI). An attacker with permission to create or edit email templates can inject template expressions that are executed on…
Update
|
CWE-94
Code Injection
|
CVE-2026-38431
|
2026-05-9 02:06 |
2026-05-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
394
|
8.8 |
HIGH
Network
|
mathjs
|
mathjs
|
Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has…
Update
|
CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
|
CVE-2026-41139
|
2026-05-9 02:06 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
395
|
6.1 |
MEDIUM
Network
|
frappe
|
erpnext
|
ERPNext v15.103.1 and before is vulnerable to Cross Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript co…
Update
|
CWE-79
Cross-site Scripting
|
CVE-2026-38432
|
2026-05-9 02:05 |
2026-05-6 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
396
|
7.7 |
HIGH
Network
|
istio
|
istio
|
Istio is an open platform to connect, manage, and secure microservices. Prior to versions 1.28.6 and 1.29.2, when a RequestAuthentication resource is created with a jwksUri pointing to an internal se…
Update
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-41413
|
2026-05-9 02:03 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
397
|
9.8 |
CRITICAL
Network
|
openexr
|
openexr
|
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3…
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-42217
|
2026-05-9 02:01 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
398
|
8.8 |
HIGH
Network
|
openexr
|
openexr
|
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3…
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-41142
|
2026-05-9 02:00 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
399
|
9.8 |
CRITICAL
Network
|
hitachi
|
virtual_storage_one_block
|
OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28.
This issue affects Hitachi Virtual Storage Platform On…
Update
|
CWE-78
OS Command
|
CVE-2025-9661
|
2026-05-9 01:59 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
400
|
7.8 |
HIGH
Local
|
zte
|
zxcloud_irai
|
ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability; since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privi…
Update
|
CWE-427
Uncontrolled Search Path Element
|
CVE-2026-44406
|
2026-05-9 01:59 |
2026-05-7 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
