|
1651
|
2.4 |
LOW
Network
|
-
|
-
|
Geyser is a bridge between Minecraft: Bedrock Edition and Minecraft: Java Edition. Prior to 2.9.3, a server-side request forgery (SSRF) vulnerability exists in Geyser’s handling of Bedrock player hea…
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-42188
|
2026-05-14 01:32 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1652
|
- |
|
-
|
-
|
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group() and Address6.link() do not HTML-escape attacker-controlled content before…
|
CWE-79
Cross-site Scripting
|
CVE-2026-42338
|
2026-05-14 01:32 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1653
|
- |
|
-
|
-
|
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. In AutoGPT, the execution process is recorded to the c…
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2025-32425
|
2026-05-14 01:32 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1654
|
8.8 |
HIGH
Network
|
-
|
-
|
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.0.0 to 4.5.6, the allow-list of extensions that can be installed…
|
CWE-88
CWE-602
Argument Injection
Client-Side Enforcement of Server-Side Security
|
CVE-2026-42266
|
2026-05-14 01:32 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1655
|
7.8 |
HIGH
Local
|
-
|
-
|
protobufjs-cli is the command line add-on for protobuf.js. Prior to 1.2.1 and 2.0.2, pbts invoked JSDoc by building a shell command string from input file paths and executing it through child_process…
|
CWE-78
OS Command
|
CVE-2026-42290
|
2026-05-14 01:32 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1656
|
- |
|
-
|
-
|
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlink…
|
CWE-79
Cross-site Scripting
|
CVE-2026-42557
|
2026-05-14 01:32 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1657
|
5.3 |
MEDIUM
Network
|
-
|
-
|
linux-entra-sso is a browser plugin for Linux to SSO on Microsoft Entra ID. Prior to 1.8.1, platform/chrome/js/platform-chrome.js:69-88 registers a single declarativeNetRequest rule whose urlFilter i…
|
CWE-284
CWE-436
Improper Access Control
Interpretation Conflict
|
CVE-2026-42177
|
2026-05-14 01:31 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1658
|
8.1 |
HIGH
Network
|
-
|
-
|
An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.
Note: Software versions which have re…
|
CWE-22
Path Traversal
|
CVE-2026-20916
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1659
|
6.8 |
MEDIUM
Network
|
-
|
-
|
When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cros…
|
CWE-35
Path Traversal: '.../...//'
|
CVE-2026-24464
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1660
|
4.4 |
MEDIUM
Local
|
-
|
-
|
When BIG-IP DNS is provisioned, a vulnerability exists in the gtm_add and bigip_add iControl REST commands that return the ssh-password parameter in cleartext in the iControl REST response and is als…
|
CWE-312
Cleartext Storage of Sensitive Information
|
CVE-2026-28758
|
2026-05-14 01:27 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
