|
2431
|
6.3 |
MEDIUM
Network
|
-
|
-
|
The software fails to enforce role-based access controls for certain Gateway API invocations. Users with the 'Internal/Everyone' role can invoke these APIs, bypassing intended permission checks. This…
|
CWE-281
Improper Preservation of Permissions
|
CVE-2025-8325
|
2026-05-14 00:25 |
2026-05-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2432
|
8.6 |
HIGH
Network
|
-
|
-
|
The Magic Link authentication flow accepts multiple invalid authentication requests without adequate rate limiting or resource control, leading to uncontrolled memory usage growth.
This vulnerabilit…
|
CWE-400
Uncontrolled Resource Consumption
|
CVE-2025-10470
|
2026-05-14 00:25 |
2026-05-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2433
|
6.4 |
MEDIUM
Adjacent
|
-
|
-
|
Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be triggered on unintended organizations.…
|
CWE-284
CWE-863
Improper Access Control
Incorrect Authorization
|
CVE-2025-9973
|
2026-05-14 00:25 |
2026-05-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2434
|
6.1 |
MEDIUM
Local
|
-
|
-
|
Issuing an ICMP ping via the `net ping` shell command to a device's own IPv4 address causes the network stack to recursively re-enter the input path on the same system work-queue stack. Because the d…
|
CWE-674
Uncontrolled Recursion
|
CVE-2026-1681
|
2026-05-14 00:25 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2435
|
8.3 |
HIGH
Network
|
-
|
-
|
Plainpad is a self hosted note taking app. Prior to version 1.1.1, Plainpad allows a low-privilege authenticated user to self-escalate to administrator by submitting admin=true in PUT /api.php/v1/use…
|
CWE-269
Improper Privilege Management
|
CVE-2026-42562
|
2026-05-14 00:23 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2436
|
- |
|
-
|
-
|
Pelican is a platform for creating data federations. From versions 7.21.0 to before 7.21.5, 7.22.0 to before 7.22.3, 7.23.0 to before 7.23.3, and 7.24.0 to before 7.24.2, there is a a privilege escal…
|
CWE-863
Incorrect Authorization
|
CVE-2026-42571
|
2026-05-14 00:23 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2437
|
7.5 |
HIGH
Network
|
-
|
-
|
apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target poi…
|
CWE-22
CWE-59
Path Traversal
Link Following
|
CVE-2026-42574
|
2026-05-14 00:23 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2438
|
6.5 |
MEDIUM
Network
|
-
|
-
|
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, DiscoverKeys in pkg/apk/apk/implementation.go unconditionally type-asserts JWKS keys as *r…
|
CWE-704
Incorrect Type Conversion or Cast
|
CVE-2026-42576
|
2026-05-14 00:23 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2439
|
7.5 |
HIGH
Network
|
-
|
-
|
apko allows users to build and publish OCI container images built from apk packages. Prior to version 1.2.7, apko verifies the signature on APKINDEX.tar.gz but never compares individually downloaded …
|
CWE-345
CWE-494
Insufficient Verification of Data Authenticity
Download of Code Without Integrity Check
|
CVE-2026-42575
|
2026-05-14 00:23 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2440
|
7.5 |
HIGH
Network
|
golang
|
go
|
The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0).
|
CWE-476
NULL Pointer Dereference
|
CVE-2026-39836
|
2026-05-14 00:11 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
