|
1291
|
7.5 |
HIGH
Network
|
golang
|
go
|
A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This vulnerability affects any user using an untrusted module pr…
|
CWE-347
Improper Verification of Cryptographic Signature
|
CVE-2026-42501
|
2026-05-14 01:59 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1292
|
7.5 |
HIGH
Network
|
golang
|
go
|
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
|
NVD-CWE-noinfo
|
CVE-2026-42499
|
2026-05-14 01:59 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1293
|
6.1 |
MEDIUM
Network
|
golang
|
go
|
If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape a…
|
CWE-116
Improper Encoding or Escaping of Output
|
CVE-2026-39826
|
2026-05-14 01:59 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1294
|
5.3 |
MEDIUM
Network
|
golang
|
go
|
ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitize…
|
NVD-CWE-noinfo
|
CVE-2026-39825
|
2026-05-14 01:58 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1295
|
6.1 |
MEDIUM
Network
|
golang
|
go
|
CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune ins…
|
CWE-79
Cross-site Scripting
|
CVE-2026-39823
|
2026-05-14 01:58 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1296
|
4.3 |
MEDIUM
Network
|
-
|
-
|
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. Prior to version 1.12.1, GET /api/workspace/:slug/tts/:chatId in AnythingLL…
|
CWE-200
CWE-639
Information Exposure
Authorization Bypass Through User-Controlled Key
|
CVE-2026-42456
|
2026-05-14 01:58 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1297
|
- |
|
-
|
-
|
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. Prior to 1.3834.0, the CoworkVMService component in Claude Desktop for Window…
|
CWE-59
CWE-269
Link Following
Improper Privilege Management
|
CVE-2026-44470
|
2026-05-14 01:58 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1298
|
5.5 |
MEDIUM
Local
|
-
|
-
|
Vercel’s AI Cloud is a unified platform for building modern applications. From 50.16.0 to 52.0.0, hen the Vercel CLI runs in non-interactive mode (--non-interactive or auto-detected AI agent), comma…
|
CWE-200
CWE-532
Information Exposure
Inclusion of Sensitive Information in Log Files
|
CVE-2026-44479
|
2026-05-14 01:58 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1299
|
- |
|
-
|
-
|
The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development fea…
|
CWE-297
CWE-322
Improper Validation of Certificate with Host Mismatch
Key Exchange without Entity Authentication
|
CVE-2026-44467
|
2026-05-14 01:58 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1300
|
9.1 |
CRITICAL
Network
|
-
|
-
|
auth provides authentication via oauth2, direct and email. From versions 1.18.0 to before 1.25.2 and 2.0.0 to before 2.1.2, the Patreon OAuth provider maps every authenticated Patreon account to the …
|
CWE-287
Improper Authentication
|
CVE-2026-42560
|
2026-05-14 01:58 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
