|
861
|
10.0 |
CRITICAL
Network
|
-
|
-
|
Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the JWT_SECRET configuration value. The application accepts any base64-decodable secr…
|
CWE-326
CWE-345
Inadequate Encryption Strength
Insufficient Verification of Data Authenticity
|
CVE-2026-44523
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
862
|
- |
|
-
|
-
|
The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an ope…
|
CWE-601
Open Redirect
|
CVE-2026-44427
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
863
|
6.5 |
MEDIUM
Network
|
vllm
|
vllm
|
vLLM is an inference and serving engine for large language models (LLMs). From to before 0.20.0, the extract_hidden_states speculative decoding proposer in vLLM returns a tensor with an incorrect sh…
|
CWE-131
CWE-704
Incorrect Calculation of Buffer Size
Incorrect Type Conversion or Cast
|
CVE-2026-44223
|
2026-05-16 00:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
864
|
5.3 |
MEDIUM
Network
|
-
|
-
|
Foscam VD1 Video Doorbell before V5.3.13_1072 is vulnerable to Cleartext Transmission of Sensitive Information. The device transmits sensitive Session Description Protocol (SDP), including ICE creden…
|
CWE-319
Cleartext Transmission of Sensitive Information
|
CVE-2026-38740
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
865
|
8.8 |
HIGH
Network
|
-
|
-
|
The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vulnerable to insecure deserialization (CW…
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2026-31219
|
2026-05-16 00:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
866
|
8.8 |
HIGH
Network
|
-
|
-
|
The _load_model() function in the neural_magic_training.py script of the optimate project in commit a6d302f912b481c94370811af6b11402f51d377f (2024-07-21) is vulnerable to insecure deserialization (CW…
|
CWE-502
Deserialization of Untrusted Data
|
CVE-2026-31218
|
2026-05-16 00:16 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
867
|
6.3 |
MEDIUM
Network
|
-
|
-
|
Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf of the user, control the Archon UI features, and steal all …
|
CWE-94
Code Injection
|
CVE-2025-69443
|
2026-05-16 00:16 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
868
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
|
CWE-416
Use After Free
|
CVE-2026-40408
|
2026-05-16 00:11 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
869
|
5.0 |
MEDIUM
Local
|
microsoft
|
visual_studio_code
|
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
|
CWE-59
CWE-79
CWE-200
Link Following
Cross-site Scripting
Information Exposure
|
CVE-2026-41610
|
2026-05-16 00:11 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
870
|
7.0 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.
|
CWE-416
Use After Free
|
CVE-2026-40410
|
2026-05-16 00:10 |
2026-05-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
