|
131
|
7.5 |
HIGH
Network
|
-
|
-
|
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes POST /api/chart/:chart_id/query with…
New
|
CWE-862
Missing Authorization
|
CVE-2026-40601
|
2026-05-2 00:31 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
132
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes a legacy dashboard route that return…
New
|
CWE-284
Improper Access Control
|
CVE-2026-40603
|
2026-05-2 00:31 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
133
|
8.1 |
HIGH
Network
|
-
|
-
|
Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes multiple dataset and dataRequest end…
New
|
CWE-284
Improper Access Control
|
CVE-2026-40904
|
2026-05-2 00:31 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
134
|
4.4 |
MEDIUM
Local
|
-
|
-
|
Notepad++ 8.9.3 contains a format string injection vulnerability in the Find Results panel handler that allows attackers to cause denial of service and information disclosure by crafting a malicious …
New
|
CWE-134
Use of Externally-Controlled Format String
|
CVE-2026-6539
|
2026-05-2 00:29 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
135
|
8.8 |
HIGH
Network
|
-
|
-
|
HKUDS OpenHarness contains a remote code execution vulnerability in the /bridge slash command that allows remote senders accepted by configuration to execute arbitrary operating system commands. Atta…
New
|
CWE-78
OS Command
|
CVE-2026-7551
|
2026-05-2 00:29 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
136
|
4.6 |
MEDIUM
Network
|
-
|
-
|
SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitrary JavaScript by crafting malicious STL template payloads t…
New
|
CWE-79
Cross-site Scripting
|
CVE-2026-7429
|
2026-05-2 00:28 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
137
|
7.2 |
HIGH
Network
|
-
|
-
|
SSCMS v7.4.0 contains a SQL injection vulnerability in the stl:sqlContent tag where the queryString attribute is passed directly to database execution without parameterization or sanitization. Attack…
New
|
CWE-89
SQL Injection
|
CVE-2026-7435
|
2026-05-2 00:28 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
138
|
- |
|
-
|
-
|
CVE-2026-33446 is a buffer overflow in the authentication sub-system of
the Secure Access client prior to 14.50. Attackers with control of a
modified server can send a special packet that can overw…
New
|
CWE-120
Classic Buffer Overflow
|
CVE-2026-33446
|
2026-05-2 00:28 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
139
|
- |
|
-
|
-
|
CVE-2026-33447 is a buffer overflow in a message parsing function of the
Secure Access client prior to 14.50. Attackers with control of a
modified server can send a special packet that can overwrit…
New
|
CWE-121
Stack-based Buffer Overflow
|
CVE-2026-33447
|
2026-05-2 00:28 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
140
|
- |
|
-
|
-
|
CVE-2026-33448 is a format string vulnerability in the logging subsystem
of Secure Access client for MacOS prior to 14.50. Attackers with
control of a modified server can force the client to dump t…
New
|
CWE-200
Information Exposure
|
CVE-2026-33448
|
2026-05-2 00:28 |
2026-05-1 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
