|
1021
|
3.2 |
LOW
Local
|
-
|
-
|
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.
New
|
CWE-312
Cleartext Storage of Sensitive Information
|
CVE-2026-45362
|
2026-05-12 10:16 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1022
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A flaw has been found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGAP Message Handler. Executing a manipulation can lead to memory corruption. The attac…
New
|
CWE-119
Incorrect Access of Indexable Resource ('Range Error')
|
CVE-2026-8349
|
2026-05-12 09:17 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1023
|
3.0 |
LOW
Network
|
-
|
-
|
In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.
Update
|
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
|
CVE-2026-44916
|
2026-05-12 09:17 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1024
|
2.9 |
LOW
Local
|
-
|
-
|
In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately sized crafted XML input.
New
|
CWE-407
Inefficient Algorithmic Complexity
|
CVE-2026-45186
|
2026-05-12 08:20 |
2026-05-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1025
|
8.1 |
HIGH
Network
|
-
|
-
|
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden allows an unconfirmed organization owner to purge the entire organization vault. The organization invite flo…
New
|
CWE-863
Incorrect Authorization
|
CVE-2026-43913
|
2026-05-12 08:20 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1026
|
- |
|
-
|
-
|
Fiber is a web framework for Go. Prior to 2.52.12 and 3.1.0, Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html…
New
|
CWE-79
Cross-site Scripting
|
CVE-2026-42554
|
2026-05-12 08:19 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1027
|
8.4 |
HIGH
Local
|
-
|
-
|
barebox version prior to 2026.04.0 contains multiple memory-safety vulnerabilities in the EFI PE loader in efi/loader/pe.c where integer overflow in virtual image size computation using 32-bit arithm…
New
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-34963
|
2026-05-12 08:19 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1028
|
6.2 |
MEDIUM
Local
|
-
|
-
|
barebox version prior to 2026.04.0 contains a denial-of-service vulnerability in ext4 directory parsing in fs/ext4/ext4_common.c where the ext4fs_iterate_dir() function fails to validate that directo…
New
|
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
|
CVE-2026-34962
|
2026-05-12 08:19 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1029
|
- |
|
-
|
-
|
Link Preview JS extracts web links information. Prior to 4.0.1, the library did not check for IPv6 loopback attacks. There was also a DNS attack, where an address could be resolved into an internal I…
New
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-43897
|
2026-05-12 07:22 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1030
|
8.2 |
HIGH
Network
|
-
|
-
|
exiftool-vendored provides cross-platform Node.js access to ExifTool. Prior to 35.19.0, exiftool-vendored starts ExifTool in -stay_open True -@ - mode, where arguments are read from stdin one per lin…
New
|
CWE-88
Argument Injection
|
CVE-2026-43893
|
2026-05-12 07:22 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
