|
881
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Textpattern CMS 4.9.0 contains a Broken Access Control vulnerability in the article management system that allows authenticated users with low privileges to modify articles owned by users with higher…
|
CWE-284
Improper Access Control
|
CVE-2026-30452
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
882
|
7.3 |
HIGH
Network
|
-
|
-
|
Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the do_ping_action function via the hostName parameter. This vulnerability allows attackers to execute arbitrary …
|
CWE-77
Command Injection
|
CVE-2026-38834
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
883
|
9.8 |
CRITICAL
Network
|
-
|
-
|
Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName parameter. This vulnerability allows attackers to…
|
CWE-77
Command Injection
|
CVE-2026-38835
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
884
|
9.8 |
CRITICAL
Network
|
-
|
-
|
CrowdStrike has released security updates to address a critical unauthenticated path traversal vulnerability (CVE-2026-40050) in LogScale. This vulnerability only requires mitigation by customers tha…
|
CWE-22
CWE-306
Path Traversal
Missing Authentication for Critical Function
|
CVE-2026-40050
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
885
|
3.7 |
LOW
Network
|
-
|
-
|
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to 1.4.3, decode_signed32() in src/bacnet/bacint.c reconstructs a 32-bit signed integer from four APDU bytes …
|
CWE-758
Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
|
CVE-2026-40279
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
886
|
- |
|
-
|
-
|
UltraDAG is a minimal DAG-BFT blockchain in Rust. In version 0.1, a non-council attacker can submit a signed SmartOp::Vote transaction that passes signature, nonce, and balance prechecks, but fails a…
|
CWE-460
CWE-696
Improper Cleanup on Thrown Exception
Incorrect Behavior Order
|
CVE-2026-40583
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
887
|
6.8 |
MEDIUM
Network
|
-
|
-
|
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Prior to 7.15.2, an authorization bypass exists in OAuth2 Proxy as part of the email_domain enforcement option. An…
|
CWE-863
Incorrect Authorization
|
CVE-2026-40574
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
888
|
- |
|
-
|
-
|
RansomLook is a tool to monitor Ransomware groups and markets and extract their victims. Prior to 1.9.0, the API in the affected application improperly filters private location entries in website/web…
|
CWE-200
Information Exposure
|
CVE-2026-40584
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
889
|
9.0 |
CRITICAL
Network
|
-
|
-
|
An insecure direct object reference vulnerability in the Users API component of Crafty Controller allows a remote, authenticated attacker to perform user modification actions via improper API permiss…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-5652
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
890
|
4.8 |
MEDIUM
Network
|
-
|
-
|
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev98, the set_session_cookie_secure before_request handler in src/pyload/webui/app/__init__.py reads the X-Forwa…
|
CWE-346
Origin Validation Error
|
CVE-2026-40594
|
2026-04-23 06:24 |
2026-04-22 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
