|
961
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=register of the com…
|
CWE-79
CWE-94
Cross-site Scripting
Code Injection
|
CVE-2026-7401
|
2026-04-30 06:16 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
962
|
7.5 |
HIGH
Network
|
-
|
-
|
PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `re…
|
CWE-22
Path Traversal
|
CVE-2026-41180
|
2026-04-30 06:08 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
963
|
8.2 |
HIGH
Network
|
-
|
-
|
Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An attacker can upload a specially crafted i…
|
CWE-400
CWE-770
Uncontrolled Resource Consumption
Allocation of Resources Without Limits or Throttling
|
CVE-2026-41309
|
2026-04-30 05:56 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
964
|
8.1 |
HIGH
Network
|
-
|
-
|
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution…
|
CWE-693
Protection Mechanism Failure
|
CVE-2026-41316
|
2026-04-30 05:56 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
965
|
9.1 |
CRITICAL
Network
|
-
|
-
|
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowi…
|
CWE-436
CWE-863
Interpretation Conflict
Incorrect Authorization
|
CVE-2026-41248
|
2026-04-30 05:56 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
966
|
9.1 |
CRITICAL
Network
|
-
|
-
|
Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields direct…
|
CWE-89
SQL Injection
|
CVE-2026-41167
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
967
|
5.3 |
MEDIUM
Network
|
-
|
-
|
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redacti…
|
CWE-200
CWE-359
CWE-532
Information Exposure
Exposure of Private Personal Information to an Unauthorized Actor
Inclusion of Sensitive Information in Log Files
|
CVE-2026-41182
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
968
|
- |
|
-
|
-
|
Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can i…
|
CWE-131
Incorrect Calculation of Buffer Size
|
CVE-2026-41197
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
969
|
- |
|
-
|
-
|
STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scrip…
|
CWE-79
Cross-site Scripting
|
CVE-2026-41200
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
970
|
7.8 |
HIGH
Local
|
linux
|
linux_kernel
|
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Limit PTP to a single page
Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256
playback streams, but…
|
NVD-CWE-noinfo
|
CVE-2026-31602
|
2026-04-30 05:16 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
