|
321
|
7.3 |
HIGH
Network
|
-
|
-
|
A weakness has been identified in florensiawidjaja BioinfoMCP up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54. This vulnerability affects the function Upload of the file bioinfo_mcp_platform/app.py of…
New
|
CWE-22
Path Traversal
|
CVE-2026-7398
|
2026-04-30 06:16 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
322
|
7.3 |
HIGH
Network
|
-
|
-
|
A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0. This issue affects the function is_path_allowed of the file server.py of the component read_file_tool/write_file_…
New
|
CWE-22
Path Traversal
|
CVE-2026-7400
|
2026-04-30 06:16 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
323
|
4.3 |
MEDIUM
Network
|
-
|
-
|
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=register of the com…
New
|
CWE-79
CWE-94
Cross-site Scripting
Code Injection
|
CVE-2026-7401
|
2026-04-30 06:16 |
2026-04-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
324
|
7.5 |
HIGH
Network
|
-
|
-
|
PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under `/files/:uploadId` validates the mounted request path using the still-encoded `re…
Update
|
CWE-22
Path Traversal
|
CVE-2026-41180
|
2026-04-30 06:08 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
325
|
8.2 |
HIGH
Network
|
-
|
-
|
Open Source Social Network (OSSN) is open-source social networking software developed in PHP. Versions prior to 9.0 are vulnerable to resource exhaustion. An attacker can upload a specially crafted i…
Update
|
CWE-400
CWE-770
Uncontrolled Resource Consumption
Allocation of Resources Without Limits or Throttling
|
CVE-2026-41309
|
2026-04-30 05:56 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
326
|
8.1 |
HIGH
Network
|
-
|
-
|
ERB is a templating system for Ruby. Ruby 2.7.0 (before ERB 2.2.0 was published on rubygems.org) introduced an `@_init` instance variable guard in `ERB#result` and `ERB#run` to prevent code execution…
Update
|
CWE-693
Protection Mechanism Failure
|
CVE-2026-41316
|
2026-04-30 05:56 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
327
|
9.1 |
CRITICAL
Network
|
-
|
-
|
Clerk JavaScript is the official JavaScript repository for Clerk authentication. createRouteMatcher in @clerk/nextjs, @clerk/nuxt, and @clerk/astro can be bypassed by certain crafted requests, allowi…
Update
|
CWE-436
CWE-863
Interpretation Conflict
Incorrect Authorization
|
CVE-2026-41248
|
2026-04-30 05:56 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
328
|
9.1 |
CRITICAL
Network
|
-
|
-
|
Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields direct…
Update
|
CWE-89
SQL Injection
|
CVE-2026-41167
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
329
|
5.3 |
MEDIUM
Network
|
-
|
-
|
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redacti…
Update
|
CWE-200
CWE-359
CWE-532
Information Exposure
Exposure of Private Personal Information to an Unauthorized Actor
Inclusion of Sensitive Information in Log Files
|
CVE-2026-41182
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
330
|
- |
|
-
|
-
|
Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can i…
Update
|
CWE-131
Incorrect Calculation of Buffer Size
|
CVE-2026-41197
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
