|
131
|
- |
|
-
|
-
|
Incorrect access control in the "Let's Encrypt" certificate download endpoint of Nginx Proxy Manager v2.14.0 allows authenticated attackers to obtain the TLS private key material via a crafted GET re…
New
|
-
|
CVE-2026-50892
|
2026-06-17 00:49 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
132
|
7.5 |
HIGH
Network
|
-
|
-
|
Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access c…
New
|
CWE-284
Improper Access Control
|
CVE-2026-47261
|
2026-06-17 00:49 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
133
|
- |
|
-
|
-
|
Incorrect access control in the /admin/api/config component of Filestash v0.4.0 allows attackers to escalate privileges via sending a crafted request.
New
|
-
|
CVE-2026-50891
|
2026-06-17 00:49 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
134
|
- |
|
-
|
-
|
Cursor is a code editor built for programming with AI. In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands from .claude/settings.local.json without ded…
New
|
CWE-94
CWE-829
Code Injection
Inclusion of Functionality from Untrusted Control Sphere
|
CVE-2026-48124
|
2026-06-17 00:49 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
135
|
4.3 |
MEDIUM
Network
|
-
|
-
|
MultiJuicer is used to run separate Juice Shop instances on a central kubernetes cluster without the need for local instances. In versions 8.0.0 through 10.0.0, the team join endpoint (POST /multi-ju…
New
|
CWE-352
Origin Validation Error
|
CVE-2026-48518
|
2026-06-17 00:49 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
136
|
7.5 |
HIGH
Network
|
-
|
-
|
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, the template engine uses a single shared text/template.Template instance (tpl package-level va…
New
|
CWE-362
CWE-567
Race Condition
Unsynchronized Access to Shared Data in a Multithreaded Context
|
CVE-2026-48708
|
2026-06-17 00:49 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
137
|
3.7 |
LOW
Network
|
-
|
-
|
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any auth…
New
|
CWE-862
Missing Authorization
|
CVE-2026-48709
|
2026-06-17 00:49 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
138
|
6.1 |
MEDIUM
Network
|
-
|
-
|
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle() and/or setDescription() to…
New
|
CWE-79
Cross-site Scripting
|
CVE-2026-48157
|
2026-06-17 00:49 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
139
|
7.8 |
HIGH
Local
|
-
|
-
|
The browserstack-cypress-cli is BrowserStack's CLI which allows users to run Cypress tests on BrowserStack. Versions prior to 1.36.4 are vulnerable to OS command injection via the cypress_config_file…
New
|
CWE-78
OS Command
|
CVE-2026-48723
|
2026-06-17 00:46 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
140
|
7.7 |
HIGH
Network
|
-
|
-
|
Sync-in Server is a secure, open-source platform for file storage, sharing, collaboration, and syncing. Prior to version 2.3.0, the private IP blocklist regex used in the URL download feature does no…
New
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-47684
|
2026-06-17 00:46 |
2026-06-17 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
