|
431
|
7.5 |
HIGH
Network
|
-
|
-
|
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into…
|
CWE-93
CRLF Injection
|
CVE-2026-12143
|
2026-06-13 05:16 |
2026-06-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
432
|
8.8 |
HIGH
Network
|
-
|
-
|
Improper handling of HPACK dynamic table size updates in the AWS Common Runtime aws-c-http library might allow a remote threat actor operating a server to cause memory corruption on a connecting clie…
|
CWE-415
Double Free
|
CVE-2026-12043
|
2026-06-13 05:16 |
2026-06-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
433
|
- |
|
-
|
-
|
Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary post_id to POST /admin/post…
|
CWE-862
Missing Authorization
|
CVE-2026-10715
|
2026-06-13 05:16 |
2026-06-13 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
434
|
7.5 |
HIGH
Network
|
qnap
|
qumagie
|
A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data or perform unauthorized actions.
We hav…
|
CWE-359
CWE-862
Exposure of Private Personal Information to an Unauthorized Actor
Missing Authorization
|
CVE-2026-26237
|
2026-06-13 04:53 |
2026-06-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
435
|
5.5 |
MEDIUM
Network
|
splunk
|
splunk
splunk_cloud_platform
|
In Splunk Enterprise versions below 10.2.4 and 10.0.7, and Splunk Cloud Platform versions below 10.4.2604.0, 10.3.2512.12, 10.2.2510.15, 10.1.2507.23, 10.0.2503.14, and 9.3.2411.131, a user who holds…
|
CWE-284
NVD-CWE-noinfo
Improper Access Control
|
CVE-2026-20259
|
2026-06-13 04:50 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
436
|
7.5 |
HIGH
Network
|
google
|
chrome
|
Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security severity: High)
|
CWE-362
Race Condition
|
CVE-2026-1220
|
2026-06-13 04:47 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
437
|
7.5 |
HIGH
Network
|
tdengine
|
tdengine
|
TDengine is an open source, time-series database optimized for Internet of Things devices. In versions 3.4.0.0 through 3.4.1.5, an unauthenticated remote attacker can crash the taosd server process b…
|
CWE-191
Integer Underflow (Wrap or Wraparound)
|
CVE-2026-42542
|
2026-06-13 04:40 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
438
|
8.8 |
HIGH
Network
|
microsoft
|
exchange_server
|
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-45504
|
2026-06-13 04:39 |
2026-06-10 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
439
|
7.5 |
HIGH
Network
|
openvm
|
openvm
|
OpenVM is a performant and modular zkVM framework built for customization and extensibility. Prior to version 1.6.0, the openvm-pairing guest library's try_honest_pairing_check function invokes Theor…
|
CWE-20
NVD-CWE-noinfo
Improper Input Validation
|
CVE-2026-46669
|
2026-06-13 04:38 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
440
|
4.6 |
MEDIUM
Network
|
umbraco
|
umbraco_cms
|
Umbraco is an ASP.NET CMS. From version 14.0.0 to before version 17.4.0, authenticated users are able to inject HTML into an input field, which is rendered in the confirmation dialog without proper o…
|
CWE-79
Cross-site Scripting
|
CVE-2026-46609
|
2026-06-13 04:34 |
2026-06-11 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
