|
1401
|
9.9 |
CRITICAL
Network
|
-
|
-
|
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a files…
|
CWE-22
CWE-73
CWE-94
CWE-427
Path Traversal
External Control of File Name or Path
Code Injection
Uncontrolled Search Path Element
|
CVE-2026-40342
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1402
|
- |
|
-
|
-
|
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. In versions prior to 23.0.0 , the ODT to PDF conversion process in odf.php concatenates …
|
CWE-78
OS Command
|
CVE-2026-23500
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1403
|
- |
|
-
|
-
|
xrdp is an open source RDP server. Versions through 0.10.5 have an out-of-bounds read vulnerability in the pre-authentication RDP message parsing logic. A remote, unauthenticated attacker can trigger…
|
CWE-125
Out-of-bounds Read
|
CVE-2026-33689
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1404
|
- |
|
-
|
-
|
mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases. In versions prior to 0.6.0, the read_only mode enforcement can be bypassed using APOC CALL procedures, potentia…
|
CWE-284
Improper Access Control
|
CVE-2026-35402
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1405
|
- |
|
-
|
-
|
xrdp is an open source RDP server. Versions through 0.10.5 have a heap-based buffer overflow in the EGFX (graphics dynamic virtual channel) implementation due to insufficient validation of client-con…
|
CWE-122
Heap-based Buffer Overflow
|
CVE-2026-35512
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1406
|
5.4 |
MEDIUM
Network
|
-
|
-
|
The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. In versions 4.12.0 through 4.17.1, simultaneous requests that trigger a nonce retry may cause the prox…
|
CWE-362
CWE-863
Race Condition
Incorrect Authorization
|
CVE-2026-40155
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1407
|
6.3 |
MEDIUM
Network
|
-
|
-
|
xrdp is an open source RDP server. Versions through 0.10.5 allow an authenticated remote user to execute arbitrary commands on the server due to unsafe handling of the AlternateShell parameter in xrd…
|
CWE-78
OS Command
|
CVE-2026-33145
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1408
|
6.5 |
MEDIUM
Network
|
-
|
-
|
OpenFGA is an authorization/permission engine built for developers. In versions 0.1.4 through 1.13.1, when OpenFGA is configured to use preshared-key authentication with the built-in playground enabl…
|
CWE-200
Information Exposure
|
CVE-2026-40293
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1409
|
- |
|
-
|
-
|
next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: 'as-needed'` could construct URLs where path handling and …
|
CWE-601
Open Redirect
|
CVE-2026-40299
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1410
|
4.7 |
MEDIUM
Network
|
-
|
-
|
DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.10, DOMSanitizer::sanitize() allows <style> elements in SVG content but never inspects their text content. CSS url() refe…
|
CWE-79
Cross-site Scripting
|
CVE-2026-40301
|
2026-04-21 04:03 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
