|
3211
|
9.8 |
CRITICAL
Network
|
-
|
-
|
Missing JWT signature verification in AWS Ops Wheel allows unauthenticated attackers to forge JWT tokens and gain unintended administrative access to the application, including the ability to read, m…
|
CWE-347
Improper Verification of Cryptographic Signature
|
CVE-2026-6911
|
2026-04-25 02:56 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3212
|
8.8 |
HIGH
Network
|
-
|
-
|
Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote authenticated users to escalate to …
|
CWE-915
Improperly Controlled Modification of Dynamically-Determined Object Attributes
|
CVE-2026-6912
|
2026-04-25 02:56 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3213
|
4.9 |
MEDIUM
Network
|
-
|
-
|
Cross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code
|
CWE-79
Cross-site Scripting
|
CVE-2026-31050
|
2026-04-25 02:55 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3214
|
3.8 |
LOW
Network
|
-
|
-
|
An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Client Balance component
|
CWE-400
Uncontrolled Resource Consumption
|
CVE-2026-31051
|
2026-04-25 02:55 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3215
|
5.3 |
MEDIUM
Network
|
-
|
-
|
An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Checkout Authentication Flow component
|
CWE-400
Uncontrolled Resource Consumption
|
CVE-2026-31052
|
2026-04-25 02:55 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3216
|
4.0 |
MEDIUM
Local
|
-
|
-
|
bookserver in KDE Arianna before 26.04.1 allows attackers to read files over a socket connection by guessing a URL.
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-42095
|
2026-04-25 02:55 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3217
|
9.8 |
CRITICAL
Network
|
-
|
-
|
BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated …
|
CWE-1188 CWE-1391
Insecure Default Initialization of Resource Use of Weak Credentials
|
CVE-2026-39920
|
2026-04-25 02:55 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3218
|
6.1 |
MEDIUM
Network
|
-
|
-
|
Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch…
|
CWE-79
Cross-site Scripting
|
CVE-2025-61872
|
2026-04-25 02:54 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3219
|
4.7 |
MEDIUM
Network
|
-
|
-
|
In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution f…
|
CWE-284
Improper Access Control
|
CVE-2025-59308
|
2026-04-25 02:54 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3220
|
5.4 |
MEDIUM
Network
|
opensourcepos
|
open_source_point_of_sale
|
Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework. Prior to 3.4.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Stock Lo…
|
CWE-79
Cross-site Scripting
|
CVE-2026-39380
|
2026-04-25 02:51 |
2026-04-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|