|
1831
|
9.1 |
CRITICAL
Network
|
-
|
-
|
Jellystat is a free and open source Statistics App for Jellyfin. Prior to version 1.1.10, multiple API endpoints in Jellystat build SQL queries by interpolating unsanitized request-body fields direct…
|
CWE-89
SQL Injection
|
CVE-2026-41167
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1832
|
5.3 |
MEDIUM
Network
|
-
|
-
|
LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to version 0.5.19 of the JavaScript SDK and version 0.7.31 of the Python SDK, the LangSmith SDK's output redacti…
|
CWE-200
CWE-359
CWE-532
Information Exposure
Exposure of Private Personal Information to an Unauthorized Actor
Inclusion of Sensitive Information in Log Files
|
CVE-2026-41182
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1833
|
- |
|
-
|
-
|
Noir is a Domain Specific Language for SNARK proving systems that is designed to use any ACIR compatible proving system, and Brillig is the bytecode ACIR uses for non-determinism. Noir programs can i…
|
CWE-131
Incorrect Calculation of Buffer Size
|
CVE-2026-41197
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1834
|
- |
|
-
|
-
|
STIG Manager is an API and web client for managing Security Technical Implementation Guides (STIG) assessments of Information Systems. Versions 1.5.10 through 1.6.7 have a reflected Cross-Site Scrip…
|
CWE-79
Cross-site Scripting
|
CVE-2026-41200
|
2026-04-30 05:46 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1835
|
7.8 |
HIGH
Local
|
linux
|
linux_kernel
|
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ctxfi: Limit PTP to a single page
Commit 391e69143d0a increased CT_PTP_NUM from 1 to 4 to support 256
playback streams, but…
|
NVD-CWE-noinfo
|
CVE-2026-31602
|
2026-04-30 05:16 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1836
|
9.8 |
CRITICAL
Network
|
-
|
-
|
radare2-mcp version 1.6.0 and earlier contains an os command injection vulnerability that allows remote attackers to execute arbitrary commands by bypassing the command filter through shell metachara…
|
CWE-78
OS Command
|
CVE-2026-6942
|
2026-04-30 05:16 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1837
|
8.5 |
HIGH
Network
|
socialengine
|
socialengine
|
SocialEngine versions 7.8.0 and prior contain a blind server-side request forgery vulnerability in the /core/link/preview endpoint where user-supplied input passed via the uri request parameter is no…
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-41461
|
2026-04-30 05:16 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1838
|
9.8 |
CRITICAL
Network
|
socialengine
|
socialengine
|
SocialEngine versions 7.8.0 and prior contain a SQL injection vulnerability in the /activity/index/get-memberall endpoint where user-supplied input passed via the text parameter is not sanitized befo…
|
CWE-89
SQL Injection
|
CVE-2026-41460
|
2026-04-30 05:16 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1839
|
6.2 |
MEDIUM
Local
|
apple
|
ipados
iphone_os
|
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.7.8 and iPadOS 18.7.8, iOS 26.4.2 and iPadOS 26.4.2. Notifications marked for deletion could be unexpectedly …
|
CWE-359
Exposure of Private Personal Information to an Unauthorized Actor
|
CVE-2026-28950
|
2026-04-30 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1840
|
5.1 |
MEDIUM
Local
|
-
|
-
|
EfficientLab Controlio before v1.3.95 contains a DLL hijacking vulnerability caused by weak folder permissions in the installation directory. A local attacker can place a specially crafted DLL in thi…
|
CWE-427
Uncontrolled Search Path Element
|
CVE-2025-10549
|
2026-04-30 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
