|
5161
|
6.3 |
MEDIUM
Local
|
-
|
-
|
Grimmory is a self-hosted digital library. Prior to version 2.3.1, a stored cross-site scripting (XSS) vulnerability in Grimmory's browser-based EPUB reader allows an attacker to embed arbitrary Java…
|
CWE-79
CWE-80
Cross-site Scripting
Basic XSS
|
CVE-2026-42451
|
2026-05-14 01:49 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5162
|
3.8 |
LOW
Network
|
-
|
-
|
SysReptor is a fully customizable pentest reporting platform. Prior to version 2026.29, users with "User Admin" permissions can change the email addresses of users with "Superuser" permissions. If th…
|
CWE-269
Improper Privilege Management
|
CVE-2026-44987
|
2026-05-14 01:49 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5163
|
- |
|
-
|
-
|
bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap an…
|
CWE-269
Improper Privilege Management
|
CVE-2026-41163
|
2026-05-14 01:49 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5164
|
7.8 |
HIGH
Local
|
-
|
-
|
pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata (e.g. the summary field) into the generated spec file without …
|
CWE-20
CWE-94
Improper Input Validation
Code Injection
|
CVE-2026-42301
|
2026-05-14 01:49 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5165
|
6.4 |
MEDIUM
Network
|
-
|
-
|
Marko is a declarative, HTML-based language for building web apps. Prior to marko version 5.38.36 and prior to @marko/runtime-tags 6.0.164, when dynamic text is interpolated into a <script> or <style…
|
CWE-79
Cross-site Scripting
|
CVE-2026-41591
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5166
|
- |
|
-
|
-
|
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, t…
|
CWE-89
SQL Injection
|
CVE-2026-41889
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5167
|
- |
|
-
|
-
|
Ray is an AI compute engine. From version 2.54.0 to before version 2.55.0, Ray Data registers custom Arrow extension types (ray.data.arrow_tensor, ray.data.arrow_tensor_v2, ray.data.arrow_variable_sh…
|
CWE-94
CWE-502
Code Injection
Deserialization of Untrusted Data
|
CVE-2026-41486
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5168
|
8.1 |
HIGH
Network
|
-
|
-
|
OmniFaces is a utility library for Faces. Prior to versions 1.14.2, 2.7.32, 3.14.16, 4.7.5, and 5.2.3, there is a server-side EL injection leading to Remote Code Execution (RCE). This affects applica…
|
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
|
CVE-2026-41883
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5169
|
7.5 |
HIGH
Network
|
-
|
-
|
locize is a localization platform that connects code and i18n setup. Prior to version 4.0.21, the locize client SDK registers a window.addEventListener("message", …) handler that dispatches to regist…
|
CWE-79
CWE-346
Cross-site Scripting
Origin Validation Error
|
CVE-2026-41886
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
5170
|
9.8 |
CRITICAL
Network
|
-
|
-
|
Nornicdb is a distributed low-latency, Graph+Vector, Temporal MVCC with all sub-ms HNSW search, graph traversal, and writes. Prior to version 1.0.42-hotfix, the --address CLI flag (and NORNICDB_ADDRE…
|
CWE-1392
Use of Default Credentials
|
CVE-2026-42072
|
2026-05-14 01:34 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
