NVD Vulnerability Information Top

Show Search Menu

Vendor Name
プロダクト・サービス名
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
In descending order of publication date
In descending order of update date
Number of items displayed

NVD Vulnerability Information Top

You can search the list of vulnerabilities managed by the NVD (National Vulnerability Database).
Since vulnerability information is often updated before JVN (Japan Vulnerability Note), vulnerabilities that are not listed in JVN may be updated.

If there is a vulnerability related to JVN (Japan Vulnerability Note), the information will be displayed on the detail page.

To search by CWE, please refer to the CWE Overview and check the CWE number.

CRITICAL
HIGH
MEDIUM
LOW

Update Date:June 15, 2026, 4:10 a.m.

No	CVSS	Level Attach Vector	Vendor Name	Project Name	Title	CWE	CVE	Update Date	Publication Date	Show Affected	Exploit PoC Search
5851	7.5	HIGH Network	mozilla	firefox firefox_focus	Sandbox escape in Firefox and Firefox Focus for Android. This vulnerability was fixed in Firefox 151.	CWE-693 Protection Mechanism Failure	CVE-2026-8945	2026-05-22 05:56	2026-05-19	Show	GitHub Exploit DB Packet Storm

5852	4.8	MEDIUM Network	samba	rsync	Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement when configured with chroot. Attackers can bypass host…	CWE-289 Authentication Bypass by Alternate Name	CVE-2026-43617	2026-05-22 05:54	2026-05-20	Show	GitHub Exploit DB Packet Storm

5853	3.7	LOW Network	samba	rsync	Rsync versions before 3.4.3 contain an off-by-one out-of-bounds stack write vulnerability in the establish_proxy_connection() function in socket.c that allows network attackers to corrupt stack memor…	CWE-193 Off-by-one Error	CVE-2026-45232	2026-05-22 05:52	2026-05-20	Show	GitHub Exploit DB Packet Storm

5854	5.5	MEDIUM Local	samba	rsync	Rsync version 3.4.2 and prior contain a receiver-side out-of-bounds array read vulnerability in recv_files() in receiver.c that allows a malicious rsync server to crash the rsync client process. Atta…	CWE-125 Out-of-bounds Read	CVE-2026-43620	2026-05-22 05:47	2026-05-20	Show	GitHub Exploit DB Packet Storm

5855	6.3	MEDIUM Local	samba	rsync	Rsync version 3.4.2 and prior contain symlink race condition vulnerabilities in path-based system calls including chmod, lchown, utimes, rename, unlink, mkdir, symlink, mknod, link, rmdir, and lstat …	CWE-59 CWE-367 Link Following Time-of-check Time-of-use (TOCTOU) Race Condition	CVE-2026-43619	2026-05-22 05:42	2026-05-20	Show	GitHub Exploit DB Packet Storm

5856	8.1	HIGH Network	samba	rsync	Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow, allowing a malicious sender to trigg…	CWE-125 CWE-190 Out-of-bounds Read Integer Overflow or Wraparound	CVE-2026-43618	2026-05-22 05:34	2026-05-20	Show	GitHub Exploit DB Packet Storm

5857	6.5	MEDIUM Network	faraday_project	faraday	Faraday is an HTTP client library abstraction layer that provides a common interface over many adapters. Versions 2.0.0 through 2.14.1 still allow protocol-relative host override when the request tar…	CWE-918 Server-Side Request Forgery (SSRF)	CVE-2026-33637	2026-05-22 05:17	2026-05-20	Show	GitHub Exploit DB Packet Storm

5858	8.1	HIGH Network	-	-	NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_, $arg_, $cookie_*) and a location invoki…	CWE-122 Heap-based Buffer Overflow	CVE-2026-8711	2026-05-22 04:16	2026-05-20	Show	GitHub Exploit DB Packet Storm

5859	-	-	-	-	A possible information disclosure vulnerability exists in the Vaadin Maven plugin and Vaadin Gradle plugin that exposes the full set of environment variables in build logs whenever the frontend build…	CWE-209 Information Exposure Through an Error Message	CVE-2026-7860	2026-05-22 04:16	2026-05-19	Show	GitHub Exploit DB Packet Storm

5860	7.5	HIGH Network	progress	moveit_automation	Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This issue affects MOVEit Automation: before 2025.0.11, from 20…	CWE-770 Allocation of Resources Without Limits or Throttling	CVE-2026-8488	2026-05-22 04:00	2026-05-21	Show	GitHub Exploit DB Packet Storm

5861	7.8	HIGH Local	hp	linux_imaging_and_printing	A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution v…	CWE-77 Command Injection	CVE-2026-8632	2026-05-22 03:58	2026-05-21	Show	GitHub Exploit DB Packet Storm

5862	9.8	CRITICAL Network	hp	linux_imaging_and_printing	A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vulnerability may allow escalation of privileges and/or arbitrary code execution v…	CWE-122 CWE-190 Heap-based Buffer Overflow Integer Overflow or Wraparound	CVE-2026-8631	2026-05-22 03:58	2026-05-21	Show	GitHub Exploit DB Packet Storm

5863	5.3	MEDIUM Network	esri	arcgis_server	ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker could exploit this issue by sending a crafted request to the en…	CWE-287 Improper Authentication	CVE-2026-2812	2026-05-22 03:56	2026-05-21	Show	GitHub Exploit DB Packet Storm

5864	7.5	HIGH Network	progress	moveit_automation	Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 befo…	CWE-276 Incorrect Default Permissions	CVE-2026-8487	2026-05-22 03:56	2026-05-21	Show	GitHub Exploit DB Packet Storm

5865	7.5	HIGH Network	progress	moveit_automation	Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 befor…	CWE-770 Allocation of Resources Without Limits or Throttling	CVE-2026-8486	2026-05-22 03:54	2026-05-21	Show	GitHub Exploit DB Packet Storm

5866	4.1	MEDIUM Network	esri	arcgis_server	ArcGIS Server contains an input validation weakness in the login redirection workflow. An Authenticated attacker could exploit this issue by sending a specially crafted request, Successful exploitati…	CWE-601 Open Redirect	CVE-2026-2813	2026-05-22 03:54	2026-05-21	Show	GitHub Exploit DB Packet Storm

5867	5.9	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbou…	CWE-295 Improper Certificate Validation	CVE-2026-48247	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5868	5.9	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIFYHOST) when issuing outbound HTT…	CWE-295 Improper Certificate Validation	CVE-2026-48246	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5869	5.3	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository. The key can be extracted by anyone with read access to the sour…	CWE-798 Use of Hard-coded Credentials	CVE-2026-48245	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5870	5.3	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository. The key can be extracted by anyone with read access to th…	CWE-798 Use of Hard-coded Credentials	CVE-2026-48244	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5871	5.3	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository. Any actor with read access to the source tree can ext…	CWE-798 Use of Hard-coded Credentials	CVE-2026-48243	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5872	8.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php. The credentials are embedded in source code commi…	CWE-798 Use of Hard-coded Credentials	CVE-2026-48242	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5873	8.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository. Any actor with access to th…	CWE-798 Use of Hard-coded Credentials	CVE-2026-48241	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5874	7.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHERE clauses of SELECT statements …	CWE-89 SQL Injection	CVE-2026-48240	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5875	7.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SELECT statements in the incidents…	CWE-89 SQL Injection	CVE-2026-48239	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5876	7.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause of a SELECT statement used as a ticket-…	CWE-89 SQL Injection	CVE-2026-48238	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5877	7.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated into WHERE clauses of SELECT/UPDATE stat…	CWE-89 SQL Injection	CVE-2026-48237	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5878	7.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in db_loader.php where the multiple POST parameters (ticketsdb, ticketshost, ticketsuser, ticketspassword) are concatenated into…	CWE-89 SQL Injection	CVE-2026-48236	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5879	8.2	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in incs/remotes.inc.php where latitude, longitude, callsign, mph, altitude, and timestamp values parsed from external GPS tracki…	CWE-89 SQL Injection	CVE-2026-48235	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5880	7.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in portal/ajax/list_requests.php where the sort and dir GET parameters are concatenated into the ORDER BY clause of a SELECT sta…	CWE-89 SQL Injection	CVE-2026-48234	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5881	7.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/sit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause of a SELECT statement without san…	CWE-89 SQL Injection	CVE-2026-48233	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5882	7.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/fullsit_incidents.php where the offset GET parameter is concatenated into the LIMIT clause of a SELECT statement without…	CWE-89 SQL Injection	CVE-2026-48232	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5883	7.1	HIGH Network	-	-	Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in tables.php where the multiple POST parameters (tablename, indexname, sortby) are concatenated into table/column identifiers i…	CWE-89 SQL Injection	CVE-2026-48231	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5884	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdb_import.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsan…	CWE-79 Cross-site Scripting	CVE-2026-48230	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5885	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_i.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized va…	CWE-79 Cross-site Scripting	CVE-2026-48229	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5886	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_w.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized v…	CWE-79 Cross-site Scripting	CVE-2026-48228	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5887	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized val…	CWE-79 Cross-site Scripting	CVE-2026-48227	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5888	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in os_watch.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized va…	CWE-79 Cross-site Scripting	CVE-2026-48226	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5889	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized value…	CWE-79 Cross-site Scripting	CVE-2026-48225	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5890	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized valu…	CWE-79 Cross-site Scripting	CVE-2026-48224	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5891	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213rr.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized va…	CWE-79 Cross-site Scripting	CVE-2026-48223	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5892	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized valu…	CWE-79 Cross-site Scripting	CVE-2026-48222	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5893	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205a.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized val…	CWE-79 Cross-site Scripting	CVE-2026-48221	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5894	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized valu…	CWE-79 Cross-site Scripting	CVE-2026-48220	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5895	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics202.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized valu…	CWE-79 Cross-site Scripting	CVE-2026-48219	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5896	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to inject arbitrary JavaScript by passing an uns…	CWE-79 Cross-site Scripting	CVE-2026-48218	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5897	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitiz…	CWE-79 Cross-site Scripting	CVE-2026-48217	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5898	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in db_loader.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized v…	CWE-79 Cross-site Scripting	CVE-2026-48216	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5899	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in circle.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized valu…	CWE-79 Cross-site Scripting	CVE-2026-48215	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm

5900	5.4	MEDIUM Network	-	-	Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_nm.php that allows authenticated attackers to inject arbitrary JavaScript by passing an unsanitized valu…	CWE-79 Cross-site Scripting	CVE-2026-48214	2026-05-22 03:16	2026-05-22	Show	GitHub Exploit DB Packet Storm