|
1001
|
9.8 |
CRITICAL
Network
|
samsung
|
magicinfo_9_server
|
La limitación inadecuada de un nombre de ruta a una vulnerabilidad de directorio restringido en la versión Samsung MagicINFO 9 Server anterior a la 21.1050 permite a los atacantes escribir archivos a…
|
CWE-22
CWE-434
Path Traversal
Unrestricted Upload of File with Dangerous Type
|
CVE-2024-7399
|
2026-04-25 05:23 |
2024-08-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1002
|
5.5 |
MEDIUM
Local
|
giskard
|
giskard
|
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the RegexMatching check passes a user-supplied regular expression pattern directly to Python's re.search() wit…
|
CWE-1333
Inefficient Regular Expression Complexity
|
CVE-2026-40319
|
2026-04-25 05:22 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1003
|
6.7 |
MEDIUM
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_server_2016
windows_server_2019
windows_server_2022
|
Reliance on untrusted inputs in a security decision in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.
|
CWE-807
Reliance on Untrusted Inputs in a Security Decision
|
CVE-2026-0390
|
2026-04-25 05:17 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1004
|
5.3 |
MEDIUM
Network
|
-
|
-
|
Xerte Online Toolkits versions 3.15 and earlier contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the full server-side filesystem path of the applicati…
|
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
|
CVE-2026-41459
|
2026-04-25 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1005
|
9.8 |
CRITICAL
Network
|
-
|
-
|
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an i…
|
CWE-184
Incomplete Blacklist
|
CVE-2026-34415
|
2026-04-25 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1006
|
7.1 |
HIGH
Network
|
-
|
-
|
Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where the name parameter in re…
|
CWE-22
Path Traversal
|
CVE-2026-34414
|
2026-04-25 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1007
|
8.6 |
HIGH
Network
|
-
|
-
|
Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unaut…
|
CWE-497
Exposure of Sensitive System Information to an Unauthorized Control Sphere
|
CVE-2026-34413
|
2026-04-25 05:16 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1008
|
5.4 |
MEDIUM
Network
|
-
|
-
|
Missing Authorization vulnerability in merkulove Buttoner for Elementor buttoner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Buttoner for Elem…
|
CWE-862
Missing Authorization
|
CVE-2025-68085
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1009
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Shortcodes salient-shortcodes allows Stored XSS.This issue affects Salient Sh…
|
CWE-79
Cross-site Scripting
|
CVE-2025-68079
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1010
|
6.5 |
MEDIUM
Network
|
-
|
-
|
Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issu…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2025-68071
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1011
|
7.5 |
HIGH
Network
|
-
|
-
|
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad soledad allows PHP Local File Inclusion.This issue affects…
|
CWE-98
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
|
CVE-2025-68066
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1012
|
8.5 |
HIGH
Network
|
-
|
-
|
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from …
|
CWE-89
SQL Injection
|
CVE-2025-68055
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1013
|
5.5 |
MEDIUM
Local
|
microsoft
|
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2019
windows_server_2022
windows_server_2022_…
|
Access of resource using incompatible type ('type confusion') in Windows COM allows an authorized attacker to disclose information locally.
|
CWE-843
Type Confusion
|
CVE-2026-20806
|
2026-04-25 05:16 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1014
|
4.3 |
MEDIUM
Network
|
-
|
-
|
Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SKT Page Builder: from n/a …
|
CWE-862
Missing Authorization
|
CVE-2025-54005
|
2026-04-25 05:16 |
2025-12-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1015
|
7.8 |
HIGH
Local
|
giskard
|
giskard
|
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template() constructor, silentl…
|
CWE-1336
Improper Neutralization of Special Elements Used in a Template Engine
|
CVE-2026-40320
|
2026-04-25 05:15 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1016
|
4.6 |
MEDIUM
Physics
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2016
windows_server_2019
w…
|
Improper removal of sensitive information before storage or transfer in Windows Recovery Environment Agent allows an unauthorized attacker to bypass a security feature with a physical attack.
|
CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer
|
CVE-2026-20928
|
2026-04-25 05:11 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1017
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_server_2019
windows_server_2022
windows_server_2022_23h2
windows_ser…
|
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
|
CWE-362
Race Condition
|
CVE-2026-20930
|
2026-04-25 05:10 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1018
|
5.7 |
MEDIUM
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2016
windows_server_2019
w…
|
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
|
CWE-822
Untrusted Pointer Dereference
|
CVE-2026-23670
|
2026-04-25 05:09 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1019
|
7.0 |
HIGH
Local
|
microsoft
|
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2022_23h2
windows_server_2025
|
Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.
|
CWE-362
Race Condition
|
CVE-2026-25184
|
2026-04-25 05:08 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1020
|
7.1 |
HIGH
Network
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network.
|
CWE-357
Insufficient UI Warning of Dangerous Operations
|
CVE-2026-26151
|
2026-04-25 05:06 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1021
|
7.0 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.
|
CWE-922
Insecure Storage of Sensitive Information
|
CVE-2026-26152
|
2026-04-25 05:05 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1022
|
8.2 |
HIGH
Network
|
firebirdsql
|
firebird
|
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when processing CNCT_specific_data segments during authentication, the server assumes s…
|
CWE-119
CWE-787
Incorrect Access of Indexable Resource ('Range Error')
Out-of-bounds Write
|
CVE-2026-27890
|
2026-04-25 05:05 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1023
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2019
windows_server_2022
windows_server_2022_…
|
Out-of-bounds read in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges locally.
|
CWE-125
Out-of-bounds Read
|
CVE-2026-26153
|
2026-04-25 05:03 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1024
|
7.5 |
HIGH
Network
|
microsoft
|
windows_server_2012
windows_server_2016
windows_server_2019
windows_server_2022
windows_server_2022_23h2
windows_server_2025
|
Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.
|
CWE-20
Improper Input Validation
|
CVE-2026-26154
|
2026-04-25 05:02 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1025
|
6.5 |
MEDIUM
Network
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2016
windows_server_2019
w…
|
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
|
CWE-126
Buffer Over-read
|
CVE-2026-26155
|
2026-04-25 05:02 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1026
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2016
windows_server_2019
w…
|
Heap-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code locally.
|
CWE-20
CWE-122
CWE-125
Improper Input Validation
Heap-based Buffer Overflow
Out-of-bounds Read
|
CVE-2026-26156
|
2026-04-25 05:00 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1027
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-26159
|
2026-04-25 04:54 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1028
|
7.5 |
HIGH
Network
|
firebirdsql
|
firebird
|
Firebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and 3.0.14, when processing an op_slice network packet, the server passes an unprepared stru…
|
CWE-476
NULL Pointer Dereference
|
CVE-2026-28212
|
2026-04-25 04:54 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1029
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-26160
|
2026-04-25 04:53 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1030
|
6.5 |
MEDIUM
Network
|
firebirdsql
|
firebird
|
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the ClumpletReader::getClumpletSize() function can overflow the totalLength value when …
|
CWE-190
CWE-835
Integer Overflow or Wraparound
Loop with Unreachable Exit Condition ('Infinite Loop')
|
CVE-2026-28214
|
2026-04-25 04:47 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1031
|
8.2 |
HIGH
Network
|
firebirdsql
|
firebird
|
Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, when the server receives an op_crypt_key_callback packet without prior authentication, …
|
CWE-476
NULL Pointer Dereference
|
CVE-2026-28224
|
2026-04-25 04:45 |
2026-04-18 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1032
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2019
windows_server_2022
windows_server_2022_…
|
Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
|
CWE-20
CWE-822
Improper Input Validation
Untrusted Pointer Dereference
|
CVE-2026-26161
|
2026-04-25 04:32 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1033
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Access of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges locally.
|
CWE-843
Type Confusion
|
CVE-2026-26162
|
2026-04-25 04:31 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1034
|
7.8 |
HIGH
Local
|
microsoft
|
windows_10_1607
windows_10_1809
windows_10_21h2
windows_10_22h2
windows_11_23h2
windows_11_24h2
windows_11_25h2
windows_11_26h1
windows_server_2012
windows_server_2016
w…
|
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.
|
CWE-415
Double Free
|
CVE-2026-26163
|
2026-04-25 04:30 |
2026-04-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1035
|
7.2 |
HIGH
Network
|
dlink
|
dir-823x_firmware
|
A command injection vulnerability in D-Link DIR-823X 240126 and 240802 allows an authorized attacker to execute arbitrary commands on remote devices by sending a POST request to /goform/set_prohibiti…
|
CWE-77
Command Injection
|
CVE-2025-29635
|
2026-04-25 04:27 |
2025-03-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1036
|
7.2 |
HIGH
Network
|
dlink
|
dir-823x_firmware
|
Una vulnerabilidad de inyección de comandos en D-Link DIR-823X 240126 y 240802 permite a un atacante autorizado ejecutar comandos arbitrarios en dispositivos remotos enviando una solicitud POST a /go…
|
CWE-77
Command Injection
|
CVE-2025-29635
|
2026-04-25 04:27 |
2025-03-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1037
|
7.2 |
HIGH
Network
|
simple-help
|
simplehelp
|
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to…
|
CWE-59
CWE-22
Link Following
Path Traversal
|
CVE-2024-57728
|
2026-04-25 04:27 |
2025-01-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1038
|
7.2 |
HIGH
Network
|
simple-help
|
simplehelp
|
El software de soporte remoto SimpleHelp v5.5.7 y versiones anteriores permite a los usuarios administradores cargar archivos arbitrarios en cualquier parte del sistema de archivos mediante la carga…
|
CWE-59
CWE-22
Link Following
Path Traversal
|
CVE-2024-57728
|
2026-04-25 04:27 |
2025-01-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1039
|
9.9 |
CRITICAL
Network
|
simple-help
|
simplehelp
|
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate p…
|
NVD-CWE-noinfo
CWE-862
Missing Authorization
|
CVE-2024-57726
|
2026-04-25 04:26 |
2025-01-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1040
|
9.9 |
CRITICAL
Network
|
simple-help
|
simplehelp
|
El software de soporte remoto SimpleHelp v5.5.7 y versiones anteriores tiene una vulnerabilidad que permite a los técnicos con pocos privilegios crear claves API con permisos excesivos. Estas claves…
|
NVD-CWE-noinfo
CWE-862
Missing Authorization
|
CVE-2024-57726
|
2026-04-25 04:26 |
2025-01-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1041
|
7.5 |
HIGH
Network
|
xiangshan
|
nemu
|
NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decodin…
|
CWE-131
CWE-1287
Incorrect Calculation of Buffer Size
Improper Validation of Specified Type of Input
|
CVE-2026-29645
|
2026-04-25 04:25 |
2026-04-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1042
|
9.8 |
CRITICAL
Network
|
xiangshan
|
nemu
|
NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode w…
|
CWE-693
Protection Mechanism Failure
|
CVE-2026-29649
|
2026-04-25 04:23 |
2026-04-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1043
|
3.3 |
LOW
Local
|
uutils
|
coreutils
|
A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The im…
|
CWE-684
Incorrect Provision of Specified Functionality
|
CVE-2026-35381
|
2026-04-25 04:19 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1044
|
6.5 |
MEDIUM
Network
|
roxy-wi
|
roxy-wi
|
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.4, the POST /config/<service>/show API endpoint accepts a configver parameter that is dir…
|
CWE-24
Path Traversal: '../filedir'
|
CVE-2026-33431
|
2026-04-25 04:19 |
2026-04-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1045
|
6.3 |
MEDIUM
Local
|
uutils
|
coreutils
|
A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the mv utility of uutils coreutils during cross-device operations. The utility removes the destination path before recreating it throu…
|
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
|
CVE-2026-35364
|
2026-04-25 04:19 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1046
|
3.3 |
LOW
Local
|
uutils
|
coreutils
|
The nohup utility in uutils coreutils creates its default output file, nohup.out, without specifying explicit restricted permissions. This causes the file to inherit umask-based permissions, typicall…
|
CWE-732
Incorrect Permission Assignment for Critical Resource
|
CVE-2026-35367
|
2026-04-25 04:19 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1047
|
7.8 |
HIGH
Local
|
uutils
|
coreutils
|
A vulnerability exists in the chroot utility of uutils coreutils when using the --userspec option. The utility resolves the user specification via getpwnam() after entering the chroot but before drop…
|
CWE-426
Untrusted Search Path
|
CVE-2026-35368
|
2026-04-25 04:18 |
2026-04-23 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1048
|
9.1 |
CRITICAL
Network
|
roxy-wi
|
roxy-wi
|
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions up to and including 8.2.8.2, when LDAP authentication is enabled, Roxy-WI constructs an LDAP search …
|
CWE-287
NVD-CWE-noinfo
Improper Authentication
|
CVE-2026-33432
|
2026-04-25 04:18 |
2026-04-21 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1049
|
7.8 |
HIGH
Local
|
linux
|
linux_kernel
|
In the Linux kernel, the following vulnerability has been resolved:
x86/fred: Correct speculative safety in fred_extint()
array_index_nospec() is no use if the result gets spilled to the stack, as
…
|
CWE-129
Improper Validation of Array Index
|
CVE-2026-23354
|
2026-04-25 04:15 |
2026-03-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1050
|
7.8 |
HIGH
Local
|
linux
|
linux_kernel
|
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:
x86/fred: Corregir la seguridad especulativa en fred_extint()
array_index_nospec() no sirve de nada si el resultado se vuelca a …
|
CWE-129
Improper Validation of Array Index
|
CVE-2026-23354
|
2026-04-25 04:15 |
2026-03-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
