|
2001
|
6.5 |
MEDIUM
Network
|
hono
|
hono
|
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.16, bodyLimit() does not reliably enforce maxSize for requests without a usable Content-Length (e.g…
|
CWE-400
Uncontrolled Resource Consumption
|
CVE-2026-44456
|
2026-05-14 03:34 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2002
|
5.3 |
MEDIUM
Network
|
hono
|
hono
|
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, Cache Middleware does not skip caching for responses that declare per-user variance via Vary: A…
|
CWE-524
Use of Cache Containing Sensitive Information
|
CVE-2026-44457
|
2026-05-14 03:34 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2003
|
4.3 |
MEDIUM
Network
|
hono
|
hono
|
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.18, the JSX renderer escapes style attribute object values for HTML but not for CSS. Untrusted inpu…
|
CWE-74
CWE-116
Injection
Improper Encoding or Escaping of Output
|
CVE-2026-44458
|
2026-05-14 03:32 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2004
|
5.7 |
MEDIUM
Network
|
-
|
-
|
Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front is vulnerable to stored XSS. This vulnerability is fixed in 6.9.1.
|
CWE-79
Cross-site Scripting
|
CVE-2026-41250
|
2026-05-14 03:31 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2005
|
- |
|
-
|
-
|
Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py's write_txt, write_csv, write_json, and (commented-but-shipping) scan_file helpers open their output as open…
|
CWE-22
CWE-73
Path Traversal
External Control of File Name or Path
|
CVE-2026-42866
|
2026-05-14 03:31 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2006
|
10.0 |
CRITICAL
Network
|
-
|
-
|
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.57, SOCFortress CoPilot ships a hardcoded JWT signing secret as a fallback value i…
|
CWE-287
CWE-522
CWE-798
Improper Authentication
Insufficiently Protected Credentials
Use of Hard-coded Credentials
|
CVE-2026-42869
|
2026-05-14 03:31 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2007
|
3.7 |
LOW
Network
|
-
|
-
|
Microdot is a minimalistic Python web framework. Prior to 2.6.1, the Response.set_cookie() method does not sanitize its string arguments, and in particular will not detect the presence of the \r\n se…
|
CWE-113
HTTP Response Splitting
|
CVE-2026-42874
|
2026-05-14 03:31 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2008
|
9.4 |
CRITICAL
Network
|
-
|
-
|
oxyno-zeta/s3-proxy is an aws s3 proxy written in go. Prior to 5.0.0, s3-proxy contains an authentication bypass caused by inconsistent URL path interpretation between the authentication middleware a…
|
CWE-22
CWE-863
Path Traversal
Incorrect Authorization
|
CVE-2026-42882
|
2026-05-14 03:31 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2009
|
7.8 |
HIGH
Local
|
-
|
-
|
libcaca is a colour ASCII art library. In 0.99.beta20 and earlier, an integer overflow vulnerability in libcaca's canvas import functionality allows an attacker to cause a controlled heap out-of-boun…
|
CWE-122
CWE-190
CWE-787
Heap-based Buffer Overflow
Integer Overflow or Wraparound
Out-of-bounds Write
|
CVE-2026-42046
|
2026-05-14 03:31 |
2026-05-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2010
|
7.1 |
HIGH
Network
|
-
|
-
|
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to version 0.12.10, a vulnerability exists in the Stripe webhook handler that allows an …
|
CWE-345
CWE-863
CWE-1188
Insufficient Verification of Data Authenticity
Incorrect Authorization
Insecure Default Initialization of Resource
|
CVE-2026-41432
|
2026-05-14 03:29 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
