|
81
|
9.1 |
CRITICAL
Network
|
-
|
-
|
Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery.
Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever …
New
|
CWE-323
Reusing a Nonce, Key Pair in Encryption
|
CVE-2026-12205
|
2026-06-17 02:16 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
82
|
8.8 |
HIGH
Network
|
-
|
-
|
Improper input validation in the SSH Elevate Shell feature in
Devolutions Remote Desktop Manager 2026.2.7 allows an authenticated user
with permission to create or modify a shared SSH entry to exec…
New
|
CWE-78
OS Command
|
CVE-2026-12161
|
2026-06-17 02:16 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
83
|
9.1 |
CRITICAL
Network
|
-
|
-
|
Socket versions before 2.041 for Perl have an out-of-bounds heap read.
In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests th…
New
|
CWE-125
CWE-805
Out-of-bounds Read
Buffer Access with Incorrect Length Value
|
CVE-2026-12087
|
2026-06-17 02:16 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
84
|
9.1 |
CRITICAL
Network
|
-
|
-
|
Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce.
The default nonce was generated using an MD5 hash of the epoch time, which is predictable.
New
|
CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
|
CVE-2026-11832
|
2026-06-17 02:16 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
85
|
7.5 |
HIGH
Network
|
expressjs
|
multer
|
Impact: multer versions 2.0.0-alpha.1 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service when using diskStorage. Aborted or malformed multipart uploads leave orphaned partial files…
Update
|
CWE-459
Incomplete Cleanup
|
CVE-2026-5038
|
2026-06-17 01:59 |
2026-06-16 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
86
|
7.7 |
HIGH
Network
|
mattermost
|
mattermost_desktop
|
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server w…
Update
|
CWE-522
Insufficiently Protected Credentials
|
CVE-2026-6517
|
2026-06-17 01:54 |
2026-06-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
87
|
7.5 |
HIGH
Network
|
expressjs
|
multer
|
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket no…
Update
|
CWE-400
Uncontrolled Resource Consumption
|
CVE-2026-5079
|
2026-06-17 01:49 |
2026-06-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
88
|
7.8 |
HIGH
Local
|
foxit
|
ai
|
When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arb…
Update
|
CWE-829
Inclusion of Functionality from Untrusted Control Sphere
|
CVE-2026-12057
|
2026-06-17 01:43 |
2026-06-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
89
|
4.4 |
MEDIUM
Local
|
ibm
|
security_qradar_edr
|
IBM Security QRadar EDR 3.12 through 3.12.24 stores user credentials in plain text which can be read by a local privileged user.
Update
|
CWE-256
CWE-522
Plaintext Storage of a Password
Insufficiently Protected Credentials
|
CVE-2024-45636
|
2026-06-17 01:26 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
90
|
5.4 |
MEDIUM
Network
|
langflow
|
langflow_desktop
|
IBM Langflow Desktop 1.0.0 through 1.9.2 IBM Langflow is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, pote…
Update
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-3341
|
2026-06-17 01:25 |
2026-06-12 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
