|
1991
|
- |
|
-
|
-
|
OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem pa…
|
CWE-22
Path Traversal
|
CVE-2026-44647
|
2026-05-15 23:55 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1992
|
7.7 |
HIGH
Network
|
-
|
-
|
python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with …
|
CWE-526
Cleartext Storage of Sensitive Information in an Environment Variable
|
CVE-2026-45370
|
2026-05-15 23:55 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1993
|
- |
|
-
|
-
|
rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.0 to before 0.10.79, CipherCtxRef::cipher_update, CipherCtxRef::cipher_update_vec, and symm::Crypter::update incorr…
|
CWE-122
Heap-based Buffer Overflow
|
CVE-2026-44662
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1994
|
- |
|
-
|
-
|
Tuist is a virtual platform team for Swift app devs. In 1.180.8 and earlier, the DELETE /api/projects/{account_handle}/{project_handle}/previews/{preview_id} endpoint loads the preview by its UUID wi…
|
CWE-639
Authorization Bypass Through User-Controlled Key
|
CVE-2026-44678
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1995
|
4.7 |
MEDIUM
Network
|
-
|
-
|
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between man…
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-44661
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1996
|
- |
|
-
|
-
|
Tuist is a virtual platform team for Swift app devs. Prior to 1.180.10, the forgot password flow allows an unauthenticated attacker to repeatedly trigger password reset emails for a known account wit…
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-44679
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1997
|
- |
|
-
|
-
|
Elixir WebRTC is an Elixir implementation of the W3C WebRTC API. Prior to 0.15.1 and 0.16.1, missing DTLS peer certificate fingerprint validation in the DTLS client (active) role removes one side of …
|
CWE-295
Improper Certificate Validation
|
CVE-2026-44700
|
2026-05-15 23:53 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1998
|
3.7 |
LOW
Network
|
-
|
-
|
Nuxt OG Image generates OG Images with Vue templates in Nuxt. The isBlockedUrl() denylist introduced in nuxt-og-image@6.2.5 to remediate GHSA-pqhr-mp3f-hrpp (Dmitry Prokhorov / Positive Technologies,…
|
CWE-918
Server-Side Request Forgery (SSRF)
|
CVE-2026-44589
|
2026-05-15 23:44 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
1999
|
9.4 |
CRITICAL
Network
|
-
|
-
|
Gradient is a nix-based continuous integration system. In 1.1.0, when GRADIENT_DISCOVERABLE=true (the default, and the NixOS module default), anyone who can reach /proto can register as a worker with…
|
CWE-306
CWE-345
CWE-862
Missing Authentication for Critical Function
Insufficient Verification of Data Authenticity
Missing Authorization
|
CVE-2026-44592
|
2026-05-15 23:44 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2000
|
8.1 |
HIGH
Network
|
-
|
-
|
Live Helper Chat is an open-source application that enables live support websites. In 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in …
|
CWE-863
Incorrect Authorization
|
CVE-2026-44633
|
2026-05-15 23:44 |
2026-05-15 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
