|
341
|
7.8 |
HIGH
Local
|
linux
|
linux_kernel
|
In the Linux kernel, the following vulnerability has been resolved:
usb: ulpi: fix double free in ulpi_register_interface() error path
When device_register() fails, ulpi_register() calls put_device…
Update
|
CWE-415
Double Free
|
CVE-2026-31759
|
2026-05-9 03:20 |
2026-05-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
342
|
6.5 |
MEDIUM
Network
|
zfnd
|
zebra-rpc
zebrad
|
ZEBRA is a Zcash node written entirely in Rust. From zebrad versions 2.2.0 to before 4.3.1 and from zebra-rpc versions 1.0.0-beta.45 to before 6.0.2, a vulnerability in Zebra's JSON-RPC HTTP middlewa…
New
|
CWE-248
CWE-617
Uncaught Exception
Reachable Assertion
|
CVE-2026-41585
|
2026-05-9 03:19 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
343
|
7.3 |
HIGH
Local
|
linux
|
linux_kernel
|
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ctnetlink: ignore explicit helper on new expectations
Use the existing master conntrack helper, anything else is not r…
Update
|
CWE-125
Out-of-bounds Read
|
CVE-2026-43025
|
2026-05-9 03:17 |
2026-05-2 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
344
|
- |
|
-
|
-
|
Crypt::PasswdMD5 versions through 1.42 for Perl generates insecure random values for salts.
The built-in rand function is predictable, and unsuitable for cryptography.
New
|
CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
|
CVE-2026-6659
|
2026-05-9 03:16 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
345
|
- |
|
-
|
-
|
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller…
New
|
CWE-89
SQL Injection
|
CVE-2026-42208
|
2026-05-9 03:16 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
346
|
5.3 |
MEDIUM
Network
|
-
|
-
|
novaGallery is a php image gallery. Prior to version 2.1.1, a path traversal vulnerability has been identified in novaGallery. This allows unauthenticated users to read image files outside the intend…
New
|
CWE-22
Path Traversal
|
CVE-2026-42028
|
2026-05-9 03:16 |
2026-05-9 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
347
|
6.3 |
MEDIUM
Network
|
-
|
-
|
Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file…
New
|
CWE-434
Unrestricted Upload of File with Dangerous Type
|
CVE-2025-67886
|
2026-05-9 03:16 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
348
|
7.3 |
HIGH
Network
|
-
|
-
|
AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.
New
|
CWE-321
Use of Hard-coded Cryptographic Key
|
CVE-2025-55449
|
2026-05-9 03:16 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
349
|
7.3 |
HIGH
Network
|
-
|
-
|
A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows attackers to execute code on the application server.
New
|
CWE-94
Code Injection
|
CVE-2024-46507
|
2026-05-9 03:16 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
350
|
7.3 |
HIGH
Network
|
-
|
-
|
A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on the server via a crafted build parameter. This occurs in free…
New
|
CWE-77
Command Injection
|
CVE-2024-45257
|
2026-05-9 03:16 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
