|
3821
|
8.8 |
HIGH
Network
|
google
|
chrome
|
Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
|
CWE-416
Use After Free
|
CVE-2026-9995
|
2026-05-30 01:40 |
2026-05-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3822
|
4.3 |
MEDIUM
Network
|
gitlab
|
gitlab
|
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed a blocked…
|
CWE-863
Incorrect Authorization
|
CVE-2026-9807
|
2026-05-30 01:40 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3823
|
9.9 |
CRITICAL
Network
|
-
|
-
|
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This all…
|
CWE-643
XPath Injection
|
CVE-2026-44962
|
2026-05-30 01:33 |
2026-05-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3824
|
9.3 |
CRITICAL
Network
|
-
|
-
|
Sherlock hunts down social media accounts by username across social networks. Prior to 0.16.1, the GitHub Actions workflow validate_modified_targets.yml is vulnerable to command injection via the pul…
|
CWE-78
OS Command
|
CVE-2026-44590
|
2026-05-30 01:32 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3825
|
8.0 |
HIGH
Network
|
-
|
-
|
An issue in Responsive File Manager Responsive FileManager Version 9.14.0 allows a remote attacker to execute arbitrary code via the force_download.php component
|
CWE-98
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
|
CVE-2026-37266
|
2026-05-30 01:32 |
2026-05-28 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3826
|
7.5 |
HIGH
Network
|
-
|
-
|
esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in…
|
CWE-22
Path Traversal
|
CVE-2026-44594
|
2026-05-30 01:32 |
2026-05-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3827
|
5.3 |
MEDIUM
Network
|
-
|
-
|
TREK is a collaborative travel planner. Prior to 3.0.18, early return on missing user during login flow allowed an attacker to enumerate valid user accounts via response timing discrepancy. When an e…
|
CWE-203
CWE-208
Information Exposure Through Discrepancy
Information Exposure Through Timing Discrepancy
|
CVE-2026-45410
|
2026-05-30 01:32 |
2026-05-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3828
|
8.1 |
HIGH
Network
|
-
|
-
|
Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcem…
|
CWE-22
Path Traversal
|
CVE-2026-44973
|
2026-05-30 01:32 |
2026-05-29 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3829
|
8.2 |
HIGH
Network
|
-
|
-
|
The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the frm_passwd parameter…
|
CWE-89
SQL Injection
|
CVE-2018-25398
|
2026-05-30 01:32 |
2026-05-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
3830
|
8.2 |
HIGH
Network
|
-
|
-
|
The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the tick_lat and tick_ln…
|
CWE-89
SQL Injection
|
CVE-2018-25399
|
2026-05-30 01:32 |
2026-05-30 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
