📡 NVD-Latest · 2026-05-07 CVE-2025-9661 (CVSS 8.1) - OS command injection vulneravility in the management gui (maintenance utility) o CVE-2025-9661 CVE-2025-9661 CVSS:8.1 OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and 28. This issue affects Hitachi Virtual

📡 NVD-Latest · 2026-05-07 CVE-2026-4430 (CVSS 7.8) - Out-of-bounds write vulnerability in The Document Foundation LibreOffice via cra CVE-2026-4430 CVE-2026-4430 CVSS:7.8 Out-of-bounds write vulnerability in The Document Foundation LibreOffice via crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice: from 26.2 before 26.2.3,

📡 NVD-Latest · 2026-05-07 CVE-2025-68060 (CVSS 7.6) - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injecti CVE-2025-68060 CVE-2025-68060 CVSS:7.6 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMart Team Member allows Blind SQL Injection. This issue

📡 NVD-Latest · 2026-05-07 CVE-2026-28201 (CVSS 7.8) - An improper input validation, together with an overly permissive default CORS co CVE-2026-28201 CVE-2026-28201 CVSS:7.8 An improper input validation, together with an overly permissive default CORS configuration in Open Notebook v1.8.1 allows remote attacker to trick a legitimate user

📡 NVD-Latest · 2026-05-07 CVE-2026-33588 (CVSS 8.1) - Lack of user input validation in the file upload functionality of Open Notebook CVE-2026-33588 CVE-2026-33588 CVSS:8.1 Lack of user input validation in the file upload functionality of Open Notebook v1.8.3 allows the application user to create or modify files

📡 NVD-Latest · 2026-05-07 CVE-2026-41642 (CVSS 7.5) - GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P CVE-2026-41642 CVE-2026-41642 CVSS:7.5 GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.3.0, a remote Denial of

📡 NVD-Latest · 2026-05-07 CVE-2026-41643 (CVSS 7.5) - GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P CVE-2026-41643 CVE-2026-41643 CVSS:7.5 GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.3.0, a remote Denial

📡 NVD-Latest · 2026-05-07 CVE-2026-42285 (CVSS 7.5) - GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go P CVE-2026-42285 CVE-2026-42285 CVSS:7.5 GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. In version 4.4.0, an unauthenticated remote BGP

📡 NVD-Latest · 2026-05-07 CVE-2026-5784 (CVSS 8.8) - Improper neutralization of input during web page generation ('cross-site scripti CVE-2026-5784 CVE-2026-5784 CVSS:8.8 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS. This issue affects DivvyDrive: from

📡 NVD-Latest · 2026-05-07 CVE-2026-6002 (CVSS 8.8) - Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vu CVE-2026-6002 CVE-2026-6002 CVSS:8.8 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Cross-Site Scripting (XSS). This issue

📡 NVD-Latest · 2026-05-07 CVE-2026-30495 (CVSS 8.8) - The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) e CVE-2026-30495 CVE-2026-30495 CVSS:8.8 The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP

📡 NVD-Latest · 2026-05-07 CVE-2026-41490 (CVSS 8.3) - Dagster is an orchestration platform for the development, production, and observ CVE-2026-41490 CVE-2026-41490 CVSS:8.3 Dagster is an orchestration platform for the development, production, and observation of data assets. Prior to Dagster Core version 1.13.1 and prior to Dagster libraries

📡 NVD-Latest · 2026-05-07 CVE-2026-41554 (CVSS 7.1) - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripti CVE-2026-41554 CVE-2026-41554 CVSS:7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS. This issue affects Bricks Builder: from n/a

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44788 - SharpCompress has directory traversal via directory entries in WriteToDirectory CVE-2026-44788 GHSA-6c8g-7p36-r338 MEDIUM nuget/SharpCompress CVE: CVE-2026-44788 Summary A path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44900 - epa4all-client has a VAU Signature bypass CVE-2026-44900 GHSA-g8r3-5hwf-qp96 HIGH maven/com.oviva.telematik:epa4all-client CVE: CVE-2026-44900 Impact In SignedPublicKeysTrustValidatorImpl.isTrusted(), the ECDSA signature verification at line 45 discards the boolean return value of Signature.verify(). The method performs certificate chain validation, OCSP check, and signature algorithm

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44896 - Mistune has XSS via unescaped figclass/figwidth in Figure directive CVE-2026-44896 GHSA-58cw-g322-p94v MEDIUM pip/mistune CVE: CVE-2026-44896 In src/mistune/directives/image.py, the render_figure() function concatenates figclass and figwidth options directly into HTML attributes without escaping (lines 152-168). This allows attribute injection and XSS

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44708 - Mistune Math Plugin has an XSS Escape Bypass CVE-2026-44708 GHSA-8g87-j6q8-g93x MEDIUM pip/mistune CVE: CVE-2026-44708 Summary The mistune math plugin renders inline math ($...$) and block math ($$...$$) by concatenating the raw user-supplied content directly into the HTML output without any HTML escaping. This occurs even when the

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44837 - view_component: System Test Entry Point Path Check Allows Sibling Directory Esca CVE-2026-44837 GHSA-hg3h-g7xc-f7vp MEDIUM rubygems/view_component CVE: CVE-2026-44837 Summary The system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44836 - view_component: Preview Route Can Dispatch Inherited Helper Methods CVE-2026-44836 GHSA-7f3r-gwc9-2995 MEDIUM rubygems/view_component CVE: CVE-2026-44836 Summary The preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of

📡 GitHub-Advisory · 2026-05-08 GHSA-mv93-w799-cj2w - GitPython: Newline injection in config_writer() section parameter bypasses CVE-2 CVE-2026-42215 GHSA-mv93-w799-cj2w HIGH pip/GitPython CVE: Summary The patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44844 - eml_parser has recursion DoS via nested message/rfc822 attachments CVE-2026-44844 GHSA-g47v-rwmh-r9f8 MEDIUM pip/eml_parser CVE: CVE-2026-44844 Summary EmlParser.get_raw_body_text() recurses unconditionally for every nested message/rfc822 attachment without any depth limit. An attacker who can supply a badly crafted EML file

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44843 - LangChain vulnerable to unsafe deserialization of attacker-controlled objects th CVE-2026-44843 GHSA-pjwx-r37v-7724 HIGH pip/langchain-core CVE: CVE-2026-44843 LangChain contains older runtime code paths that deserialize run inputs, run outputs, or other application-controlled payloads using overly broad object allowlists. These paths may call load() with allowed_objects="

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44330 - free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens ca CVE-2026-44330 GHSA-rwww-x45w-p52w CRITICAL go/github.com/free5gc/nef CVE: CVE-2026-44330 Summary free5GC's NEF mounts the nnef-pfdmanagement route group without inbound OAuth2/bearer-token authorization. A network attacker who can reach NEF on the

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44329 - free5GC's SMF UPI management interface lacks auth middleware; unauthenticated to CVE-2026-44329 GHSA-3258-qmv8-frp3 CRITICAL go/github.com/free5gc/smf CVE: CVE-2026-44329 Summary free5GC's SMF mounts the UPI management route group without OAuth2/bearer-token authorization middleware. A network attacker who can reach SMF on

📡 GitHub-Advisory · 2026-05-08 CVE-2026-44328 - free5GC's SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion v CVE-2026-44328 GHSA-p9mg-74mg-cwwr HIGH go/github.com/free5gc/smf CVE: CVE-2026-44328 Summary free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware (same root cause as the broader