# CVEs published 2023-05-21

7 CVEs were published on May 21, 2023: 0 critical, 0 high. Days are UTC.

- [CVE-2023-2826](https://cve.now/CVE-2023-2826.md): SourceCodester Class Scheduling System POST Parameter search\_teacher\_result.php cross site scripting (CVSS 3.5, SourceCodester Class Scheduling System)
- [CVE-2020-36694](https://cve.now/CVE-2020-36694.md): An issue was discovered in netfilter in the Linux kernel before 5.10. (CVSS 6.7)
- [CVE-2021-46888](https://cve.now/CVE-2021-46888.md): An issue was discovered in hledger before 1.23. (no CVSS)
- [CVE-2023-33250](https://cve.now/CVE-2023-33250.md): The Linux kernel 6.3 has a use-after-free in iopt\_unmap\_iova\_range in drivers/iommu/iommufd/io\_pagetable.c. (CVSS 4.4)
- [CVE-2023-33251](https://cve.now/CVE-2023-33251.md): When Akka HTTP before 10.5.2 accepts file uploads via the FileUploadDirectives.fileUploadAll directive, the temporary file it creates has to (CVSS 4.7)
- [CVE-2023-33252](https://cve.now/CVE-2023-33252.md): iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modu (no CVSS, snarkjs)
- [CVE-2023-33254](https://cve.now/CVE-2023-33254.md): There is an LDAP bind credentials exposure on KACE Systems Deployment and Remote Site appliances 9.0.146. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-05-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.