Lucene search
+L

65522 matches found

Vulnrichment
Vulnrichment
•added 2026/07/20 12:04 p.m.•10 views

CVE-2026-63762 SurrealDB before v2.6.1 Denial of Service via scripting

SurrealDB before v2.6.1 and before v3.0.0-beta.3 contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability disabled by default. Any user able to execute arbitrary queries — including unauthenticated guests when...

6CVSS5.7AI score0.0045EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
•added 2026/07/20 11:56 a.m.•20 views

axios: Axios: Information disclosure of proxy credentials via redirect flows

A flaw was found in Axios. During specific proxy-to-direct redirect flows in the Node.js HTTP adapter, a remote attacker could exploit this vulnerability. The Proxy-Authorization header, which contains proxy credentials and is intended only for the outbound proxy, may be forwarded to the final...

8.2CVSS5.3AI score0.0076EPSS
SaveExploits1References5
RedHat Linux
RedHat Linux
•added 2026/07/20 11:56 a.m.•22 views

jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON JavaScript Object Notation data to a service that reads and processes it. This can lead to a Denial of Service Do...

7.5CVSS5.5AI score0.00616EPSS
SaveExploits1References7
OSV
OSV
•added 2026/07/20 10:19 a.m.•10 views

MAL-2026-10876 Malicious code in @dxcl/indicators-js (npm)

--- -= Per source details. Do not edit below this line.=-...

5.3AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
•added 2026/07/20 10:19 a.m.•26 views

Malicious code in @dxcl/indicators-js (npm)

--- -= Per source details. Do not edit below this line.=-...

5.3AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
•added 2026/07/20 10:19 a.m.•28 views

Malicious code in @dxcl/customer-js (npm)

--- -= Per source details. Do not edit below this line.=-...

5.3AI score
SaveExploits0References1
NVD
NVD
•added 2026/07/20 8:16 a.m.•20 views

CVE-2026-2445

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

6.1CVSS0.00253EPSS
SaveExploits0References1
attackerkb
attackerkb
•added 2026/07/20 8:06 a.m.•20 views

CVE-2026-2445

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

6.1CVSS5.4AI score0.00253EPSS
SaveExploits0References2Affected Software3
EUVD
EUVD
•added 2026/07/20 8:06 a.m.•26 views

EUVD-2026-45898

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

6.1CVSS5.4AI score0.00253EPSS
SaveExploits0References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/07/20 12:00 a.m.•0 views

CVE-2026-63762: NULL Pointer Dereference

SurrealDB before v2.6.1 and before v3.0.0-beta.3 contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability disabled by default. Any user able to execute arbitrary queries — including unauthenticated guests when...

6.5CVSS6AI score0.0045EPSS
SaveExploits0References4
Redos
Redos
•added 2026/07/20 12:00 a.m.•10 views

ROS-20260720-73-0033

The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type conversion errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

8.3AI score0.00417EPSS
SaveExploits0
Redos
Redos
•added 2026/07/20 12:00 a.m.•13 views

ROS-20260720-73-0070

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to cause a service failure...

5AI score0.00193EPSS
SaveExploits0
AlmaLinux
AlmaLinux
•added 2026/07/20 12:00 a.m.•18 views

Important: webkit2gtk3 security update

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. Security Fixes: Mozilla: Arbitrary JavaScript execution in PDF.js CVE-2024-4367 webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash CVE-2026-39872 webkitgtk: webkitgtk:...

8.8CVSS8.2AI score0.7066EPSS
SaveExploits17References48
Tenable Nessus
Tenable Nessus
•added 2026/07/20 12:00 a.m.•13 views

Amazon Linux 2023 : nodejs22, nodejs22-devel, nodejs22-full-i18n (ALAS2023-2026-1981)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1981 advisory. A use-after-free / double-free in c-ares' query-completion handling. Thesame flaw -- a query's callback being invoked while the query is stilllinked in the channel's internal lookup structures -- is...

7.5CVSS5.4AI score0.00845EPSS
SaveExploits0References4
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/07/20 12:00 a.m.•1 views

CVE-2026-44230: Improper Neutralization of Input During Web Page Generation

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

6.1CVSS5.9AI score0.00263EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/07/20 12:00 a.m.•30 views

PT-2026-61578

SurrealDB before v2.6.1 and before v3.0.0-beta.3 contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability disabled by default. Any user able to execute arbitrary queries — including unauthenticated guests when...

6CVSS5.8AI score0.0045EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/07/20 12:00 a.m.•20 views

EUVD-2026-46050

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...

6.1CVSS5.1AI score0.00263EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/07/20 12:00 a.m.•33 views

PT-2026-61540

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

6.1CVSS5.4AI score0.00253EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/07/20 12:00 a.m.•0 views

CVE-2026-35198: Improper Neutralization of Input During Web Page Generation

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, a stored cross-site scripting XSS vulnerability in the form builder allows a low-privileged team member to inject malicious JavaScript that executes when a team owner views the form, leading to complete account takeover through...

9CVSS5.6AI score0.0049EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/07/20 12:00 a.m.•11 views

CVE-2026-26483

Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting XSS vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject...

5AI score0.00263EPSS
SaveExploits0References2
Rows per page
Query Builder