Lucene search
+L

13234 matches found

Cvelist
Cvelist
•added 2026/08/10 12:00 p.m.•38 views

CVE-2026-68219 media: nxp: imx8-isi: Fix potential out-of-bounds issues

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix potential out-of-bounds issues The maximum downscaling factor supported by ISI can be up to 16. Add minimum value constraint before applying the setting to hardware. Otherwise, the process will not respo...

7.8CVSS0.00175EPSS
SaveExploits0References5
CVE
CVE
•added 2026/08/10 11:59 a.m.•69 views

CVE-2026-68187

CVE-2026-68187 affects the Linux kernel in the exec path, specifically the unsigned loop counter wrap in transfer_args_to_stack(). The stop value comes from bprm->p >> PAGE_SHIFT and index is an unsigned long; if bprm->p = stop never terminates after index reaches 0, wrapping to ULONG...

5.3AI score0.0022EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/08/10 11:58 a.m.•13 views

EUVD-2026-55504

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...

5.3AI score0.00552EPSS
SaveExploits0References5
NVD
NVD
•added 2026/08/10 11:17 a.m.•24 views

CVE-2026-72589

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

9.8CVSS0.01947EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/08/10 10:41 a.m.•15 views

EUVD-2026-55217

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

9.8CVSS5.8AI score0.01947EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/10 7:16 a.m.•19 views

CVE-2026-19075

All-in-One Video Gallery registers a public, unauthenticated file-download handler triggered by ?vdl= on any aiovgvideos post public/video.php, AIOVGPublicVideo::downloadvideo, which reads the post's mp4 meta value and streams that URL's response back to the requester...

5CVSS0.0027EPSS
SaveExploits0References1
attackerkb
attackerkb
•added 2026/08/10 6:00 a.m.•19 views

CVE-2026-18468

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...

5.3AI score0.00383EPSS
SaveExploits0References1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/10 12:00 a.m.•1 views

CVE-2026-68149: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: fs: preserve ACLDONTCACHE state in forgetcachedacl The ACLDONTCACHE state is meant to be a constant state for the inode for filesystems that want to opt out of posix acl caching. Commit facd61053cff1 "fuse: fixes after adapting t...

8.4CVSS5.8AI score0.00135EPSS
SaveExploits0References1
Redos
Redos
•added 2026/08/10 12:00 a.m.•11 views

ROS-20260810-73-0028

The vulnerability in etcd is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to enhance their privileges...

4.3CVSS5.3AI score0.00274EPSS
SaveExploits0
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/10 12:00 a.m.•3 views

CVE-2026-19049: Improper Neutralization of Special Elements used in an SQL Command

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete...

8.6CVSS5.9AI score0.00517EPSS
SaveExploits0References2
attackerkb
attackerkb
•added 2026/08/09 6:17 p.m.•13 views

CVE-2026-70395

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

2.1CVSS5.3AI score0.00197EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/08/09 9:30 a.m.•18 views

EUVD-2026-54914

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument taskid/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public...

6.9CVSS6.3AI score0.00547EPSS
SaveExploits0References6
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/09 12:00 a.m.•2 views

CVE-2026-70395: Improper Neutralization of Special Elements in Data Query Logic

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ash allows an attacker to forge a relationship to a record they cannot name, and to recover the secret value used to look it up. When managerelationship is used with onlookup: :relate on a belongsto...

2.1CVSS5.8AI score0.00197EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/08 5:16 p.m.•20 views

CVE-2026-71951

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

9.8CVSS0.03168EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/08/08 4:53 p.m.•51 views

CVE-2026-71951 D-Link DWR-M961 Command Injection via /boafrm/formIMEISetup

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

9.8CVSS0.03168EPSS
SaveExploits0References3
attackerkb
attackerkb
•added 2026/08/08 6:38 a.m.•15 views

CVE-2026-14526

The AI Copilot – Content Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to creat...

9.8CVSS5.3AI score0.00912EPSS
SaveExploits0References14
CVE
CVE
•added 2026/08/07 9:26 p.m.•108 views

CVE-2026-48170

The CVE-2026-48170 issue affects the scim-patch library (SCIM PATCH processing). Before version 0.9.1, PATCH operations with a value object containing keys like proto .someProp can pollute Object.prototype, affecting all plain objects in the Node process. This can enable prototype pollution with ...

9.1CVSS5.4AI score0.00403EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/07 6:33 p.m.•14 views

GHSA-9HJ4-R449-HFVC Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls...

8.7CVSS6.3AI score0.00428EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
•added 2026/08/07 6:33 p.m.•17 views

Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls...

8.7CVSS6.3AI score0.00428EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
•added 2026/08/07 6:31 p.m.•41 views

CVE-2026-71847 Ruby JSON: JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object...

8.7CVSS0.00428EPSS
SaveExploits0References1
Rows per page
Query Builder