Lucene search
+L

9808 matches found

Nuclei
Nuclei
added 8 hours ago73 views

Kentico - Installer Privilege Escalation

Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 are susceptible to a privilege escalation attack. An attacker can obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard. id: CVE-2017-17736 info: name: Kentico - Installer...

9.8CVSS8.4AI score0.6936EPSS
Exploits1References5
Nuclei
Nuclei
added 8 hours ago21 views

MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting

paintballrefjosh/MaNGOSWebV4 4.0.8 contains a reflected XSS caused by unsanitized input in install/index.php step parameter, letting attackers execute arbitrary scripts in the victim's browser, exploit requires victim to visit a maliciously crafted URL id: CVE-2017-6478 info: name: MaNGOSWebV4...

6.1CVSS6.4AI score0.02574EPSS
Exploits6References4
Nuclei
Nuclei
added 8 hours ago41 views

osCommerce 2.3.4.1 - Remote Code Execution

osCommerce Online Merchant 2.3.4.1 contains a remote code execution caused by insecure default configuration and missing authentication in the installer workflow, letting unauthenticated attackers execute arbitrary PHP code via install4.php, exploit requires accessible /install/ directory after...

9.3CVSS6.7AI score0.0282EPSS
Exploits0References4
EUVD
EUVD
added yesterday7 views

EUVD-2026-42362

Composer: Arbitrary file write outside vendor via malicious transitive package name...

7CVSS5.1AI score0.00132EPSS
Exploits0References6
RedHat Linux
RedHat Linux
added yesterday4 views

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

7.8CVSS6.1AI score0.00156EPSS
Exploits0References5
RedHat Linux
RedHat Linux
added yesterday3 views

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

7.8CVSS6.1AI score0.00156EPSS
Exploits0References5
RedHat Linux
RedHat Linux
added yesterday3 views

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

7.8CVSS6.1AI score0.00156EPSS
Exploits0References5
CVE
CVE
added yesterday6 views

CVE-2026-16247

The CVE affects _connect.BRAIN prior to version 5.06. During setup, LogPathConfig.exe is executed and deletes/recreates %ProgramData% permissions, granting the Windows group Everyone full control instead of restricting access to %ProgramData\Bizerba_connect.BRAIN or %ProgramData\Bizerba\BCT. Star...

7.3CVSS5.4AI score
Exploits0References1
CVE
CVE
added 4 days ago14 views

CVE-2026-63308

Helm

5.3CVSS5.4AI score0.00234EPSS
Exploits0References4
Positive Technologies
Positive Technologies
added 4 days ago10 views

PT-2026-60806

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in...

5.3CVSS5.3AI score0.00234EPSS
Exploits0References4
NVD
NVD
added 5 days ago9 views

CVE-2026-53411

A time-of-check to time-of-use TOCTOU race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges...

7.8CVSS0.00143EPSS
Exploits0References1
Cvelist
Cvelist
added 5 days ago37 views

CVE-2026-53411 Zoom Workplace VDI Plugin for Windows - Improper Input Validation

A time-of-check to time-of-use TOCTOU race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges...

7.8CVSS0.00143EPSS
Exploits0References1
Cvelist
Cvelist
added 5 days ago36 views

CVE-2026-53410 Zoom Clients for Windows - Race Condition

A time-of-check to time-of-use TOCTOU race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges...

7CVSS0.00093EPSS
Exploits0References1
NVD
NVD
added 5 days ago10 views

CVE-2026-59865

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota info read x-ms-kiota-info.languagesInformation..dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command,...

9.3CVSS0.0319EPSS
Exploits0References4
Cvelist
Cvelist
added 5 days ago35 views

CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

9.8CVSS0.00427EPSS
Exploits0References2
CVE
CVE
added 5 days ago14 views

CVE-2026-63087

Grafana OnCall 1.16.11 is affected by an unauthenticated token-hijack vulnerability via the internal plugin install endpoint. An attacker can POST to the endpoint using hardcoded default stack_id and org_id values to obtain a valid PluginAuthToken, which can be used to authenticate against intern...

9.8CVSS6.2AI score0.00427EPSS
Exploits0References2
OSV
OSV
added 5 days ago6 views

CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

9.3CVSS6.2AI score0.00427EPSS
Exploits0References5
Cvelist
Cvelist
added 5 days ago33 views

CVE-2026-59865 Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota info read x-ms-kiota-info.languagesInformation..dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command,...

9.3CVSS0.0319EPSS
Exploits0References4
CVE
CVE
added 5 days ago9 views

CVE-2026-59865

Kiota (OpenAPI-based HTTP Client code generator) prior to version 1.32.5 is vulnerable. The issue arises in kiota info where x-ms-kiota-info.languagesInformation..dependencyInstallCommand, along with dependency name/version, could be used to present a spec-supplied command as Kiota’s recommended ...

9.3CVSS6.2AI score0.0319EPSS
Exploits0References4
OSV
OSV
added 5 days ago6 views

CVE-2026-59865 Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota info read x-ms-kiota-info.languagesInformation..dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command,...

9.3CVSS6.2AI score0.0319EPSS
Exploits0References6
Rows per page
Query Builder