Lucene search
+L

223562 matches found

CVE
CVE
added 2026/07/29 9:31 a.m.27 views

CVE-2026-16597

Summary: CVE-2026-16597 affects the GTM4WP WordPress plugin (versions ≤ 1.22.3) and allows unauthenticated stored XSS via WooCommerce Billing Fields when the GTM4WP_OPTION_INTEGRATE_WCORDERDATA option is enabled. The root cause is insufficient input sanitization and output escaping in the plugin’...

7.2CVSS6AI score0.00241EPSS
SaveExploits0References7
NVD
NVD
added 2026/07/29 9:16 a.m.9 views

CVE-2026-13425

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

7.2CVSS0.00248EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/07/29 5:2 a.m.91 views

Cisco VPN Routers - Unauthenticated Arbitrary File Upload

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...

9.8CVSS6.9AI score0.88874EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/07/28 9:25 p.m.5 views

firefox: thunderbird: Site isolation issue in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

5.4CVSS6.2AI score0.00339EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/28 4:23 p.m.7 views

firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw...

4.3CVSS6.1AI score0.00381EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/28 4:23 p.m.7 views

gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser reads a segment length value from the bitstream without validating it against available data. A remote attacker could trick a user into opening a specially crafted JPEG file, causi...

7.1CVSS5.9AI score0.00341EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/28 4:14 p.m.37 views

CVE-2026-54345 GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)

gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length by subtracting a fixed header size from an attacker-controlled AVP Length field, so a vendor-flagged AVP whose Length is smaller than the 12-byte header...

6.9CVSS0.00388EPSS
SaveExploits1References3
OSV
OSV
added 2026/07/28 3:43 p.m.7 views

GHSA-8R6W-3QQ5-4P4R Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Summary A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing serveruuid, useruuid, and uniqueid, regardless of the token’s intended purpose. Because the Panel issues...

8.1CVSS6AI score0.00357EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2026/07/28 3:22 p.m.4 views

CVE-2025-50327

A flaw was found in ZPAQFRANZ. A remote attacker can exploit this vulnerability by bypassing the Mark-of-the-Web protection mechanism, which is designed to prevent the execution of untrusted files. This bypass allows the attacker to escalate privileges and execute arbitrary code on the affected...

8.8CVSS6.4AI score0.00386EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/28 1:17 p.m.11 views

CVE-2026-18038

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/toolsinvoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched...

5.3CVSS0.00222EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/28 12:45 p.m.3 views

CVE-2026-18038 nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/toolsinvoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched...

5.3CVSS5.5AI score
SaveExploits0References9
Cvelist
Cvelist
added 2026/07/28 12:45 p.m.30 views

CVE-2026-18038 nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure

A flaw has been found in nextlevelbuilder GoClaw up to 3.13.2. Affected by this vulnerability is the function ExecTool.Execute of the file goclaw/internal/http/toolsinvoke.go of the component jq Handler. Executing a manipulation can lead to information disclosure. The attack can be launched...

5.3CVSS0.00222EPSS
SaveExploits0References7
GithubExploit
GithubExploit
added 2026/07/28 10:16 a.m.74 views

Root-My-Device-Payloads

Root My Device Payloads A fork of BuSung-dev/Root-My-Galaxy-...

7.8CVSS5.9AI score0.00725EPSS
SaveExploits54
GithubExploit
GithubExploit
added 2026/07/28 9:35 a.m.55 views

Exploit for CVE-2026-64600

No d...

7.8CVSS7.3AI score0.00507EPSS
SaveExploits6
NVD
NVD
added 2026/07/28 7:16 a.m.8 views

CVE-2026-16585

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesticker function in all versions up to, and including, 2.15.19. This makes it possible for authenticate...

7.2CVSS0.00734EPSS
SaveExploits0References6
Nuclei
Nuclei
added 2026/07/28 5:35 a.m.73 views

HPE Integrated Lights-out 4 (ILO4) <2.53 - Authentication Bypass

HPE Integrated Lights-out 4 iLO 4 prior to 2.53 was found to contain an authentication bypass and code execution vulnerability. id: CVE-2017-12542 info: name: HPE Integrated Lights-out 4 ILO4 2.53 - Authentication Bypass author: pikpikcu severity: critical description: HPE Integrated Lights-out 4...

10CVSS7.6AI score0.99294EPSS
SaveExploits9References5
Nuclei
Nuclei
added 2026/07/28 5:35 a.m.118 views

Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass

Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code via the sgcgoogleanalytic parameter that runs on all pages served by WordPress. The saveGoogleCode function in smartgooglecode.php does not check if the...

9.8CVSS7.4AI score0.91141EPSS
SaveExploits5References5
Nuclei
Nuclei
added 2026/07/28 5:35 a.m.254 views

Skype for Business 2019 (SfB) - Blind Server-side Request Forgery

Skype Pre-Auth Server-side Request Forgery SSRF vulnerability id: CVE-2023-41763 info: name: Skype for Business 2019 SfB - Blind Server-side Request Forgery author: hateshape severity: medium description: | Skype Pre-Auth Server-side Request Forgery SSRF vulnerability impact: | Unauthenticated...

5.3CVSS7AI score0.90353EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/07/28 5:35 a.m.77 views

Fuel CMS 1.4.7 - SQL Injection

FUEL CMS 1.4.7 allows SQL Injection via the col parameter to /pages/items, /permissions/items, or /navigation/items. id: CVE-2020-17463 info: name: Fuel CMS 1.4.7 - SQL Injection author: Thirukrishnan severity: critical description: | FUEL CMS 1.4.7 allows SQL Injection via the col parameter to...

9.8CVSS7.5AI score0.90044EPSS
SaveExploits4References5
ATTACKERKB
ATTACKERKB
added 2026/07/28 12:0 a.m.7 views

CVE-2026-51274

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

5.4AI score0.00414EPSS
SaveExploits0References3
Rows per page
Query Builder