Lucene search
+L

169194 matches found

EUVD
EUVD
added 2026/08/11 2:35 a.m.11 views

EUVD-2026-55929

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

4.9CVSS5.3AI score0.00344EPSS
SaveExploits0References2
Chainguard
Chainguard
added 2026/08/11 2:17 a.m.15 views

GHSA-GM37-52C6-37MW vulnerabilities

Vulnerabilities for packages: open-webui...

5.2AI score
SaveExploits0
Wolfi
Wolfi
added 2026/08/11 2:16 a.m.14 views

CVE-2026-67422 vulnerabilities

Vulnerabilities for packages: open-webui...

7.5CVSS5.1AI score0.00582EPSS
SaveExploits0
Wolfi
Wolfi
added 2026/08/11 2:16 a.m.12 views

CVE-2026-59936 vulnerabilities

Vulnerabilities for packages: open-webui...

8.7CVSS5.1AI score0.0034EPSS
SaveExploits0
Wolfi
Wolfi
added 2026/08/11 2:16 a.m.14 views

CVE-2026-59937 vulnerabilities

Vulnerabilities for packages: open-webui...

7.5CVSS5.1AI score0.0034EPSS
SaveExploits0
NVD
NVD
added 2026/08/11 1:17 a.m.6 views

CVE-2026-66775

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

4.3CVSS0.00124EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/11 1:17 a.m.8 views

CVE-2026-66773

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

5.9CVSS0.00194EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/11 12:31 a.m.20 views

EUVD-2025-210673

The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid...

8.7CVSS5.6AI score0.00219EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/11 12:31 a.m.11 views

EUVD-2025-210672

Cross-Site Request Forgery weaknesses in the Administrative Console of PingFederate versions before version 13.1 may allow actors to perform unauthorized actions via specially-crafted links triggered by administrators with active sessions...

6.1CVSS5.3AI score0.00151EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/11 12:19 a.m.9 views

EUVD-2026-55887

SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an...

4.3CVSS5.2AI score0.00124EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/11 12:19 a.m.50 views

CVE-2026-66775

CVE-2026-66775 affects SAP Approuter (SAP Business AI Platform). The vulnerability is a CSRF flaw where cross-site request forgery protection is not enforced on the authentication flow by default. An unauthenticated attacker could craft a malicious link to lure a victim and bind the victim’s sess...

4.3CVSS5.2AI score0.00124EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/11 12:18 a.m.12 views

EUVD-2026-55885

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

5.9CVSS5.1AI score0.00194EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/11 12:18 a.m.12 views

CVE-2026-66773 Server-controlled `__next` URL is not checking cross-origin

A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability...

5.9CVSS5.2AI score
SaveExploits0References4
CVE
CVE
added 2026/08/11 12:18 a.m.53 views

CVE-2026-66772

CVE-2026-66772 concerns SAP BusinessObjects BI Platform (Admin Tools), where a missing authorization check on certain administrative functionality lets an authenticated non-administrative user bypass restrictions to glean limited information about the affected feature. The impact is described as ...

4.3CVSS5.2AI score0.00182EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
added 2026/08/11 12:4 a.m.10 views

SUSE CVE-2026-56750

Gitea Remember-Me Token Theft Not Invalidating Attacker Session...

9.1CVSS5.6AI score0.00342EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70359

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to...

5.3CVSS5.3AI score0.00267EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70208

An issue in usememos through v0.30.0 allows a remote authenticated attacker to perform Server-Side Request Forgery SSRF via the Webhook validation mechanism in internal/webhook/validate.go, by setting a webhook target to an internal address...

8.5CVSS5.3AI score0.00291EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.3 views

PT-2026-70437

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

7.8CVSS5.4AI score0.00278EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.4 views

PT-2026-70149

Name of the Vulnerable Software and Affected Versions Swing Music version 3.0.0 Description A missing authentication issue allows unauthenticated remote attackers to create arbitrary user accounts. This occurs because the 'POST /auth/profile/create' endpoint is allowlisted from JWT JSON Web Token...

7.5CVSS5.4AI score0.00308EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/11 12:0 a.m.4 views

PT-2026-70159

FreeRDP before 3.30.0 contains a server-side authentication bypass in the RDSTLS handshake. When a server is configured with RdstlsSecurity = TRUE, the handshake dispatches inbound PDUs based solely on the attacker-supplied wire pduType without verifying that the received PDU is the one required ...

7.5CVSS5.5AI score0.00435EPSS
SaveExploits0References4
Rows per page
Query Builder