Lucene search
+L

169648 matches found

Tenable Nessus
Tenable Nessus
added 2026/08/07 12:00 a.m.13 views

Linux Distros Unpatched Vulnerability : CVE-2026-19166

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HT...

9.6CVSS5.4AI score0.00423EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/06 10:37 p.m.10 views

CVE-2026-63508

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.5AI score0.00442EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/06 10:37 p.m.12 views

CVE-2026-56162

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.7AI score0.00484EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/06 10:37 p.m.12 views

CVE-2026-62896

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network...

9.6CVSS5.5AI score0.00381EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/06 10:18 p.m.11 views

CVE-2026-70636

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers...

8.7CVSS0.00373EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/06 10:18 p.m.21 views

CVE-2026-70558

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

9.8CVSS0.00596EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/06 10:18 p.m.7 views

CVE-2026-65400

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials...

9.8CVSS0.00751EPSS
SaveExploits2References7
NVD
NVD
added 2026/08/06 10:17 p.m.19 views

CVE-2026-53983

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

9.2CVSS0.00325EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/06 10:17 p.m.10 views

CVE-2026-48087

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

9.8CVSS0.00457EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/06 10:17 p.m.11 views

CVE-2026-48079

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

7.4CVSS0.00386EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/06 10:17 p.m.12 views

CVE-2026-48054

OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file test/test.ts by interpolating user-supplied opts.name ERC20/ERC721 and opts.uri ERC1155 directly into TypeScript...

8.8CVSS0.00455EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/06 10:17 p.m.11 views

CVE-2026-45378

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verification admin UI embeds verificationattachment blobs through reusable signed Active Storage disk URLs, allowing anyone who obtains a URL to...

7.5CVSS0.00303EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/06 10:17 p.m.9 views

CVE-2026-45414

Decidim is a participatory democracy framework. Prior to 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, JWT-backed API authentication is not bound to the organization selected by the current host, allowing a JWT issued for one tenant to be replayed against another tenant’s API to read...

8.5CVSS0.00324EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/06 10:16 p.m.6 views

DEBIAN-CVE-2026-19166

Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

9.6CVSS5.3AI score0.00423EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/06 10:16 p.m.9 views

CVE-2026-19166

Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

9.6CVSS0.00423EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/06 10:16 p.m.11 views

CVE-2026-15147

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark...

5.3CVSS0.00125EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
added 2026/08/06 10:16 p.m.13 views

CVE-2026-19166

Use after free in Web Authentication in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

9.6CVSS5.3AI score0.00423EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/06 9:32 p.m.20 views

CVE-2026-48087 OpenReception: WebAuthn passkey injection allows account takeover

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the registration handler at POST /api/auth/register/userId validates the relationship between the WebAuthn challenge and the registration cookie's email but never...

9.8CVSS5.5AI score
SaveExploits0References4
OSV
OSV
added 2026/08/06 9:31 p.m.17 views

CVE-2026-70636 Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers...

8.7CVSS5.5AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/06 9:31 p.m.33 views

CVE-2026-70636 Flowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers...

8.7CVSS0.00373EPSS
SaveExploits0References3
Rows per page
Query Builder