Lucene search
+L

150818 matches found

Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/18 12:00 a.m.•2 views

CVE-2026-83946: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Portal allows an unauthorized attacker to perform spoofing over a network...

8.2CVSS5.8AI score0.0032EPSS
SaveExploits0References3
Amazon
Amazon
•added 2026/09/18 12:00 a.m.•7 views

Important: kernel-livepatch-6.1.175-219.359

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader CVE-2026-68121 In the Linux kernel, the following vulnerability has been resolved: sctp: prevent peer transport count overflow CVE-2026-74469 In the Linux kernel, t...

8.8CVSS6.7AI score0.01083EPSS
SaveExploits7
EUVD
EUVD
•added 2026/09/18 12:00 a.m.•12 views

EUVD-2026-82975

NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handleimportprivilege.php...

8.8CVSS5.8AI score0.01086EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/18 12:00 a.m.•6 views

CVE-2026-16515: Insufficient Control of Network Message Volume (Network Amplification)

neticmpv6senderror in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules do not answer an ICMPv6 error with an ICMPv6 error. It did not check whether the triggering packet's source address identifies a single node rule e.6 or whether the packet was sen...

4.7CVSS5.8AI score0.002EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/18 12:00 a.m.•4 views

CVE-2026-93839: Missing Authentication for Critical Function

LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pdregister WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer address validation. Attackers can disclose full user prompts routed to their socket...

9.8CVSS5.9AI score0.00761EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/18 12:00 a.m.•1 views

CVE-2026-85887: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

7.7CVSS5.7AI score0.0084EPSS
SaveExploits0References3
CVE
CVE
•added 2026/09/18 12:00 a.m.•33 views

CVE-2026-88622

The NUUO Network Video Recorder 2.0.0 is vulnerable to a Command Injection flaw located in the handle_import_privilege.php component. The root cause is the improper neutralization of special elements used in a command . This vulnerability allows for high-impact consequences involving confidential...

8.8CVSS5.8AI score0.01086EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/18 12:00 a.m.•3 views

CVE-2026-58197: Improper Access Control

ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol servers. Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to...

8.8CVSS5.8AI score0.00372EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/18 12:00 a.m.•3 views

CVE-2026-69843: Authentication Bypass by Spoofing

Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.8AI score0.00901EPSS
SaveExploits0References3
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/18 12:00 a.m.•2 views

CVE-2026-76900: Server-Side Request Forgery (SSRF)

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through...

6.8CVSS5.8AI score0.005EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/17 11:18 p.m.•21 views

CVE-2026-83944

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

10CVSS0.00442EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/17 11:04 p.m.•48 views

CVE-2026-83946

CVE-2026-83946 is a cross-site scripting (XSS) vulnerability in Azure Portal , caused by improper neutralization of input during web page generation. An unauthorized attacker with network access can exploit this to perform spoofing , achieving high confidentiality impact and low integrity impact ...

8.2CVSS5.8AI score0.0032EPSS
SaveExploits0References1Affected Software1
CVE
CVE
•added 2026/09/17 10:55 p.m.•57 views

CVE-2026-70200

Azure Logic Apps is affected by a path traversal vulnerability (improper limitation of a pathname to a restricted directory) that allows an unauthorized attacker to elevate privileges over a network. The CNA-assigned CVSS 3.1 score is 10.0 (Critical) , reflecting a network-based attack with low c...

10CVSS5.8AI score0.006EPSS
SaveExploits0References1Affected Software1
OSV
OSV
•added 2026/09/17 9:17 p.m.•5 views

DEBIAN-CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...

3.7CVSS5.9AI score0.00245EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
•added 2026/09/17 9:17 p.m.•10 views

CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...

5.9AI score0.00245EPSS
SaveExploits0References3
CVE
CVE
•added 2026/09/17 9:08 p.m.•61 views

CVE-2026-93384

Google Chrome on Android prior to version 153.0.8010.52 is vulnerable to a server-side request forgery (SSRF) in the Omnibox component. A remote attacker can leverage social engineering and crafted network traffic to bypass system access restrictions. This vulnerability has been addressed in the ...

3.7CVSS5.9AI score0.00245EPSS
SaveExploits0References2Affected Software1
Debian CVE
Debian CVE
•added 2026/09/17 9:08 p.m.•9 views

CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...

3.7CVSS5.9AI score0.00245EPSS
SaveExploits0
Cvelist
Cvelist
•added 2026/09/17 9:08 p.m.•34 views

CVE-2026-93384

Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. Chromium security severity: Medium...

0.00245EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/09/17 8:19 p.m.•36 views

CVE-2026-54565 rhwp browser extension performs SSRF / private-network requests and leaks HWP preview data to untrusted pages

rhwp is an HWP viewer and editor implemented in Rust and WebAssembly. Prior to rhwp 0.7.15 and rhwp Chrome and Firefox extension 0.2.4, the browser extensions use an all-URLs host permission to detect HWP and HWPX links on visited pages, but the service workers do not validate message senders, UR...

4.7CVSS0.00192EPSS
SaveExploits0References3
OSV
OSV
•added 2026/09/17 5:16 p.m.•7 views

GHSA-H7VF-4X9W-H99V oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

Summary oras-go's pagination helper parseLink in registry/remote/utils.go follows the Link response header from a registry without validating the URL's host or scheme. When a malicious registry returns a Link header containing an absolute URL pointing to an arbitrary host e.g., a cloud metadata...

4.7CVSS5.9AI score0.00349EPSS
SaveExploits0References5
Rows per page
Query Builder