Lucene search
+L

23035 matches found

Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.25 views

PT-2026-50585

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An open redirect exists due to improper validation within the urlIsRelative function in modules/httplib/url.go. An attacker can bypass this validation by using directory traversal sequences...

6.4CVSS5.9AI score0.00248EPSS
SaveExploits0
Tenable Nessus
Tenable Nessus
added 2026/06/17 12:0 a.m.11 views

MinIO RELEASE.2022-07-24T01-54-52Z < RELEASE.2026-04-14T21-32-45Z Path Traversal (CVE-2026-42600)

The version of MinIO installed on the remote host is RELEASE.2022-07-24T01-54-52Z or later but prior to RELEASE.2026-04-14T21-32-45Z. It is, therefore, affected by a path traversal vulnerability: - A path traversal vulnerability in MinIO's ReadMultiple internode storage-REST endpoint allows a...

6.9CVSS5.4AI score0.08457EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/06/17 12:0 a.m.13 views

Traefik 2.x < 2.11.48 / 3.x < 3.6.19 / 3.7.x < 3.7.3 Authentication Bypass (CVE-2026-48020)

The version of Traefik installed on the remote macOS host is 2.x prior to 2.11.48, 3.x prior to 3.6.19, or 3.7.x prior to 3.7.3. It is, therefore, affected by an authentication bypass vulnerability: - The StripPrefix middleware allows unauthenticated attackers to bypass route-level authentication...

10CVSS6AI score0.00866EPSS
SaveExploits2References2
Packet Storm
Packet Storm
added 2026/06/17 12:0 a.m.70 views

📄 Discuz! X5.0 Local File Inclusion

This is a Metasploit auxiliary module targeting a local file inclusion vulnerability in Discuz! X5.0. ================================================================================================================================== | Title : Discuz! X5.0 LFI Metasploit Module | | Author :...

8.6CVSS5.3AI score0.00525EPSS
SaveExploits2
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.19 views

PT-2026-50516

Name of the Vulnerable Software and Affected Versions undici versions 6.x prior to 6.26.0 undici versions 7.0.0 through 7.27.x undici versions 8.x prior to 8.5.0 Description The cookie parser in the parseSetCookie function percent-decodes cookie values using qsUnescape, which converts encoded...

5.9CVSS5.5AI score0.00257EPSS
SaveExploits0References86
Positive Technologies
Positive Technologies
added 2026/06/17 12:0 a.m.28 views

PT-2026-50545

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile with an empty folder...

7.1CVSS5.4AI score0.00343EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/06/16 9:35 p.m.6 views

CVE-2026-2604 Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...

5.6CVSS5.4AI score0.00189EPSS
SaveExploits0References3
CVE
CVE
added 2026/06/16 9:35 p.m.50 views

CVE-2026-2604

Summary: CVE-2026-2604 affects evolution-data-server. An inconsistent comparison logic in the addressbook backend lets a Flatpak/D-Bus user craft a malicious URI with directory traversal sequences. This URI is stored during contact creation/modification and later rechecked with lower strictness d...

5.6CVSS5.4AI score0.00189EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/06/16 9:35 p.m.33 views

CVE-2026-2604 Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...

5.6CVSS0.00189EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/06/16 9:35 p.m.14 views

CVE-2026-2604

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...

5.6CVSS5.5AI score0.00189EPSS
SaveExploits0
OSV
OSV
added 2026/06/16 9:35 p.m.8 views

CVE-2026-2604 Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...

5.6CVSS6AI score
SaveExploits0References8
Cvelist
Cvelist
added 2026/06/16 9:17 p.m.21 views

CVE-2026-48055 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction,...

10CVSS0.00621EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/16 9:17 p.m.16 views

EUVD-2026-37500

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction,...

10CVSS5.5AI score0.00621EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/16 9:17 p.m.33 views

CVE-2026-48055

Streambert (Electron-based desktop app) has a Zip Slip vulnerability in its subtitle extraction logic affecting versions up to 2.4.0. The code concatenates raw archive entry names to a temporary directory, enabling path traversal and arbitrary file writes if a malicious ZIP with traversal sequenc...

10CVSS5.4AI score0.00621EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/06/16 9:17 p.m.11 views

CVE-2026-48055 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction,...

10CVSS5.4AI score0.00621EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/16 9:17 p.m.6 views

CVE-2026-48055 Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction

Streambert is a cross-platform Electron Desktop App to stream and download any video media. In versions 2.4.0 and prior, a high-severity Zip Slip vulnerability was identified in Streambert's subtitle extraction logic. The application does not sanitize archive entry filenames during extraction,...

10CVSS6AI score
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/06/16 8:13 p.m.41 views

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Summary Multiple security vulnerabilities in the Crawl4AI Docker API server affecting endpoints for crawling, markdown/LLM extraction, screenshots, PDFs, webhooks, monitoring, JavaScript execution, and configuration. Vulnerabilities 1. Arbitrary File Write via /screenshot and /pdf CWE-22, CVSS 9....

9.2CVSS5.8AI score0.00476EPSS
SaveExploits0References22Affected Software1
OSV
OSV
added 2026/06/16 8:13 p.m.21 views

GHSA-365W-HQF6-VXFG Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Summary Multiple security vulnerabilities in the Crawl4AI Docker API server affecting endpoints for crawling, markdown/LLM extraction, screenshots, PDFs, webhooks, monitoring, JavaScript execution, and configuration. Vulnerabilities 1. Arbitrary File Write via /screenshot and /pdf CWE-22, CVSS 9....

9.8CVSS5.8AI score0.00769EPSS
SaveExploits0References21
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/16 6:26 p.m.13 views

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-67735 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the...

7.5CVSS6.3AI score0.00864EPSS
SaveExploits3Affected Software1
GithubExploit
GithubExploit
added 2026/06/16 5:49 p.m.110 views

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 ⚠ This tool is created solely for education...

9.8CVSS6.2AI score0.97927EPSS
SaveExploits71
Rows per page
Query Builder