Lucene search
+L

28258 matches found

EUVD
EUVD
•added 2026/09/23 8:54 p.m.•10 views

EUVD-2026-85668

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

5.3CVSS6.1AI score0.00325EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/23 8:54 p.m.•7 views

CVE-2026-6925 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

5.3CVSS6.1AI score0.00325EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 8:54 p.m.•29 views

CVE-2026-6925 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

5.3CVSS0.00325EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/23 8:54 p.m.•17 views

CVE-2026-6925

IBM Concert versions 1.0.0 through 3.0.0 are susceptible to a directory traversal vulnerability. A remote attacker can exploit this by sending a specially crafted URL request containing "dot dot" sequences (e.g., /../) to access and view arbitrary files on the system. No specific remediation step...

5.3CVSS6AI score0.00325EPSS
SaveExploits0References1Affected Software1
NVD
NVD
•added 2026/09/23 8:17 p.m.•9 views

CVE-2026-84683

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

8.7CVSS0.00256EPSS
SaveExploits0References6
GithubExploit
GithubExploit
•added 2026/09/23 7:21 p.m.•24 views

Exploit for CVE-2026-87902

CVE‑2026‑87902 – WordPress Unauth LFI→RCE...

8.1CVSS6.2AI score0.19756EPSS
SaveExploits27
NVD
NVD
•added 2026/09/23 7:19 p.m.•9 views

CVE-2026-93421

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

5.3CVSS0.00404EPSS
SaveExploits0References4
CVE
CVE
•added 2026/09/23 7:02 p.m.•20 views

CVE-2026-84683

A vulnerability exists in Red Hat Ansible Automation Platform's automation-controller where the HTML view of job, ad hoc command, project update, and inventory update standard outputs fails to remove ANSI terminal escape sequences before HTML conversion. Specifically, an ANSI OSC 8 hyperlink sequ...

8.7CVSS5.6AI score0.00256EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/23 7:02 p.m.•40 views

CVE-2026-84683 Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

8.7CVSS0.00256EPSS
SaveExploits0References6
EUVD
EUVD
•added 2026/09/23 7:02 p.m.•9 views

EUVD-2026-85571

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

8.7CVSS5.6AI score0.00256EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
•added 2026/09/23 7:02 p.m.•9 views

CVE-2026-84683 Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling session takeover

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

8.7CVSS5.6AI score0.00256EPSS
SaveExploits0References6
OSV
OSV
•added 2026/09/23 7:01 p.m.•6 views

GHSA-G7F6-RXC4-QHPH Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Summary The /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in a...

5.3CVSS6AI score0.00404EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
•added 2026/09/23 7:01 p.m.•15 views

Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Summary The /csp endpoint accepts unauthenticated JSON reports and logs user-controlled values directly to stdout using print without escaping control characters. A remote attacker can include ANSI/VT100 escape sequences in fields such as blocked-uri or document-uri. When the logs are viewed in a...

5.3CVSS6AI score0.00404EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
•added 2026/09/23 6:59 p.m.•8 views

EUVD-2026-85568

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

5.3CVSS5.8AI score0.00404EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/23 6:59 p.m.•35 views

CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

5.3CVSS0.00404EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
•added 2026/09/23 6:59 p.m.•10 views

CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

5.3CVSS5.8AI score0.00404EPSS
SaveExploits0References4
CVE
CVE
•added 2026/09/23 6:59 p.m.•19 views

CVE-2026-93421

The Mesop Python-based UI framework is vulnerable to an unauthenticated ANSI escape sequence injection in the /__csp__ endpoint. The csp_report handler in mesop/server/static_file_serving.py processes attacker-controlled JSON fields (such as blocked-uri and document-uri) and prints them directly ...

5.3CVSS5.8AI score0.00404EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/23 6:59 p.m.•4 views

CVE-2026-93421 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /csp endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the cspreport handler in mesop/server/staticfileserving.py, which prints them ...

5.3CVSS5.8AI score
SaveExploits0References6
RedhatCVE
RedhatCVE
•added 2026/09/23 6:53 p.m.•9 views

CVE-2026-84683

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

8.7CVSS5.6AI score0.00256EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/23 5:17 p.m.•8 views

CVE-2026-96651

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the...

7.1CVSS0.0041EPSS
SaveExploits0References4
Rows per page
Query Builder