Lucene search
+L

59748 matches found

Vulnrichment
Vulnrichment
added 2026/07/23 8:17 p.m.5 views

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

7.1CVSS5.8AI score0.00303EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/23 8:17 p.m.36 views

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

7.1CVSS0.00303EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/23 8:17 p.m.6 views

CVE-2026-47723 nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.1, none of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security,...

7.1CVSS5.3AI score
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/07/23 7:35 p.m.10 views

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the unstable RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect...

6.9CVSS5.3AI score0.0035EPSS
SaveExploits0References6Affected Software1
NVD
NVD
added 2026/07/23 6:17 p.m.8 views

CVE-2026-6516

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API...

10CVSS0.04729EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/23 6:17 p.m.11 views

CVE-2026-65700

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

9.8CVSS0.01269EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/23 5:22 p.m.10 views

CVE-2026-6516

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API...

10CVSS6AI score0.04729EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/07/23 5:22 p.m.59 views

CVE-2026-6516 Remote Code Execution

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API...

10CVSS6AI score0.04729EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/23 5:22 p.m.8 views

EUVD-2026-48337

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API...

10CVSS6AI score0.04729EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/23 5:22 p.m.35 views

CVE-2026-6516 Remote Code Execution

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API...

10CVSS0.04729EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 5:22 p.m.62 views

CVE-2026-6516

CVE-2026-6516 affects Zohocorp ManageEngine ADAudit Plus versions before 8606. The issue is an unauthenticated remote code execution vulnerability caused by the vulnerable agent API, as described in the NVD entry. The CVSS‑3.1 metrics indicate a critical severity (10.0) with network attack vector...

10CVSS6AI score0.04729EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/23 5:2 p.m.9 views

CVE-2026-65700 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

9.3CVSS6.5AI score
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/07/23 5:2 p.m.12 views

CVE-2026-65700

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by supplying traversal sequences in the bearer token. The getuserdir function in...

9.8CVSS6.6AI score0.01269EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/23 5:2 p.m.21 views

CVE-2026-65700

CVE-2026-65700 affects h2oGPT 0.2.1 via the OpenAI-compatible files API. The vulnerability arises from a path traversal weakness in get_user_dir where the bearer token is unsafely used as a path component with os.path.join, allowing unauthenticated remote attackers to read, write, and delete file...

9.8CVSS6.6AI score0.01269EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/23 4:28 p.m.7 views

PYSEC-2026-3543 Open WebUI's API key endpoint restrictions bypassed via `x-api-key` header — full message processing on restricted endpoints

Summary Open WebUI allows admins to restrict which API endpoints an API key can access. When an API key is restricted from /api/v1/messages, requests using the Authorization: Bearer sk-... header are correctly blocked with 403. However, the same key sent via the x-api-key header bypasses the...

6.5CVSS6.5AI score0.00309EPSS
SaveExploits1References6
OSV
OSV
added 2026/07/23 4:24 p.m.7 views

CVE-2026-65696 Overseerr 1.35.0 Authorization Bypass via pushSubscriptions API

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

5.3CVSS5.5AI score
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/07/23 3:34 p.m.12 views

CVE-2026-16584 AWS API MCP Server Security Policy Bypass via Startup Failure

Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny or gate. When initialization of the security policy enforcement data...

7.3CVSS5.5AI score0.0013EPSS
SaveExploits0References3
Wolfi
Wolfi
added 2026/07/23 2:16 p.m.16 views

CVE-2026-59879 vulnerabilities

Vulnerabilities for packages: nextcloud-server, vitess, rancher-api-ui...

8.7CVSS7.2AI score0.00438EPSS
SaveExploits1
Wolfi
Wolfi
added 2026/07/23 2:16 p.m.20 views

GHSA-V56Q-MH7H-F735 vulnerabilities

Vulnerabilities for packages: nextcloud-server, vitess, rancher-api-ui...

5.2AI score
SaveExploits0
Microsoft CVE
Microsoft CVE
added 2026/07/23 2:0 p.m.12 views

Azure API Management (APIM) Remote Code Execution Vulnerability

Improper access control in Azure API Management APIM allows an authorized attacker to execute code over a network...

8CVSS5.6AI score0.00483EPSS
SaveExploits0
Rows per page
Query Builder