Lucene search
+L

59734 matches found

CVE
CVE
added 2026/07/23 5:35 a.m.14 views

CVE-2026-7534

The CVE-2026-7534 entry details a vulnerability in the SUMO Reward Points for WooCommerce plugin (WordPress) up to version 32.7.0. Affected component: SRP_REST_Earning_Controller handling REST endpoint /wp-json/wc-srp/v1/earning. Root cause: the user_has_cap filter unconditionally grants the rs_e...

7.2CVSS5.6AI score0.0019EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/07/23 3:49 a.m.11 views

openjdk: Enhance Jar handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...

7.5CVSS7.1AI score0.00256EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/07/23 2:2 a.m.17 views

openjdk: Enhance Jar file processing (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The processImpl method in SignatureFileVerifier exhibits On^2 time complexity when verifying JAR files where different entries have different signer combinations, potentially leading to DoS...

5.3CVSS7.1AI score0.00289EPSS
SaveExploits0References4
Fedora
Fedora
added 2026/07/23 1:4 a.m.7 views

[SECURITY] Fedora 43 Update: perl-DBI-1.651-1.fc43

DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used...

9.8CVSS5.4AI score0.00479EPSS
SaveExploits0
RedHat Linux
RedHat Linux
added 2026/07/23 12:40 a.m.6 views

openjdk: Enhance Jar handling (Oracle CPU 2026-07)

A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...

7.5CVSS7.1AI score0.00256EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/23 12:0 a.m.19 views

PT-2026-63590

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it...

6.4CVSS5.6AI score0.00307EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/07/23 12:0 a.m.28 views

PT-2026-64196

Name of the Vulnerable Software and Affected Versions Pronetiqs IntraVUE versions prior to 3.2.1a14 Description The software stores passwords in plaintext, which could lead to the exposure of cleartext credentials through the API. Recommendations Update to a version newer than 3.2.1a14...

8.7CVSS5.9AI score0.00232EPSS
SaveExploits0References5
Kaspersky
Kaspersky
added 2026/07/23 12:0 a.m.7 views

KLA91175 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability i...

10CVSS6.7AI score0.00973EPSS
SaveExploits0References12
OSV
OSV
added 2026/07/22 11:13 p.m.8 views

GHSA-H5V5-8746-G7MM JupyterLab PluginManager lock-rule enforcement bypass

JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins. Impact Users could workaround the plugin...

6CVSS5.4AI score
SaveExploits0References9
Patchstack
Patchstack
added 2026/07/22 10:0 p.m.10 views

NPM: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

NPM: n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs vulnerability discovered by ? in WordPress Npm n8n versions 2.29.8...

8.9CVSS5.4AI score0.0047EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/07/22 10:0 p.m.8 views

GHSA-777W-RPR6-C52H n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Impact JWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acting user's actual role. A low-privileged user who could obtain a valid external JWT trusted by a configured issuer could therefore use the resulting access token to invoke...

8.9CVSS6AI score0.0047EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2026/07/22 10:0 p.m.8 views

n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs

Impact JWTs issued through the Token Exchange module were assigned all Public API key scopes, regardless of the acting user's actual role. A low-privileged user who could obtain a valid external JWT trusted by a configured issuer could therefore use the resulting access token to invoke...

8.9CVSS6AI score0.0047EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/07/22 8:36 p.m.8 views

GO-2026-6025 File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser

File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser...

5.3AI score
SaveExploits0References1
OSV
OSV
added 2026/07/22 8:36 p.m.7 views

GO-2026-6048 Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override in gitea.dev

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override in gitea.dev...

5.3AI score
SaveExploits0References2
OSV
OSV
added 2026/07/22 8:36 p.m.8 views

GO-2026-6036 Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) in gitea.dev

Gitea: RSS/Atom feed handlers bypass API-token scope & public-only confinement incomplete fix of 37698 in gitea.dev...

5.3AI score
SaveExploits0References2
OSV
OSV
added 2026/07/22 8:32 p.m.5 views

MAL-2026-11005 Malicious code in n8n-nodes-quick-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a3ad37cc152517b09b8ee72a009a179399ddf802e7f22c126c9d104b4252d5a On require/import, index.js spawns /bin/bash wired to a TCP socket at hardcoded IP 103.27.109.184:8895, giving the remote operator an interactive she...

5.7AI score
SaveExploits0References3
OSV
OSV
added 2026/07/22 8:24 p.m.13 views

MAL-2026-10999 Malicious code in n8n-nodes-task-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 991093c97f0d954740c4b72a2e7725a501df211c94634979ebadc52652f2ebe8 The package impersonates the n8n task-runner subsystem but its shipped n8n node MyNode.js is a no-op stub whose execute returns . The real payload...

5.4AI score
SaveExploits0References17
NVD
NVD
added 2026/07/22 8:16 p.m.7 views

CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

8.6CVSS0.00272EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/22 8:16 p.m.6 views

UBUNTU-CVE-2026-13059

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

8.6CVSS5.9AI score0.00272EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/22 7:21 p.m.33 views

CVE-2026-13059 Improper Validation of Client-Supplied Command Parameters Allowing Role-Based Access Control Bypass

An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands ...

8.6CVSS0.00272EPSS
SaveExploits0References1
Rows per page
Query Builder