Lucene search
+L

10084 matches found

NVD
NVD
added 2026/03/17 4:16 p.m.14 views

CVE-2026-28506

Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a logic flaw in its filtering mechanism. It allows any authenticated user to retrieve activity events associated with documents that have no...

4.3CVSS0.00229EPSS
SaveExploits1References1
Qualys Blog
Qualys Blog
added 2026/03/17 4:3 p.m.10 views

Countering Current Geopolitical Cyber Threats With Qualys

Summary In response to the latest public sector threat intelligence on Iranian-linked threat activity, Qualys has released new intelligence capabilities within Qualys Vulnerability Management, Detection & Response VMDR to help organizations immediately assess their exposure. These updates extend...

5.9AI score
SaveExploits0
Vulnrichment
Vulnrichment
added 2026/03/17 3:30 p.m.12 views

CVE-2026-28506 Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts

Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a logic flaw in its filtering mechanism. It allows any authenticated user to retrieve activity events associated with documents that have no...

4.3CVSS5.8AI score0.00229EPSS
SaveExploits1References1
CVE
CVE
added 2026/03/17 3:30 p.m.19 views

CVE-2026-28506

The CVE-2026-28506 affects Outline prior to 1.5.0. A logic flaw in the events.list API endpoint’s filtering lets any authenticated user retrieve activity events for documents that have no collection (e.g., Private Drafts, Deleted Documents), regardless of the user’s actual permissions. This resul...

4.3CVSS5.8AI score0.00229EPSS
SaveExploits1References1Affected Software1
Cvelist
Cvelist
added 2026/03/17 3:30 p.m.31 views

CVE-2026-28506 Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts

Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a logic flaw in its filtering mechanism. It allows any authenticated user to retrieve activity events associated with documents that have no...

4.3CVSS0.00229EPSS
SaveExploits1References1
OSV
OSV
added 2026/03/17 3:30 p.m.7 views

CVE-2026-28506 Outline's Information Disclosure in Activity Logs allows User Enumeration of Private Drafts

Outline is a service that allows for collaborative documentation. Prior to 1.5.0, the events.list API endpoint, used for retrieving activity logs, contains a logic flaw in its filtering mechanism. It allows any authenticated user to retrieve activity events associated with documents that have no...

4.3CVSS5.9AI score
SaveExploits0References3
Snyk
Snyk
added 2026/03/16 6:46 p.m.4 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the WebSocket session handling in kernel/util/websocket.go. An attacker can connect to the /ws endpoint and receive real-time document metadata and activity events by using the special id=auth WebSocket...

7.5CVSS5.8AI score0.00361EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/03/16 3:30 p.m.9 views

EUVD-2026-12297

Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Secure Folder privilege...

8.4CVSS5.9AI score0.00159EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/03/16 3:30 p.m.11 views

EUVD-2026-12293

Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability...

6.8CVSS5.8AI score0.00082EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/16 2:29 p.m.4 views

CVE-2025-52644

HCL AION is affected by a vulnerability where certain user actions are not adequately audited or logged. The absence of proper auditing mechanisms may reduce traceability of user activities and could potentially impact monitoring, accountability, or incident investigation processes...

5.8CVSS5.8AI score0.00141EPSS
SaveExploits0References2Affected Software1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/03/16 8:11 a.m.12 views

Malicious code in @wealth-common/font (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a56e089d98a2a90a0e20698b8e57be8f14e4999477967cdf1254cff0e51804c The package @wealth-common/font was found to contain malicious code. Source: ghsa-malware...

5.7AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/03/16 4:31 a.m.3 views

CVE-2026-20990

Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Secure Folder privilege...

8.4CVSS5.9AI score0.00159EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/03/16 4:31 a.m.60 views

CVE-2026-20990

Improper export of android application components in Secure Folder prior to SMR Mar-2026 Release 1 allows local attackers to launch arbitrary activity with Secure Folder privilege...

8.4CVSS0.00159EPSS
SaveExploits0References1
CVE
CVE
added 2026/03/16 4:31 a.m.20 views

CVE-2026-20990

CVE-2026-20990 stems from an improper export of Android app components in Samsung Secure Folder prior to the SMR Mar-2026 Release 1, enabling local attackers to launch arbitrary activities with Secure Folder privilege. The issue is described as a local-privilege escalation due to component export...

8.4CVSS5.9AI score0.00159EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/03/16 4:31 a.m.22 views

CVE-2026-20988

The collected reports describe a vulnerability in Android settings related to improper verification of intent by a broadcast receiver, allowing a local attacker to launch arbitrary activities with Settings privileges. Exploitation requires user interaction (e.g., tricking the user into installing...

6.8CVSS5.8AI score0.00082EPSS
SaveExploits0References1Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/16 4:31 a.m.6 views

CVE-2026-20988

Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability...

6.8CVSS5.8AI score0.00082EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/03/16 12:0 a.m.14 views

PT-2026-25593

Improper verification of intent by broadcast receiver in Settings prior to SMR Mar-2026 Release 1 allows local attacker to launch arbitrary activity with Settings privilege. User interaction is required for triggering this vulnerability...

6.8CVSS5.8AI score0.00082EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/03/16 12:0 a.m.10 views

HCL AION 安全漏洞

HCL AION is an AI lifecycle management platform from HCL India. HCL AION has a security vulnerability that can be exploited by attackers to affect the traceability of user activities...

8.2CVSS5.8AI score0.00141EPSS
SaveExploits0References1
OSV
OSV
added 2026/03/15 5:46 a.m.5 views

MAL-2026-1426 Malicious code in @3stripes/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2cf6f6a1fb0e79c716386545df6b4a1e4df689bf6b35e741c28150cc3fad072a The package @3stripes/common was found to contain malicious code. Source: ossf-package-analysis...

5.8AI score
SaveExploits0
OSV
OSV
added 2026/03/14 7:17 a.m.7 views

MAL-2026-1423 Malicious code in test_pkg_forppe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fb7a0a95274f0d2d68d1bf6fc49d05bfc1b8a7e041147c0597e8db59c5552015 The package testpkgforppe was found to contain malicious code. Source: ghsa-malware 4f40eeeea0e63ed3d90dbfcf8f947f134cf561db8c1775a61ae4099c71c926e4...

5.8AI score
SaveExploits0References1
Rows per page
Query Builder