Lucene search
+L

2102 matches found

Cvelist
Cvelist
added 3 hours ago8 views

CVE-2026-67347 Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update

Vendure through 3.7.1, fixed in commit f67ef5f, contains a cross-channel authorization bypass vulnerability in stock-location.service.ts and asset.service.ts update methods that allows channel-scoped administrators to modify other tenants' data. Attackers can supply global IDs of StockLocation or...

6.8CVSS
SaveExploits0References4
NVD
NVD
added 7 hours ago5 views

CVE-2026-16969

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

7.6CVSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 8 hours ago4 views

CVE-2026-16969

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

7.6CVSS5.8AI score
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 8 hours ago9 views

CVE-2026-16969 DFIR-IRIS Stored XSS in Assets

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

7.6CVSS
SaveExploits0References1
EUVD
EUVD
added 8 hours ago8 views

EUVD-2026-51069

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

7.6CVSS5.8AI score
SaveExploits0References1
CVE
CVE
added 8 hours ago7 views

CVE-2026-16969

Affected product: IRIS web application (version 2.4.26 and possibly others). Vulnerability: Stored cross-site scripting (XSS) in the assets function. Impact: High (CVE-2026-16969, CVSS v3.1 base score 7.6) with confidentiality impact elevated; requires user interaction and has network access with...

7.6CVSS5.8AI score
SaveExploits0References1
Nuclei
Nuclei
added 11 hours ago105 views

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/dns.php Profile Name or notes field. id: CVE-2018-19914 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

4.8CVSS6.2AI score0.03316EPSS
SaveExploits5References5
Nuclei
Nuclei
added 11 hours ago210 views

Chuanhu Chat - Directory Traversal

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

9.8CVSS7AI score0.2795EPSS
SaveExploits2
Nuclei
Nuclei
added 11 hours ago38 views

DomainMOD 4.11.01 - Cross-Site Scripting

DomainMOD 4.11.01 contains a cross-site scripting vulnerability via assets/add/account-owner.php Owner name field. id: CVE-2018-19749 info: name: DomainMOD 4.11.01 - Cross-Site Scripting author: arafatansari severity: medium description: | DomainMOD 4.11.01 contains a cross-site scripting...

4.8CVSS6.2AI score0.03316EPSS
SaveExploits6References5
GithubExploit
GithubExploit
added 2 days ago56 views

Root-My-Device-Payloads

Root My Device Payloads A fork of BuSung-dev/Root-My-Galaxy-...

7.8CVSS5.9AI score0.00725EPSS
SaveExploits44
NVD
NVD
added 5 days ago10 views

CVE-2026-66013

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

9.3CVSS0.00388EPSS
SaveExploits0References2
EUVD
EUVD
added 5 days ago10 views

EUVD-2026-49044

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

9.3CVSS5.9AI score0.00388EPSS
SaveExploits0References2
Cvelist
Cvelist
added 5 days ago37 views

CVE-2026-66013 OpenRemote before 1.26.2 Authentication Bypass via Console Registration

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

9.3CVSS0.00388EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 5 days ago6 views

CVE-2026-66013 OpenRemote before 1.26.2 Authentication Bypass via Console Registration

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

9.3CVSS5.9AI score0.00388EPSS
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 6 days ago5 views

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilitie

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilitie CVE-2026-55602, CVE-2026-53550, CVE-2026-48710, CVE-2026-48817, CVE-2026-48818, CVE-2026-54282, CVE-2026-54283, CVE-2026-13676, CVE-2026-12208, CVE-2026-13149, CVE-2026-5988...

8.7CVSS5.6AI score0.01839EPSS
SaveExploits5Affected Software2
EUVD
EUVD
added 2026/07/22 12:31 a.m.7 views

EUVD-2026-47080

Vulnerability in the Oracle Assets product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Assets. Successful attac...

8.1CVSS7.1AI score0.00326EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/22 12:31 a.m.8 views

EUVD-2026-47082

Vulnerability in the Oracle Assets product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Assets. Successful...

7.2CVSS7.1AI score0.00316EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/21 10:18 p.m.5 views

CVE-2026-60755

Vulnerability in the Oracle Assets product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Assets. Successful...

7.2CVSS0.00316EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/21 10:18 p.m.4 views

CVE-2026-60749

Vulnerability in the Oracle Assets product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Assets. Successful attac...

8.1CVSS0.00326EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/21 8:53 p.m.26 views

CVE-2026-47697 Shelf has cross-organization IDOR: authenticated users could read/attach another workspace's assets, tags, custodians, bookings, QR codes and audit data

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and connect-ed / read / updated them without verifying the IDs belonged to the caller's...

7.1CVSS0.00181EPSS
SaveExploits0References1
Rows per page
Query Builder