Lucene search
+L

3901 matches found

F5 Networks
F5 Networks
•added 2026/08/31 7:59 a.m.•9 views

K000163144: Spring Data vulnerability CVE-2026-41696

Security Advisory Description Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected...

5.9CVSS5.9AI score0.00332EPSS
SaveExploits0
IBM Security Bulletins
IBM Security Bulletins
•added 2026/08/31 6:04 a.m.•9 views

Security Bulletin: Maximo AI Service uses multiple third party dependencies which are vulnerable to multiple CVEs.

Summary Maximo AI Service uses httpclient5-5.6.2.jar, aiohttp-3.13.4-cp311-cp311-manylinux2014x8664.manylinux217x8664.manylinux228x8664.whl, ip-address-10.2.0.tgz, datasets-3.6.0-py3-none-any.whl, jackson-databind-2.21.4.jar, keras-3.13.2-py3-none-any.whl, log4j-api-2.24.3.jar,...

6.9CVSS6.7AI score0.00791EPSS
SaveExploits1Affected Software1
Tenable Nessus
Tenable Nessus
•added 2026/08/31 12:00 a.m.•10 views

Linux Distros Unpatched Vulnerability : CVE-2026-59282

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring Framework applications that use Spring's data binding infrastructure to apply user-supplied property paths onto a target object may be vulnerable to a...

5.8AI score0.0046EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
•added 2026/08/31 12:00 a.m.•12 views

Linux Distros Unpatched Vulnerability : CVE-2026-59281

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument...

6AI score0.00253EPSS
SaveExploits0References3
GithubExploit
GithubExploit
•added 2026/08/30 10:08 p.m.•29 views

Exploit for Type Confusion in Google Chrome

CVE-2026-78905 — Meta-Phishing Facebook Graph API — OAuth...

8.8CVSS5.9AI score0.00451EPSS
SaveExploits1
Tenable Nessus
Tenable Nessus
•added 2026/08/30 12:00 a.m.•17 views

Linux Distros Unpatched Vulnerability : CVE-2026-82466

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other accoun...

9.4CVSS6AI score0.00613EPSS
SaveExploits0References2
NVD
NVD
•added 2026/08/29 5:17 p.m.•29 views

CVE-2026-82466

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

9.4CVSS0.00613EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
•added 2026/08/29 5:17 p.m.•14 views

CVE-2026-82466

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

9.4CVSS6AI score0.00613EPSS
SaveExploits0References5
OSV
OSV
•added 2026/08/29 4:35 p.m.•36 views

CVE-2026-82466 Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

9.4CVSS6AI score
SaveExploits0References6
Vulnrichment
Vulnrichment
•added 2026/08/29 4:35 p.m.•11 views

CVE-2026-82466 Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

9.4CVSS6AI score0.00613EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/08/29 4:35 p.m.•47 views

CVE-2026-82466 Rodauth before 2.46.0 Authentication Bypass via webauthn_login

Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthnlogin route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the...

9.4CVSS0.00613EPSS
SaveExploits0References4
NVD
NVD
•added 2026/08/29 2:16 p.m.•35 views

CVE-2026-82456

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

10CVSS0.01729EPSS
SaveExploits0References3
OSV
OSV
•added 2026/08/29 1:47 p.m.•98 views

CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

10CVSS5.9AI score
SaveExploits0References5
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/08/29 12:00 a.m.•2 views

CVE-2026-82456: Binding to an Unrestricted IP Address

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

10CVSS5.8AI score0.01729EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/08/28 6:02 p.m.•24 views

EUVD-2026-42986

Snipe-IT has missing object-level authorization in Kits API...

5.4CVSS5.9AI score0.00294EPSS
SaveExploits0References4
OSV
OSV
•added 2026/08/28 6:02 p.m.•14 views

GHSA-CRV3-J83J-F3R6 Snipe-IT has missing object-level authorization in Kits API

Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...

5.3CVSS5.9AI score0.00294EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
•added 2026/08/28 6:02 p.m.•16 views

Snipe-IT has missing object-level authorization in Kits API

Impact The API endpoint for adding a license to a predefined kit POST /api/v1/kits/kitid/licenses only checks whether the caller can edit kits, but does not perform object-level authorization on the referenced license itself. Because of this, a low-privilege user with only predefined-kit...

5.4CVSS5.9AI score0.00294EPSS
SaveExploits0References5Affected Software1
OSV
OSV
•added 2026/08/28 4:18 p.m.•33 views

CVE-2026-82266 Redpanda Admin API Unauthenticated Superuser Access via Default Configuration

Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with adminapirequireauth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition...

9.3CVSS5.9AI score
SaveExploits0References7
SUSE CVE
SUSE CVE
•added 2026/08/28 1:00 a.m.•8 views

SUSE CVE-2026-72147

In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw-edma-pcie: Reject devices without driver data dwedmapcieprobe treats the PCI device ID driverdata as the template for the controller layout and copies it unconditionally. A device bound dynamically via sysfs can mat...

5.8AI score0.00209EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
•added 2026/08/28 12:58 a.m.•7 views

SUSE CVE-2026-74320

In the Linux kernel, the following vulnerability has been resolved: fbdev: sm501fb: Fix buffer errors in OF binding code The code that gets the frame buffer mode from OF has 'use after free', 'buffer overrun' and memory leaks. info-ediddata isn't free if the probe functions fail or if pd-defmode ...

6AI score0.0022EPSS
SaveExploits0References3
Rows per page
Query Builder