Lucene search
+L

24306 matches found

Cvelist
Cvelist
added 2026/05/22 3:39 a.m.51 views

CVE-2026-7249 Location Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging

The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the splwupdateblockoptions and lwpcleanweathertransients functions in all versions up to, and including, 3.0.2. This makes it possible for authenticated attackers, with...

4.3CVSS0.00248EPSS
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/05/22 1:16 a.m.13 views

Malicious code in @exocore/exocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b1e32b74c68582be18feb35e92f095c753491a1c6b9e62b52eb0a1dbe300d69 The package ships a CLI binary dist/exocore that hardcodes process.env.ANTHROPICBASEURL to https://exocoreai-exocore-gateway.hf.space/v1 and...

5.8AI score
SaveExploits0References3
OSV
OSV
added 2026/05/22 1:16 a.m.11 views

MAL-2026-4388 Malicious code in @exocore/exocode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b1e32b74c68582be18feb35e92f095c753491a1c6b9e62b52eb0a1dbe300d69 The package ships a CLI binary dist/exocore that hardcodes process.env.ANTHROPICBASEURL to https://exocoreai-exocore-gateway.hf.space/v1 and...

5.8AI score
SaveExploits0References3
EUVD
EUVD
added 2026/05/22 12:31 a.m.15 views

EUVD-2026-31374

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

2.3CVSS5.8AI score0.0013EPSS
SaveExploits0References2
OSV
OSV
added 2026/05/22 12:31 a.m.9 views

GHSA-RV3Q-XMFW-MCJV Concrete CMS is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/page/bulk/cache...

2.3CVSS5.8AI score0.0013EPSS
SaveExploits0References3
CNNVD
CNNVD
added 2026/05/22 12:0 a.m.20 views

WordPress plugin Location Weather 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

4.3CVSS5.8AI score0.00248EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/05/21 9:31 p.m.7 views

CVE-2026-8412

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

2.3CVSS5.8AI score0.0013EPSS
SaveExploits0References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/05/21 9:31 p.m.8 views

CVE-2026-8412 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

2.3CVSS5.8AI score0.0013EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/05/21 9:31 p.m.51 views

CVE-2026-8412 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

2.3CVSS0.0013EPSS
SaveExploits0References1
CVE
CVE
added 2026/05/21 9:31 p.m.87 views

CVE-2026-8412

Concrete CMS prior to version 9.5.0 is vulnerable to Cross-Site Request Forgery (CSRF) at the endpoint concrete/controllers/dialog/page/bulk/cache. The issue is caused by insufficient verification of user intent for requests to that endpoint. Impact is described as CSRF with potential to perform ...

8.8CVSS5.8AI score0.0013EPSS
SaveExploits0References1Affected Software1
OSV
OSV
added 2026/05/21 9:31 p.m.9 views

CVE-2026-8412 Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache

Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery CSRF at concrete/controllers/dialog/page/bulk/cache. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan...

2.3CVSS5.9AI score
SaveExploits0References4
OSV
OSV
added 2026/05/21 9:23 p.m.10 views

GHSA-35WC-CVQG-78FP twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments

Description IntlExtension memoises every \IntlDateFormatter and \NumberFormatter it creates in instance-level arrays keyed on a hash that includes locale, pattern, attrs and other values that are ordinary named arguments of the formatdatetime / formatdate / formattime / formatnumber /...

6.9CVSS5.8AI score0.00302EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/05/21 9:23 p.m.20 views

twig/intl-extra: Unbounded formatter memoisation in keyed on template-controlled arguments

Description IntlExtension memoises every \IntlDateFormatter and \NumberFormatter it creates in instance-level arrays keyed on a hash that includes locale, pattern, attrs and other values that are ordinary named arguments of the formatdatetime / formatdate / formattime / formatnumber /...

6.5CVSS5.8AI score0.00302EPSS
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/05/21 8:39 p.m.24 views

NocoDB: Stale Auth Cache After API Token Deletion

Summary Deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cache was not invalidated by token value at deletion time. Details The API token deletion path removed the database row but did not evict the token-value keyed entry from the auth cache...

2.3CVSS5.7AI score0.00197EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/05/21 8:39 p.m.13 views

GHSA-F76X-F9VJ-92JV NocoDB: Stale Auth Cache After API Token Deletion

Summary Deleted API tokens continued to authenticate requests until their cache entry expired, because the auth cache was not invalidated by token value at deletion time. Details The API token deletion path removed the database row but did not evict the token-value keyed entry from the auth cache...

2.3CVSS5.7AI score0.00197EPSS
SaveExploits0References3
Patchstack
Patchstack
added 2026/05/21 8:39 p.m.15 views

NPM: NocoDB: Stale Auth Cache After API Token Deletion

NPM: NocoDB: Stale Auth Cache After API Token Deletion vulnerability discovered by ? in WordPress Npm nocodb versions = 0.301.3...

5.8AI score0.00197EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/05/21 8:28 p.m.11 views

GHSA-MQCF-GQVG-RMHM SpiceDB: Caveat structures with nested lists can result in improper cache reuse

Impact Users are impacted if: - They have a caveat structure with a nested list, e.g.: zed caveat shapex list x == "a", "b" - Their system exercises that caveat with either CheckBulkPermission or else LookupResources running with the --experimental-lookup-resources-version flag set to lr3, implyi...

2.3CVSS5.8AI score0.00276EPSS
SaveExploits0References5
GithubExploit
GithubExploit
added 2026/05/21 7:43 p.m.167 views

Exploit for Incorrect Resource Transfer Between Spheres in Linux Linux_Kernel

CVE-2026-31431-CopyFail---Minified-LPE-PoC ⚠️ Disclaimer For...

7.8CVSS7.4AI score0.99907EPSS
SaveExploits237
Metasploit
Metasploit
added 2026/05/21 7:1 p.m.344 views

xfrm-ESP Page-Cache Write via CVE-2026-43284

CVE-2026-43284 is a Linux kernel page-cache write vulnerability in the IPsec/xfrm subsystem affecting ESP Encapsulating Security Payload fragmentation. Dubbed "DirtyFrag", the bug allows a local unprivileged user to gain write access to read-only page-cache pages by triggering a race condition in...

8.8CVSS7.1AI score0.93235EPSS
SaveExploits32
Metasploit
Metasploit
added 2026/05/21 7:1 p.m.386 views

rxkad Page-Cache Write via CVE-2026-43500

CVE-2026-43500 exploits a memory-corruption vulnerability in the Linux kernel's RxRPC authentication subsystem rxkad. When a crafted DATA packet is delivered to an AFRXRPC socket configured with an attacker-controlled rxkad session key, the kernel's rxkadverifypacket1 function performs an in-plac...

7.8CVSS7.2AI score0.92855EPSS
SaveExploits21
Rows per page
Query Builder