Lucene search
+L

24150 matches found

Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.21 views

PT-2026-60195

Name of the Vulnerable Software and Affected Versions Directus versions prior to 12.0.0 Description When response caching is enabled, the cache-key derivation process in the get-cache-key.ts file omits critical authorization context, including share, role, roles, admin, app, and policies. Because...

8.6CVSS5.3AI score0.00272EPSS
SaveExploits0References10
BDU FSTEC
BDU FSTEC
added 2026/07/15 12:0 a.m.159 views

The vulnerability of the magick-distribute-cache service in the console-based image editing tool ImageMagick allows a hacker to disclose protected information.

The vulnerability of the magick-distribute-cache service in the console-based image editing tool ImageMagick is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to disclose protected information...

4.1CVSS6.1AI score0.00077EPSS
SaveExploits0References6Affected Software4
OSV
OSV
added 2026/07/15 12:0 a.m.6 views

ALSA-2026:39868 Important: nodejs:24 security, bug fix, and enhancement update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

9.8CVSS6.5AI score0.03711EPSS
SaveExploits1References32
NVD
NVD
added 2026/07/14 10:16 p.m.10 views

CVE-2026-46633

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string does not escape single quotes when a template name from a % use % tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the...

9.8CVSS0.00642EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/14 9:41 p.m.9 views

JLSEC-2026-681 The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a...

The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line resolution. In a controlled environment such as Intel SGX, an attacker can gain a per instruction sub-cache-line resolution allowing them to break the...

5.5CVSS5.8AI score0.00185EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/14 9:41 p.m.8 views

JLSEC-2026-733 When restoring a session from cache, a pointer from the serialized session data is used in a free...

When restoring a session from cache, a pointer from the serialized session data is used in a free operation without validation. An attacker who can poison the session cache could trigger an arbitrary free. Exploitation requires the ability to inject a crafted session into the cache and for the...

4.1CVSS6.2AI score0.00172EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/07/14 9:14 p.m.12 views

CVE-2026-46633

Twig is a template language for PHP. Prior to 3.26.0, Compiler::string does not escape single quotes when a template name from a % use % tag is placed inside a PHP single-quoted string literal, allowing a crafted template name to terminate the string and inject arbitrary PHP expressions into the...

9.8CVSS5.5AI score0.00642EPSS
SaveExploits0
OSV
OSV
added 2026/07/14 7:33 p.m.9 views

CVE-2026-13001 Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'podlovehandlecachefiles' function in all versions up to, and including, 4.5.1. This makes it possible for unauthenticated attackers to upload arbitrary files on t...

9.8CVSS6.5AI score
SaveExploits0References6
CVE
CVE
added 2026/07/14 7:33 p.m.34 views

CVE-2026-13001

Affected software : Podlove Podcast Publisher for WordPress. Vulnerability : arbitrary file uploads caused by missing file type validation in the podlove_handle_cache_files function, affecting all versions up to and including 4.5.1. Impact : unauthenticated attackers could upload arbitrary files ...

9.8CVSS6.5AI score0.00828EPSS
SaveExploits4References4
UbuntuCve
UbuntuCve
added 2026/07/14 6:17 p.m.12 views

CVE-2026-15747

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. csrftoken generates and caches one token per session and returns the same value on every call, and csrffield places that value in a hidden csrftoken input...

9.1CVSS6.1AI score0.00255EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/07/14 5:7 p.m.9 views

kernel: KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for ARM64, specifically within the vgic-its component. This vulnerability occurs when multiple concurrent operations incorrectly drop the translation cache's reference to an entry more than once during cache invalidation. Thi...

9.3CVSS6.8AI score0.00441EPSS
SaveExploits1References6
OSV
OSV
added 2026/07/14 1:58 p.m.8 views

MAL-2026-10586 Malicious code in crypto-validate-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3d8b69cab723043b20a628a6cd17f0e5cc64051004d9beb43d4b9ed58dbd9a0 index.js contains a self-invoking IIFE that, 37 seconds after the module is required, reads a base64 blob from test/fixtures/keypairs.dat a 53KB opaq...

6.1AI score
SaveExploits0References3
OSV
OSV
added 2026/07/14 12:9 p.m.5 views

CVE-2026-62390 Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Kylin. A backend API refreshing table catalog may cause the injection to the generated SQL. This issue affects Apache Kylin: from 4 through 5.0.3. Users are recommended to upgrade to version...

9.8CVSS6.1AI score
SaveExploits0References4
CVE
CVE
added 2026/07/14 12:9 p.m.30 views

CVE-2026-62390

Apache Kylin vulnerability CVE-2026-62390 is a SQL Injection flaw in the Catalog Cache Refresh API. Affected versions are 4 through 5.0.3; upgrading to 5.0.4 fixes the issue. The issue arises from improper neutralization of special elements in SQL commands used by the backend API that refreshes t...

9.8CVSS6.1AI score0.00409EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/14 11:15 a.m.5 views

SUSE-SU-2026:2968-1 Security update for python-Authlib

This update for python-Authlib fixes the following issues - CVE-2026-41425: Prior to 1.6.11, there is no CSRF protection on the cache feature in authlib.integrations.starletteclient.OAuth bsc1263114. - CVE-2026-44681: Prior to 1.6.12 and 1.7.1, an unauthenticated open redirect in Authlib's...

6.1CVSS6.1AI score0.00249EPSS
SaveExploits2References5
Patchstack
Patchstack
added 2026/07/14 6:59 a.m.13 views

WordPress W3 Total Cache plugin <= 2.9.4 - Unauthenticated Arbitrary File Read vulnerability

Unauthenticated Arbitrary File Read vulnerability discovered by snr in WordPress Plugin W3 Total Cache versions = 2.9.4...

7.5CVSS6.1AI score0.02773EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/07/14 12:31 a.m.9 views

EUVD-2026-43554

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the downloadandcopy function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the...

6.6CVSS6.2AI score0.00129EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 2026/07/14 12:0 a.m.11 views

EulerOS 2.0 SP10 : unbound (EulerOS-SA-2026-2676)

According to the versions of the unbound packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash give...

10CVSS6.5AI score0.01272EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.19 views

PT-2026-57979

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.3 Description An OS Command Injection issue exists where a backend API allows job configuration parameters to be passed directly to the OS command line without proper neutralization of special elements. OS...

9.8CVSS6.3AI score0.01321EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.16 views

PT-2026-58720

Name of the Vulnerable Software and Affected Versions Podlove Podcast Publisher versions prior to 4.5.2 Description Missing file type validation in the podlove handle cache files function allows unauthenticated attackers to upload arbitrary files to the server. This flaw in the image cache can le...

9.8CVSS6.4AI score0.00828EPSS
SaveExploits4References7
Rows per page
Query Builder