Lucene search
+L

57614 matches found

CVE
CVE
added 2 days ago11 views

CVE-2026-41447

FirmaCheck for Windows

8.5CVSS6.5AI score0.00114EPSS
SaveExploits0References2
EUVD
EUVD
added 2 days ago6 views

EUVD-2026-52441

FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files x86\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration...

8.5CVSS6.5AI score0.00114EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2 days ago41 views

CVE-2026-41447 FirmaCheck < 1.3.16 DLL Hijacking via Unvalidated OpenSSL Configuration Path

FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files x86\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration...

8.5CVSS0.00114EPSS
SaveExploits0References2
NVD
NVD
added 2 days ago8 views

CVE-2026-62354

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

7.7CVSS0.00261EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2 days ago40 views

CVE-2026-18631 jeequan jeepay PreAuthorize SysLogController.java WebSecurityConfig authorization

A vulnerability was identified in jeequan jeepay up to 3.2.9. This vulnerability affects the function WebSecurityConfig of the file jeepay-manager/src/main/java/com/jeequan/jeepay/mgr/ctrl/sysuser/SysLogController.java of the component PreAuthorize Handler. The manipulation leads to authorization...

6.5CVSS0.0038EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2 days ago7 views

CVE-2026-69093

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...

7.1CVSS5.5AI score0.0011EPSS
SaveExploits0References4
OSV
OSV
added 2 days ago4 views

CVE-2026-69093 Admidio before 5.0.11 CSRF via category-report preferences

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...

7.1CVSS5.5AI score
SaveExploits0References5
CVE
CVE
added 2 days ago10 views

CVE-2026-69093

Admidio prior to 5.0.11 contains a CSRF weakness in modules/category-report/preferences.php: adm_csrf_token is not validated, allowing an authenticated admin to be tricked into visiting a crafted URL that can delete or copy Category Report configurations via GET parameters. This affects integrity...

7.1CVSS5.5AI score0.0011EPSS
SaveExploits0References3
EUVD
EUVD
added 2 days ago7 views

EUVD-2026-52286

Admidio before 5.0.11 does not validate the admcsrftoken in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters delete and copy. An attacker can trick an authenticated administrator into visiting a crafted URL to delete ...

7.1CVSS5.5AI score0.0011EPSS
SaveExploits0References3
NVD
NVD
added 2 days ago8 views

CVE-2026-18592

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

5.8CVSS0.00202EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2 days ago47 views

CVE-2026-62416

Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly. When the affected products are used with the initial configuration, anyone can connect to them without authentication and uploa...

6.9CVSS0.00356EPSS
SaveExploits0References3
CVE
CVE
added 2 days ago13 views

CVE-2026-62416

The CVE-2026-62416 entry concerns Sharp Corporation’s Network Scanner Tool and Network Scanner Tool Lite configured with no authentication, allowing unlimited file uploads over the network. The underlying issue enables an unauthenticated attacker to connect and upload files, potentially causing d...

6.9CVSS5.6AI score0.00356EPSS
SaveExploits0References3
CVE
CVE
added 2 days ago17 views

CVE-2026-63563

Sharp and Toshiba Tec MFPs shipped for a market with the user authentication feature disabled by default. When used with this initial configuration, address book editing and Document Filing features can be accessed without authentication, potentially exposing sensitive configuration data. The aff...

6.9CVSS5.5AI score0.0043EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2 days ago51 views

CVE-2026-18592 osCommerce Email Template Configuration EmailController.php EmailController sql injection

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

5.8CVSS0.00202EPSS
SaveExploits0References5
EUVD
EUVD
added 2 days ago8 views

EUVD-2026-52221

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php of the component Email Template Configuration. Performing a manipulation of the argument emailtemplateskey results in sq...

5.8CVSS5.5AI score0.00202EPSS
SaveExploits0References5
CVE
CVE
added 2 days ago13 views

CVE-2026-18592

CVE-2026-18592 affects osCommerce version 4.14.63493, specifically the function EmailController in app/lib/backend/controllers/EmailController.php of the Email Template Configuration component. The issue arises from manipulating the email_templates_key argument, which leads to a SQL injection vul...

5.8CVSS5.5AI score0.00202EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2 days ago92 views

Discourse Backup File Disclosure Via Default Nginx Configuration

Discourse is an open source platform for community discussion. This vulnerability only impacts Discourse instances configured to use FileStore--LocalStore which means uploads and backups are stored locally on disk. If an attacker knows the name of the Discourse backup file, the attacker can trick...

7.5CVSS7.2AI score0.26788EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2 days ago114 views

Dify v1.9.1 - Broken Access Control

Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data. id: CVE-2025-63387 info: name: Dify v1.9.1 - Broken Access Control author:...

7.5CVSS5.4AI score0.28042EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2 days ago103 views

Apache APISIX - Remote Code Execution

A default configuration of Apache APISIX with default API key is vulnerable to remote code execution. An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. When the admin key was changed or the port of Admin API was changed to a port different...

9.8CVSS8.3AI score0.96001EPSS
SaveExploits16References5
Nuclei
Nuclei
added 2 days ago147 views

Buffalo WSR-2533DHPL2 - Configuration File Injection

The web interfaces of Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 does not properly sanitize user input. An authenticated remote attacker could leverage this vulnerability to alter device configuration, potentially leading to remote code execution. id:...

9.8CVSS8AI score0.9998EPSS
SaveExploits5References5
Rows per page
Query Builder