Lucene search
+L

225250 matches found

NVD
NVD
added 2026/07/17 7:17 p.m.12 views

CVE-2026-58195

Agentic-Flow is an AI agent orchestration platform. Prior to 2.0.14, agentic-flow MCP server tools in src/mcp/standalone-stdio.ts, src/mcp/fastmcp/servers/claude-flow-sdk.ts, src/mcp/fastmcp/servers/stdio-full.ts, src/mcp/fastmcp/servers/http-streaming-updated.ts,...

8.8CVSS0.00456EPSS
SaveExploits0References7
The Hacker News
The Hacker News
added 2026/07/17 6:54 p.m.27 views

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil , which was observed using...

6.2AI score
SaveExploits0
OSV
OSV
added 2026/07/17 5:58 p.m.13 views

CVE-2026-48009 Shopware: Admin Account Takeover via User Recovery Hash Exposure

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a low-privilege admin user with userrecovery:read ACL can take over any admin account by triggering POST /api/action/user/user-recovery, reading the password recovery hash through POST /api/search/user-recovery, and using PAT...

6.8CVSS5.3AI score
SaveExploits0References8
EUVD
EUVD
added 2026/07/17 5:56 p.m.17 views

EUVD-2026-45241

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/action/order/orderId/state/transition and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare...

6.5CVSS5.3AI score0.00233EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/17 5:56 p.m.48 views

CVE-2026-48014 Shopware: Admin API ACL Bypass in Order State Transition Endpoints

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/action/order/orderId/state/transition and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare...

6.5CVSS0.00233EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/07/17 5:56 p.m.12 views

CVE-2026-48014

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/action/order/orderId/state/transition and similar transaction and delivery transition routes in src/Core/Checkout/Order/Api/OrderActionController.php do not declare...

6.5CVSS5.2AI score0.00233EPSS
SaveExploits0References6Affected Software2
CVE
CVE
added 2026/07/17 5:25 p.m.38 views

CVE-2026-9762

CVE-2026-9762 affects IBM Db2 Client components: the IBM Data Server Driver for JDBC and SQLJ. A remote code execution (RCE) exists when the JDBC URL is under user control. Affected products/versions: Db2 client 11.5.0–11.5.9 and 12.1.0–12.1.4. Root cause identified as CWE-94 (Improper Code Gener...

7.8CVSS6.2AI score0.00165EPSS
SaveExploits0References1Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/17 5:25 p.m.14 views

CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...

7.8CVSS6.3AI score0.00165EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/17 5:25 p.m.53 views

CVE-2026-9762 IBM® Data Server driver for JDBC and SQLJ is vulnerable to remote code execution when jdbc url is under user control

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to remote code execution when jdbc url is under user control...

7.8CVSS0.00165EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/17 5:17 p.m.12 views

CVE-2026-12693

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

9.4CVSS0.00264EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/17 5:17 p.m.11 views

CVE-2026-12694

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

9.1CVSS0.00243EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/17 4:59 p.m.14 views

EUVD-2026-45229

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

9.1CVSS5.3AI score0.00243EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/17 4:59 p.m.38 views

CVE-2026-12694 Missing Authorization in Vimesoft's Enterprise Video Platform

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

9.1CVSS0.00243EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/17 4:59 p.m.13 views

CVE-2026-12694

Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

9.1CVSS5.3AI score0.00243EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/07/17 4:50 p.m.11 views

EUVD-2026-45227

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

9.4CVSS5.3AI score0.00264EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/17 4:50 p.m.26 views

CVE-2026-12693

The CVE-2026-12693 entry concerns an Identity/Authorization weakness in Vimesoft Inc.'s Enterprise Video Platform. Affected software: Enterprise Video Platform versions 3.11.0.0 up to, but not including, 3.25.0. The issue is an Authorization bypass via a User-Controlled key, leading to a lack of ...

9.4CVSS5.3AI score0.00264EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/17 4:50 p.m.41 views

CVE-2026-12693 IDOR in Vimesoft's Enterprise Video Platform

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

9.4CVSS0.00264EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/17 4:50 p.m.10 views

CVE-2026-12693

Authorization bypass through User-Controlled key vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Enterprise Video Platform: from 3.11.0.0 before 3.25.0...

9.4CVSS5.3AI score0.00264EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/07/17 3:32 p.m.16 views

EUVD-2026-45195

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint syncapi/routing/context.go that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while...

5.3CVSS5.4AI score0.0016EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/17 3:32 p.m.41 views

CVE-2026-63097 Dendrite 0.13.8 syncapi /context Endpoint Post-Leave State Exposure

Dendrite through 0.13.8 contains an improper access control vulnerability in the syncapi /context endpoint syncapi/routing/context.go that allows authenticated local users to access post-leave room state events by exploiting a flawed membership check that evaluates only the RoomExists field while...

5.3CVSS0.0016EPSS
SaveExploits0References2
Rows per page
Query Builder