Lucene search
+L

1265691 matches found

Cvelist
Cvelist
•added 2026/09/18 5:36 p.m.•36 views

CVE-2026-63199 Perses: Missing authorization in datasource proxy allows cross-scope secret disclosure

Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for the separately...

8.3CVSS0.00439EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
•added 2026/09/18 5:34 p.m.•9 views

CVE-2026-59982

A flaw was found in OpenEXR. A remote attacker could provide a specially crafted deep EXR image file, which, when processed by a user, could lead to an out-of-bounds pointer being returned by the TypedDeepImageChannel::row function. This vulnerability could cause the application to crash Denial o...

7.1CVSS5.8AI score0.00423EPSS
SaveExploits0References7
RedhatCVE
RedhatCVE
•added 2026/09/18 5:33 p.m.•13 views

CVE-2026-59189

A flaw was found in OpenEXR. An attacker could provide a specially crafted deep image that, when processed, would cause an out-of-bounds read in the TypedDeepImageChannel::row API if the image has a non-zero dataWindow origin. This vulnerability can lead to a heap out-of-bounds read, resulting in...

7.1CVSS5.8AI score0.00423EPSS
SaveExploits0References7
RedhatCVE
RedhatCVE
•added 2026/09/18 5:33 p.m.•7 views

CVE-2026-59981

A flaw was found in OpenEXR. An attacker can craft a malicious deep EXR image file that, when opened by an application, can lead to an out-of-bounds read in the OpenEXRUtil library's SampleCountChannel::row API. This vulnerability can result in information disclosure, where adjacent heap memory i...

7.1CVSS5.9AI score0.00423EPSS
SaveExploits0References7
Cvelist
Cvelist
•added 2026/09/18 5:27 p.m.•39 views

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

8.8CVSS0.00399EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/18 5:24 p.m.•7 views

EUVD-2026-83210

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

8.3CVSS5.8AI score0.00468EPSS
SaveExploits0References1
MongoDB
MongoDB
•added 2026/09/18 5:24 p.m.•9 views

NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

8.3CVSS5.8AI score0.00468EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
•added 2026/09/18 5:24 p.m.•38 views

CVE-2026-93760 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

8.3CVSS0.00468EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/18 5:24 p.m.•3 views

CVE-2026-93760 NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard

Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the databas...

8.3CVSS5.8AI score0.00468EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/18 5:24 p.m.•24 views

CVE-2026-93760

Mongoid , the Ruby ODM for MongoDB, allows caller-supplied filter data to carry unrestricted query operators when an application forwards externally supplied parameters to its query-building methods. Because the operator guard is unsafe by default , an unauthenticated party can influence how the ...

8.3CVSS5.8AI score0.00468EPSS
SaveExploits0References1Affected Software1
Kitploit
Kitploit
•added 2026/09/18 5:22 p.m.•11 views

Komfy-Switch-Wifi-Password-Disclosure

Komfy-Switch-Wifi-Password-Disclosure Intro This writeup will detail my finding on D-Link's Komfy Switch with Camera to retrieve the device's associated wifi ssid and password over bluetooth 4.0 BLE. The Komfy switch is a home security and automation product that can replace a wall switch in your...

6AI score
SaveExploits0References3
Kitploit
Kitploit
•added 2026/09/18 5:20 p.m.•11 views

libreoffice-remote-arbitrary-file-disclosure

Descripción de la vulnerabilidad CVE-2018-6871 Primera parte LibreOffice es compatible con la función COM.MICROSOFT.WEBSERVICE: root@kitploit: https://support.office.com/en-us/article/webservice-function-0546a35a-ecc6-4739-aed7-c0b7ce1562c4 La función es necesaria para obtener datos por URL,...

9.8CVSS7.4AI score0.22803EPSS
SaveExploits5
Kitploit
Kitploit
•added 2026/09/18 5:17 p.m.•14 views

scripts-nse

What is it? Some NSE scripts to search information from routers. The author of this scripts are VicenDominguez. He found the 0-Day on Huawei I only modified for two others. The author of this script is not responsible for its use. Huawei HG253s v2 Vodafone-Spain is starting to rent a new Huawei...

6AI score
SaveExploits0References2
Kitploit
Kitploit
•added 2026/09/18 5:17 p.m.•16 views

disclosures

Repositorio de Divulgaciones de Investigación de Vulnerabilidades de Cylance Este es un repositorio para albergar todas las divulgaciones públicas de vulnerabilidades del equipo de Investigación de Vulnerabilidades de Cylance. La clave pública del correo electrónico de nuestro Equipo de...

6AI score
SaveExploits0
NVD
NVD
•added 2026/09/18 5:17 p.m.•6 views

CVE-2026-93758

An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic application privileges to reference a record identifier that is not their own. Processing such a request can cause that record to be looked up without the usual...

8.6CVSS0.00356EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/18 5:17 p.m.•6 views

CVE-2026-93338

Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain sensitive system information by querying the SNMP v2c service configured with the default community string 'public'. Attackers can query...

6.9CVSS0.00533EPSS
SaveExploits0References3
OSV
OSV
•added 2026/09/18 5:15 p.m.•6 views

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

4.3CVSS5.8AI score
SaveExploits0References6
EUVD
EUVD
•added 2026/09/18 5:15 p.m.•10 views

EUVD-2026-83204

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

4.3CVSS5.8AI score0.00342EPSS
SaveExploits0References4
CVE
CVE
•added 2026/09/18 5:15 p.m.•11 views

CVE-2026-77385

Kyoo , a self-hosted media server for movies, series, and anime, is affected by a missing catalog-level authorization in its transcoder component prior to version 5.1.0 . Specifically, transcoder/src/api/path.go validated only that a base64-encoded filesystem path began with Settings.SafePath, wh...

4.3CVSS5.8AI score0.00342EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
•added 2026/09/18 5:15 p.m.•9 views

CVE-2026-77385 Kyoo: Transcoder serves uncataloged files from the media directory

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...

4.3CVSS5.8AI score0.00342EPSS
SaveExploits0References4
Rows per page
Query Builder