Lucene search
+L

44923 matches found

Nuclei
Nuclei
added 2026/08/23 2:28 a.m.61 views

WordPress Core - Post Author Email Disclosure

WordPress Core is vulnerable to Sensitive Information Exposure in versions between 4.7.0 and 6.3.1 via the User REST endpoint. While the search results do not display user email addresses unless the requesting user has the 'listusers' capability, the search is applied to the useremail column. id:...

5.3CVSS6.1AI score0.03862EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.154 views

Label Studio - Cross-Site Scripting

Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. id: CVE-2023-47115 info: name: Label Studio - Cross-Site Scripting author: isaca...

7.1CVSS5.8AI score0.01448EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.30 views

AstrBot <= 4.22.1 - Command Injection

AstrBot versions up to and including 4.22.1 contain a command injection vulnerability in the MCP server configuration endpoint. The /api/tools/mcp/add endpoint accepts arbitrary command and args fields that are passed directly to subprocess execution during the connection test, without any...

6.5CVSS6.9AI score0.02304EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.18 views

LearnPress < 4.3.7 - Information Disclosure

LearnPress WordPress plugin 4.3.7 contains an information disclosure vulnerability caused by missing capability checks on a REST endpoint, letting unauthenticated visitors retrieve sensitive user role and capability data via crafted requests. id: CVE-2026-8383 info: name: LearnPress 4.3.7 -...

5.3CVSS5.2AI score0.00563EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.88 views

Mesop AI Sandbox <= 1.2.2 - Remote Code Execution

Mesop = 1.2.2 contains an unrestricted remote code execution caused by unauthenticated ingestion and execution of base64-encoded Python code in the /exec-py endpoint of ai/testing module, letting attackers execute arbitrary commands on the host, exploit requires HTTP access to the server. id:...

9.8CVSS6.6AI score0.05289EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.25 views

Dgraph <= 25.3.2 - Admin Token Disclosure

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

9.8CVSS7.7AI score0.03082EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.42 views

Uptime-Kuma < v1.23.0 - Improper Access Control

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

5.3CVSS5.4AI score0.00905EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.45 views

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. id: CVE-2026-25892 info: name: Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent Do...

7.5CVSS5.2AI score0.01586EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.8 views

Concrete CMS <= 9.5.0 - Unauthenticated Conversation Message Disclosure (IDOR)

Concrete CMS = 9.5.0 contains an IDOR caused by insufficient access control in /ccm/frontend/conversations/messagedetail endpoint, letting unauthenticated attackers enumerate conversation messages and attachments. id: CVE-2026-8237 info: name: Concrete CMS = 9.5.0 - Unauthenticated Conversation...

6.3CVSS5.1AI score0.00456EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/22 4:16 p.m.9 views

CVE-2026-74682

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

0.0022EPSS
SaveExploits0References8
NVD
NVD
added 2026/08/22 4:16 p.m.7 views

CVE-2026-74642

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

0.00209EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/22 3:32 p.m.10 views

EUVD-2026-64369

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write on Type II inbound URBs dataepsetparams sizes each URB transfer buffer before it adds the Format Type II transfer delimiter: u-packets = urbpacks; u-buffersize = maxsize u-packets; if fmt-fmttype ==...

5.9AI score0.0022EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/22 3:32 p.m.8 views

EUVD-2026-64579

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: Fix UAF at delayed release of MIDI2 EPs The recent fix for UAF in umptoendpoint caused another UAF because it tries to dereference the UMP endpoint object, but this might be executed at a delayed context where the...

5.5AI score0.00209EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/22 3:32 p.m.9 views

CVE-2026-74642

CVE-2026-74642 is a Use-After-Free (UAF) vulnerability in the Linux kernel's ALSA USB subsystem , specifically in the handling of MIDI 2.0 (UMP) endpoints . A prior fix for a UAF in ump_to_endpoint() inadvertently introduced a second UAF: the code dereferences the UMP endpoint object in a delayed...

5.5AI score0.00209EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/08/22 2:19 p.m.8 views

EUVD-2026-64321

Joomla Extension - fabrikar.com - Unauthenticated deletion of any comment in Fabrik 4.7.2 - The DeleteComment endpoint did not perform any access checks...

6.9CVSS5.2AI score0.00406EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/22 2:15 p.m.7 views

EUVD-2026-64318

Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik 4.7.2 - The onUpdateComment endpoint did not perform any access checks...

6.9CVSS5.2AI score0.00406EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/22 2:14 p.m.10 views

EUVD-2026-64317

Joomla Extension - fabrikar.com - Unauthenticated disclosure of any commenter's email address in Fabrik 4.7.2 - The onGetEmail endpoint did not perform any access checks...

6.9CVSS5.2AI score0.00406EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/22 2:14 p.m.10 views

CVE-2026-76608

Fabrik is a Joomla extension that provides form and database functionality. In versions prior to 4.7.2 , the onGetEmail endpoint lacked any access control checks, allowing an unauthenticated attacker to disclose the email address of any commenter. This constitutes an information disclosure vulner...

6.9CVSS5.2AI score0.00406EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/22 12:28 p.m.10 views

EUVD-2026-64275

The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the duplicatepost function in all versions up to, and including, 3.0.11. This is due to the function not verifying that the user has editothersposts capability before...

4.3CVSS5.5AI score0.00336EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/22 12:28 p.m.14 views

CVE-2026-4244

The Post Duplicator plugin for WordPress (all versions up to and including 3.0.11 ) is vulnerable to unauthorized data modification due to a missing capability check in the duplicate_post() function. The function does not verify that the caller holds the edit_others_posts capability before accept...

4.3CVSS5.5AI score0.00336EPSS
SaveExploits0References5
Rows per page
Query Builder