Lucene search
+L

14040 matches found

OSV
OSV
added 2026/06/17 2:9 p.m.10 views

GHSA-F3G7-59QC-PQG6 Open WebUI IDOR: Calendar event re-parenting allows writing events into another user's calendar

Summary POST /api/v1/calendars/events/eventid/update validates that the caller has write access to the calendar the event currently belongs to, but does not validate the destination calendarid supplied in the request body. The model layer then persists the new calendarid unconditionally. A regula...

4.3CVSS5.4AI score0.00207EPSS
SaveExploits1References6
CVE
CVE
added 2026/06/17 1:38 a.m.49 views

CVE-2026-12442

The CVE-2026-12442 entry describes a use-after-free in Passwords in Google Chrome on Android before version 149.0.7827.155, allowing a remote attacker to execute arbitrary code via a crafted HTML page (Chromium security severity: Critical). Connected sources confirm this vulnerability affects Chr...

8.8CVSS6AI score0.00395EPSS
SaveExploits0References2Affected Software1
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.11 views

PT-2026-56442

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.2 Description An authorization bypass exists in the Evaluations feature within the 'POST /workflows/workflowId/test-runs/new' endpoint. The system incorrect...

7.4CVSS6.2AI score0.00161EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/06/15 9:30 p.m.14 views

EUVD-2026-36749

An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature...

5.8AI score0.00174EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/15 8:16 p.m.16 views

CVE-2026-50874

An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input...

8.1CVSS0.01119EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/15 6:16 p.m.18 views

CVE-2026-47777

Mastodon is a free, open-source social network server based on ActivityPub. In versions there is a missing condition in the check if remote accounts consented to be featured in a remote Collection could lead to attackers bypassing the check and faking consent. An attacker could forge the...

7.5CVSS0.00167EPSS
SaveExploits0References2
vulnersOsv
vulnersOsv
added 2026/06/15 5:14 p.m.13 views

@neetly/jest-config (>=1.0.0-alpha.14 <=1.0.0-alpha.16), @powerlines/plugin-alloy (>=0.14.0 <=0.26.152) +21 more potentially affected by CVE-2026-49356 via @babel/core (>=8.0.0-alpha.1 <=8.0.0-rc.5)

@babel/core NPM version =8.0.0-alpha.1, =1.0.0-alpha.14, =0.14.0, =0.12.396, =0.6.149, =0.9.0, =0.12.0, =0.12.0, =0.2.99, =0.1.0, =0.1.0, =0.1.71, =0.3.0, =0.3.0, =0.1.0, =0.7.301, =0.7.460 and more Source cves: CVE-2026-49356 Source advisory: OSV:GHSA-4X5R-PXFX-6JF8...

3.6CVSS5.7AI score0.00126EPSS
SaveExploits0
CVE
CVE
added 2026/06/15 12:0 a.m.25 views

CVE-2026-36933

The CVE-2026-36933 issue affects Boyleep K11 y108 firmware v2.3.0.11291. A physically proximate attacker can execute arbitrary code via the factory test feature. The impact is described as high for confidentiality, integrity, and availability; the root cause is tied to the factory test feature, w...

6.8CVSS5.9AI score0.00174EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/15 12:0 a.m.35 views

CVE-2026-36933

An issue in Boyleep K11, y108 firmware v.2.3.0.11291 allows a physically proximate attacker to execute arbitrary code via the factory test feature...

0.00174EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/15 12:0 a.m.20 views

PT-2026-49260

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.6.0 Description A missing condition in the verification process for remote accounts consenting to be featured in a remote Collection allows attackers to bypass checks and fake consent. An attacker can forge the...

7.5CVSS5.4AI score0.00167EPSS
SaveExploits0References4
OSV
OSV
added 2026/06/13 8:46 a.m.22 views

BIT-MYSQL-CLIENT-2026-49261 MariaDB server has unsafe parameter handling in `wsrep_notify_cmd`

MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with wsrepnotifycmd enabled would execute shell commands embedded in the name of the joiner node. This is fixed in...

10CVSS5.5AI score0.01582EPSS
SaveExploits0References13
EUVD
EUVD
added 2026/06/13 12:34 a.m.12 views

EUVD-2026-36611

OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other...

8.6CVSS5.2AI score0.00209EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/12 9:56 p.m.8 views

CVE-2026-53823 OpenClaw < 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFrom

OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other...

8.6CVSS6AI score
SaveExploits0References5
CVE
CVE
added 2026/06/12 9:56 p.m.38 views

CVE-2026-53823

OpenClaw is affected by a privilege-escalation vulnerability in the allowFrom feature, where binding to mutable Slack display names enables an attacker with Slack account access to alter display name metadata to match policy entries and gain unauthorized agent access intended for other identities...

8.6CVSS5.3AI score0.00209EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 2026/06/12 9:56 p.m.38 views

CVE-2026-53823 OpenClaw < 2026.5.3 - Privilege Escalation via Mutable Slack Display Names in allowFrom

OpenClaw before 2026.5.3 contains a privilege escalation vulnerability in the allowFrom feature that binds to mutable Slack display names. Attackers with Slack account access can change display name metadata to match policy entries, potentially gaining unauthorized agent access intended for other...

8.6CVSS0.00209EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/12 8:36 p.m.11 views

EUVD-2026-36564

MISP contains a reflected cross-site scripting vulnerability in the UiBeta event index view. The urlparams value is inserted into an inline JavaScript handler using HTML escaping inside a single-quoted JavaScript string. Because browsers HTML-decode attribute values before JavaScript parsing, a...

5.3CVSS5.2AI score0.00256EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/12 9:16 a.m.15 views

CVE-2026-12058

The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed...

5.3CVSS0.0017EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/12 9:4 a.m.13 views

BIT-GITLAB-2026-6277 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 13.9 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.2 that under certain conditions could have allowed an authenticated user with Security Manager-role permissions to manage project security configuration even whe...

4.3CVSS5.4AI score0.00182EPSS
SaveExploits0References4
CVE
CVE
added 2026/06/12 8:2 a.m.45 views

CVE-2026-12058

Technical details about CVE-2026-12058 are not publicly available in the provided documents. Monitor for updates from the vendor.

5.3CVSS5.3AI score0.0017EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/12 8:2 a.m.35 views

CVE-2026-12058

The connection confirmation pop-up of a specific feature in the PcSuite can be bypassed...

5.3CVSS0.0017EPSS
SaveExploits0References1
Rows per page
Query Builder