Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

14163 matches found

NVD
NVD•added 2026/09/30 6:18 p.m.•16 views

CVE-2026-103475

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

9.3CVSS0.00397EPSS
SaveExploits0References4
osv_opensuse
osv_opensuse•added 2026/09/30 5:58 p.m.•10 views

OPENSUSE-SU-2026:21983-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....

8.6CVSS6.6AI score0.0084EPSS
SaveExploits4References35
osv_suse
osv_suse•added 2026/09/30 5:49 p.m.•16 views

SUSE-SU-2026:23973-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....

8.6CVSS6.6AI score0.0084EPSS
SaveExploits4References36
osv_suse
osv_suse•added 2026/09/30 5:49 p.m.•11 views

SUSE-SU-2026:23984-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....

8.6CVSS6.6AI score0.0084EPSS
SaveExploits4References36
osv_cve
osv_cve•added 2026/09/30 5:22 p.m.•29 views

CVE-2026-103475 yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

9.3CVSS5.9AI score0.00397EPSS
SaveExploits0References6
EUVD
EUVD•added 2026/09/30 5:22 p.m.•18 views

EUVD-2026-90206

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

9.3CVSS5.9AI score0.00397EPSS
SaveExploits0References4
CVE
CVE•added 2026/09/30 5:22 p.m.•35 views

CVE-2026-103475

Versions of yii2-starter-kit through 4.2.0 are vulnerable because the default development configuration sets allowedIPs to ['*'], exposing the Yii debug and Gii modules to all IP addresses. Unauthenticated remote attackers can exploit this to access the debug endpoint to read sensitive data, such...

9.3CVSS5.9AI score0.00397EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment•added 2026/09/30 5:22 p.m.•17 views

CVE-2026-103475 yii2-starter-kit through 4.2.0 Debug and Gii Module Exposure

yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to '' in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or...

9.3CVSS5.9AI score0.00397EPSS
SaveExploits0References4
NVD
NVD•added 2026/09/30 3:22 p.m.•22 views

CVE-2026-103398

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

8.6CVSS0.00267EPSS
SaveExploits0References5
NVD
NVD•added 2026/09/30 3:22 p.m.•22 views

CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

7.3CVSS0.00145EPSS
SaveExploits0References4
Cvelist
Cvelist•added 2026/09/30 2:48 p.m.•48 views

CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

8.6CVSS0.00267EPSS
SaveExploits0References5
osv_cve
osv_cve•added 2026/09/30 2:48 p.m.•17 views

CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

8.6CVSS6.1AI score
SaveExploits0References7
EUVD
EUVD•added 2026/09/30 2:48 p.m.•17 views

EUVD-2026-89993

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

8.6CVSS6AI score0.00267EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment•added 2026/09/30 2:48 p.m.•15 views

CVE-2026-103398 OpenSave through 2.4.0 Arbitrary File Read and Write via Peer-Controlled Save Path

OpenSave through 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes...

8.6CVSS6AI score0.00267EPSS
SaveExploits0References5
CVE
CVE•added 2026/09/30 2:48 p.m.•29 views

CVE-2026-103398

The software OpenSave through 2.4.0 is vulnerable to an arbitrary file read and write flaw. The issue originates in the manifest request handler , which fails to properly validate save paths provided by paired peers. This allows an attacker to specify arbitrary directories outside of the configur...

8.6CVSS6AI score0.00267EPSS
SaveExploits0References5
EUVD
EUVD•added 2026/09/30 2:06 p.m.•18 views

EUVD-2026-89959

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

7.3CVSS6AI score0.00145EPSS
SaveExploits0References4
CVE
CVE•added 2026/09/30 2:06 p.m.•40 views

CVE-2026-101295

The oc-mirror tool is vulnerable to a path traversal and arbitrary file write flaw during the operator catalog image extraction process. When users mirror operator catalogs using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), the software fails to validate that extracted t...

7.3CVSS6AI score0.00145EPSS
SaveExploits0References4
Cvelist
Cvelist•added 2026/09/30 2:06 p.m.•49 views

CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

7.3CVSS0.00145EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment•added 2026/09/30 2:06 p.m.•17 views

CVE-2026-101295 Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

7.3CVSS6AI score0.00145EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE•added 2026/09/30 1:23 p.m.•19 views

CVE-2026-101295

Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path --v1 or the OCI feature path --use-oci-feature, oc-mirror extracts tar entries from catalog image layers without validating that file paths...

7.3CVSS6AI score0.00145EPSS
SaveExploits0References5
Rows per page
Query Builder