Lucene search
+L

93906 matches found

NVD
NVD
added 2026/08/13 4:19 p.m.5 views

CVE-2026-73576

In Zimbra Collaboration ZCS before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with...

6.3CVSS0.00188EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/13 3:26 p.m.12 views

EUVD-2026-58075

In Zimbra Collaboration ZCS before 10.1.17, weak cryptographic key generation vulnerability exists in the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated using an insecure random number generator, resulting in insufficient entropy. An attacker who obtains a JWT signed with...

6.3CVSS5.3AI score0.00188EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/13 3:26 p.m.23 views

CVE-2026-73576

CVE-2026-73576 affects Zimbra Collaboration (ZCS) before 10.1.17 via the OnlyOffice integration. The zimbraDocumentEditingJwtSecret is generated with an insecure RNG, yielding insufficient entropy. This may allow offline brute-forcing to recover the JWT signing secret, enabling JWT forgery and po...

6.3CVSS5.3AI score0.00188EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/08/13 3:24 p.m.11 views

CVE-2026-73575

In Zimbra Collaboration ZCS before 10.1.17, a Cross-Site Request Forgery CSRF vulnerability exists in the Exchange Web Services EWS endpoint of Zimbra Collaboration ZCS due to insufficient validation of request content types. An attacker can exploit this vulnerability by causing an authenticated...

3.1CVSS5.3AI score0.00112EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/13 3:24 p.m.17 views

CVE-2026-73575

CVE-2026-73575 affects Zimbra Collaboration (ZCS) pre-10.1.17. A CSRF vulnerability exists in the Exchange Web Services (EWS) endpoint caused by insufficient validation of request content types. An attacker could induce an authenticated user to submit a crafted request, potentially allowing unaut...

3.1CVSS5.3AI score0.00112EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/13 3:19 p.m.7 views

CVE-2026-53788

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names...

6.9CVSS0.00251EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/08/13 2:36 p.m.8 views

CVE-2026-53788

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names...

6.9CVSS5.3AI score0.00251EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/13 2:36 p.m.46 views

CVE-2026-53788 rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names...

6.9CVSS0.00251EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/13 2:36 p.m.9 views

CVE-2026-53788 rsync < 3.5.0 Newline Injection via name-converter uid/gid mapping

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names...

6.9CVSS5.5AI score
SaveExploits0References6
CVE
CVE
added 2026/08/13 2:36 p.m.22 views

CVE-2026-53788

CVE-2026-53788 affects rsync prior to 3.5.0. A newline injection in the name-converter uid/gid mapping interface lets local attackers forge protocol messages by embedding newline characters in user/group names, causing the rsync daemon to treat attacker-controlled data as legitimate protocol inpu...

6.9CVSS5.3AI score0.00251EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/13 2:36 p.m.8 views

EUVD-2026-58096

rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names...

6.9CVSS5.3AI score0.00251EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/13 2:17 p.m.6 views

CVE-2026-66704

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

7.2CVSS0.00188EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/13 2:17 p.m.7 views

CVE-2026-66654

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

6CVSS0.00191EPSS
SaveExploits0References1
Github Security Blog
Github Security Blog
added 2026/08/13 2:16 p.m.9 views

Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials

Summary A client that can submit message history to a Pydantic AI UI adapter can reference arbitrary files in the application's model-provider or cloud-storage account. The server forwards the reference to the model provider, which fetches it using the server's own credentials, allowing the clien...

6.8CVSS5.6AI score0.00197EPSS
SaveExploits0References5Affected Software2
OSV
OSV
added 2026/08/13 1:59 p.m.5 views

OESA-2026-3331 bind security update

BIND Berkeley Internet Name Domain is an implementation of the DNS Domain Name System protocols. BIND includes a DNS server named, which resolves host names to IP addresses; a resolver library routines for applications to use when interfacing with DNS; and tools for verifying that the DNS server ...

8.6CVSS5.5AI score0.00523EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/08/13 1:37 p.m.7 views

EUVD-2026-57907

Unauthenticated Server Side Request Forgery SSRF in Gutenverse Companion = 2.5.1 versions...

7.2CVSS5.2AI score0.00188EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/13 1:37 p.m.5 views

EUVD-2026-57893

Subscriber Server Side Request Forgery SSRF in Vehica Core = 1.0.104 versions...

6CVSS5.2AI score0.00191EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/08/13 1:26 p.m.6 views

Security Bulletin: IBM Documentation Offline is vulnerable to information disclosure, session forgery and remote code execution

Summary IBM Documentation Offline is a desktop application that bundles an Electron-based viewer and an embedded Node.js web server to serve product documentation locally on the user's workstation. Multiple vulnerabilities have been identified in the embedded server component spanning three...

9.8CVSS6.1AI score0.00611EPSS
SaveExploits0Affected Software1
Elastic
Elastic
added 2026/08/13 10:48 a.m.7 views

Kibana 8.19.20 and 9.4.5 Security Update (ESA-2026-99)

Cross-Site Request Forgery in Kibana Leading to Privilege Escalation Cross-Site Request Forgery CWE-352 in Kibana can lead to privilege escalation via Cross Site Request Forgery CAPEC-62. A user who is permitted to create visualizations can save a specially crafted Vega visualization that, when i...

7.3CVSS5.3AI score0.00133EPSS
SaveExploits0
Circl
Circl
added 2026/08/13 4:45 a.m.20 views

CVE-2026-18699

creationtimestamp| type| source ---|---|--- 2026-08-13 04:45:31+00:00| seen| https://www.hkcert.org/security-bulletin/mongodb-multiple-vulnerabilities20260813...

6.5CVSS4.9AI score0.00289EPSS
SaveExploits0References1
Rows per page
Query Builder