Lucene search
+L

23394 matches found

ATTACKERKB
ATTACKERKB
added 5 days ago9 views

CVE-2026-48056

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s...

10CVSS5.6AI score0.00379EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 5 days ago31 views

CVE-2026-48056

Streambert (Electron desktop app) versions prior to 2.5.0 are vulnerable due to improper validation of executable paths in the run-download IPC handler, enabling a compromised renderer to execute arbitrary local binaries with the application’s privileges. Version 2.5.0 patches this. No exploitati...

10CVSS5.6AI score0.00379EPSS
SaveExploits0References2
Cvelist
Cvelist
added 5 days ago35 views

CVE-2026-48046 Streambert Vulnerable to Remote Code Execution (RCE) via Unvalidated Auto-Updater IPC Handler

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 contain an unvalidated auto-updater URL vulnerability that allows a compromised renderer process to make the main process download and execute an arbitrary binary, resulting in remote...

9.3CVSS0.00273EPSS
SaveExploits0References2
CVE
CVE
added 5 days ago35 views

CVE-2026-48046

Vulnerability summary for CVE-2026-48046: Streambert (Electron desktop app) is affected in versions prior to 2.5.0 by an unvalidated auto-updater URL handled via IPC. A compromised renderer process can trigger the main process to download and execute an arbitrary binary, resulting in remote code ...

9.3CVSS5.9AI score0.00273EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago5 views

CVE-2026-72540

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified alb...

4.3CVSS0.00206EPSS
SaveExploits0References1
Cvelist
Cvelist
added 5 days ago34 views

CVE-2026-72555 Peppermint Lab Peppermint - Broken Access Control

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.rolesactive flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass...

8.1CVSS0.00263EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 5 days ago7 views

CVE-2026-72555

A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 exists because the Config.rolesactive flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass...

8.1CVSS5.4AI score0.00263EPSS
SaveExploits0References2
Cvelist
Cvelist
added 5 days ago34 views

CVE-2026-72540 PhotoPrism PhotoPrism - Insecure Direct Object Reference

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified alb...

4.3CVSS0.00206EPSS
SaveExploits0References1
EUVD
EUVD
added 5 days ago6 views

EUVD-2026-56010

An insecure direct object reference vulnerability in PhotoPrism through commit bb0b933 allows any user with a valid preview token to retrieve the original-resolution cover photo of any album. The AlbumCover handler does not verify that the requesting user is authorized to access the specified alb...

4.3CVSS5.3AI score0.00206EPSS
SaveExploits0References1
CVE
CVE
added 5 days ago38 views

CVE-2026-14548

The CVE concerns the Ray Enterprise Translation WordPress plugin (affected:

6.5CVSS5.4AI score0.00174EPSS
SaveExploits0References1
CVE
CVE
added 5 days ago31 views

CVE-2026-51584

The CVE-2026-51584 entry concerns usememos v0.27.1, where a remote attacker can achieve account takeover through the ssoCredentials branch of the SignIn handler (server/router/api/v1/auth_service.go). The root cause is that SSO identity is matched against an attacker-controllable identifier and i...

9.8CVSS5.4AI score0.00418EPSS
SaveExploits0References2
EUVD
EUVD
added 5 days ago8 views

EUVD-2026-56175

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

5.3AI score0.00418EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 5 days ago4 views

CVE-2026-51584

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

5.3AI score0.00418EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 5 days ago3 views

PT-2026-70207

Streambert is a cross-platform Electron Desktop App to stream and download video content. Versions prior to 2.5.0 improperly validate executable paths supplied to the run-download IPC handler, allowing a compromised renderer process to execute arbitrary local binaries with the application’s...

10CVSS5.6AI score0.00379EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 5 days ago9 views

Linux Distros Unpatched Vulnerability : CVE-2026-72913

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the...

7.3CVSS5.7AI score0.00146EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 5 days ago6 views

PT-2026-70915

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.16.0 Description The OpenAI Create Transcription action handler uses the fetch function to retrieve a user-supplied audio URL without implementing existing Server-Side Request Forgery SSRF protections. SSRF is a fla...

5.4CVSS5.4AI score0.00223EPSS
SaveExploits0References6
Cvelist
Cvelist
added 5 days ago31 views

CVE-2026-51584

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

0.00418EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 5 days ago2 views

PT-2026-70242

A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an...

4.3CVSS5.3AI score0.0026EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 5 days ago3 views

PT-2026-70209

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject...

9.8CVSS5.3AI score0.00418EPSS
SaveExploits0References3
OSV
OSV
added 6 days ago4 views

DEBIAN-CVE-2026-72913

Kitty is a cross-platform GPU based terminal. Prior to 0.48.2, the @kitty-echo and @kitty-ssh DCS handlers in kitty/window.py write unauthenticated data to the child shell's stdin, where handleremoteecho accepts printable shell command characters and handleremotessh calls getsshdata in...

7.3CVSS5.5AI score0.00146EPSS
SaveExploits0References1
Rows per page
Query Builder