Lucene search
+L

506021 matches found

EUVD
EUVD
•added 2026/09/11 3:39 a.m.•11 views

EUVD-2026-75954

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

7.5CVSS5.7AI score0.00304EPSS
SaveExploits0References5
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•11 views

EUVD-2026-75769

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

8.8CVSS6.7AI score0.00807EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•19 views

EUVD-2026-75886

An OS command injection vulnerability in the TDDP module of Deco BE11000 allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution...

7.7CVSS6.6AI score0.03678EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•10 views

EUVD-2026-75766

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...

8.8CVSS6.4AI score0.00794EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•10 views

EUVD-2026-75765

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

8.8CVSS6.7AI score0.00807EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•11 views

EUVD-2026-75774

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command...

8.8CVSS6.7AI score0.00807EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•18 views

EUVD-2026-75784

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary code due to code injection during graph construction...

9.8CVSS6.7AI score0.0086EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•11 views

EUVD-2026-75794

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to execute arbitrary OS commands due to improper neutralization of special elements used in an OS command...

9.8CVSS6.4AI score0.00673EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•12 views

EUVD-2026-75796

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary commands due to improper validation of command-line arguments in the MCP stdio server configuration...

8.8CVSS6.4AI score0.00794EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•11 views

EUVD-2026-75878

IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources...

7.8CVSS5.8AI score0.00193EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/09/11 12:31 a.m.•10 views

EUVD-2026-75870

FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting XSS. An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, accou...

5.8AI score0.00226EPSS
SaveExploits1References2
NVD
NVD
•added 2026/09/11 12:17 a.m.•19 views

CVE-2026-17176

An OS command injection vulnerability in the TDDP module of Deco BE11000 allows an adjacent network attacker to execute arbitrary commands with root privileges by sending a crafted UDP packet. Successful exploitation may lead to complete device compromise, including unauthorized command execution...

7.7CVSS0.03678EPSS
SaveExploits0References2
OSV
OSV
•added 2026/09/11 12:11 a.m.•8 views

RLSA-2026:61586 Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape CVE-2026-18477 tar: tar:...

5CVSS6AI score0.00401EPSS
SaveExploits1References5
Rockylinux
Rockylinux
•added 2026/09/11 12:11 a.m.•12 views

tar security, bug fix, and enhancement update

An update is available for tar. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The GNU tar program can save multiple files in an archive and restore files from...

5.5CVSS6AI score0.00401EPSS
SaveExploits1
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/11 12:00 a.m.•0 views

CVE-2026-89246: Improper Neutralization of Formula Elements in a CSV File

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a CSV formula injection vulnerability in the myComments.download.php endpoint that fails to sanitize spreadsheet formula prefixes in comment text. Authenticated users can inject formulas starting with =, +, -, or @...

5.4CVSS6AI score0.00235EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/11 12:00 a.m.•0 views

CVE-2026-62112: Improper Neutralization of Special Elements used in an SQL Command

Editor SQL Injection in Amelia = 2.4.9 versions...

7.6CVSS5.8AI score0.00383EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/11 12:00 a.m.•0 views

CVE-2026-62105: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in ThemeREX Addons 2.45.0 versions...

9.8CVSS5.7AI score0.00564EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/11 12:00 a.m.•0 views

CVE-2026-52630: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the update action in UserAction.class.php...

9.8CVSS6AI score0.00665EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/11 12:00 a.m.•0 views

CVE-2026-89239: Improper Neutralization of Input During Web Page Generation

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing / to close t...

6.1CVSS5.6AI score0.00263EPSS
SaveExploits0References2
Rapid7 Vulnerability Database (full)
Rapid7 Vulnerability Database (full)
•added 2026/09/11 12:00 a.m.•0 views

CVE-2026-90444: Improper Neutralization of Special Elements used in an OS Command

A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...

8.7CVSS6.2AI score0.00396EPSS
SaveExploits0References2
Rows per page
Query Builder