Lucene search
+L

3863 matches found

UbuntuCve
UbuntuCve
•added 2026/06/15 12:00 a.m.•13 views

CVE-2026-45190

Net::CIDR::Lite versions before 0.24 for Perl does not properly validate IP address and CIDR mask inputs, which may allow IP ACL bypass. Inputs containing a trailing newline or non-ASCII digit characters pass the validators but are then re-encoded by the parser to a different address than the inp...

6.5CVSS6.1AI score0.00484EPSS
SaveExploits0References5
Snyk
Snyk
•added 2026/06/12 10:52 p.m.•12 views

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the ParseCommand process. An attacker can execute arbitrary operating system commands by injecting shell metacharacters into allowed command input, which are then interpreted by the configured...

8.8CVSS6.3AI score0.00437EPSS
SaveExploits0References3
Snyk
Snyk
•added 2026/06/12 10:52 p.m.•10 views

Incomplete List of Disallowed Inputs

Overview Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the ParseCommand process. An attacker can execute arbitrary operating system commands by injecting shell metacharacters into allowed command input, which are then interpreted by the configured...

8.8CVSS6.3AI score0.00437EPSS
SaveExploits0References3
NVD
NVD
•added 2026/06/12 6:16 p.m.•25 views

CVE-2026-44168

MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. No...

8CVSS0.0097EPSS
SaveExploits0References13
RedHat Linux
RedHat Linux
•added 2026/06/12 8:54 a.m.•24 views

python-idna: idna: Denial of Service via specially crafted long inputs

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...

6.9CVSS6.1AI score0.00457EPSS
SaveExploits0References5
CNNVD
CNNVD
•added 2026/06/11 12:00 a.m.•28 views

GitLab Enterprise Edition(EE)和GitLab Community Edition(CE) 安全漏洞

GitLab Enterprise Edition EE and GitLab Community Edition CE are both products of the American company GitLab. GitLab Enterprise Edition is a content management system. GitLab Community Edition is a community version of GitLab. Versions of GitLab CE/EE prior to 15.9, 18.10.8, 18.11.5, and 19.0.2...

3.7CVSS5.3AI score0.0023EPSS
SaveExploits0References1
CVE
CVE
•added 2026/06/11 12:00 a.m.•57 views

CVE-2026-38581

A SQL Injection vulnerability exists in damasac thaipalliative_lte versions 3.0 and earlier . The root cause is the direct concatenation of the idFormMain parameter (to /substudy/ezform.php at line 14) and the id parameter (at line 49) into SQL queries without proper sanitization or the use of pa...

6.3AI score0.00592EPSS
SaveExploits1References2
CNVD
CNVD
•added 2026/06/11 12:00 a.m.•16 views

Huawei EMUI and Huawei HarmonyOS have vulnerabilities related to input validation.

Huawei HarmonyOS EMUI is a microkernel-based distributed operating system developed by Huawei, offering seamless collaboration across devices. There are input validation vulnerabilities in Huawei EMUI and Huawei HarmonyOS. These vulnerabilities stem from the log service’s failure to properly hand...

5CVSS5.9AI score0.00106EPSS
SaveExploits0
NVD
NVD
•added 2026/06/10 10:17 p.m.•21 views

CVE-2026-48110

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could se...

7.5CVSS0.0046EPSS
SaveExploits0References1
UbuntuCve
UbuntuCve
•added 2026/06/10 10:17 p.m.•13 views

CVE-2026-48110

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could se...

7.5CVSS6.1AI score0.0046EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/06/10 8:26 p.m.•19 views

CVE-2026-48110 Russh: SSH message fields were decoded through allocation-first parsers before field-specific bounds

Russh is a Rust SSH client & server library. From version 0.34.0 to before version 0.61.0, several russh client and server message handlers decoded attacker-controlled SSH strings, name-lists, and byte fields into owned allocations before applying field-specific bounds. A remote SSH peer could se...

7.5CVSS5.5AI score0.0046EPSS
SaveExploits0References1
CVE
CVE
•added 2026/06/10 8:16 p.m.•66 views

CVE-2026-46673

Summary of the vulnerability (CVE-2026-46673) : In Russh (Rust SSH client/server), CryptoVec allocations and growth were unchecked in vulnerable releases. Prior to 0.60.3, local agent inputs could feed attacker-controlled frame lengths into buffer growth before validation; in historical releases ...

7.5CVSS5.6AI score0.0046EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/06/10 8:16 p.m.•43 views

CVE-2026-46673 Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth...

7.5CVSS0.0046EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/06/10 8:16 p.m.•15 views

CVE-2026-46673 Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth...

7.5CVSS5.6AI score0.0046EPSS
SaveExploits0References1
OSV
OSV
•added 2026/06/10 8:16 p.m.•10 views

CVE-2026-46673 Russh: Unchecked CryptoVec allocation and growth handling is reachable from local agent inputs in current russh releases and from remote SSH traffic in historical pre-0.58.0 releases

Russh is a Rust SSH client & server library. Prior to version 0.60.3, CryptoVec used unchecked capacity growth, unchecked length arithmetic, and unsafe allocation/locking paths. In current russh releases, local SSH agent peers could still feed attacker-controlled frame lengths into buffer growth...

7.5CVSS6.1AI score
SaveExploits0References3
Veracode
Veracode
•added 2026/06/10 3:15 p.m.•22 views

OS Command Injection

shell-quote is vulnerable to OS Command Injection. The vulnerability is due to insufficient validation and escaping of object-token .op inputs in the quote function, which allows an attacker to inject line terminators and execute arbitrary shell commands when the generated output is processed by ...

9.2CVSS6.2AI score0.00953EPSS
SaveExploits1References37Affected Software1
RedHat Linux
RedHat Linux
•added 2026/06/10 9:34 a.m.•16 views

python-idna: idna: Denial of Service via specially crafted long inputs

A flaw was found in the idna library, which handles Internationalized Domain Names in Python applications. A remote attacker could exploit this vulnerability by sending specially crafted, excessively long inputs to the library's encoding function. This could cause the system to consume significan...

6.9CVSS6.5AI score0.00457EPSS
SaveExploits0References5
CNNVD
CNNVD
•added 2026/06/10 12:00 a.m.•25 views

WordPress plugin MW WP Form 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

4.4CVSS5.1AI score0.00327EPSS
SaveExploits0References2
OSV
OSV
•added 2026/06/09 8:38 a.m.•17 views

USN-8410-1 node-shell-quote vulnerability

Akshat Sinha discovered that shell-quote improperly validated object-token inputs. An attacker could possibly use this issue to cause shell-quote to crash, resulting in a denial of service, or execute arbitrary code...

9.8CVSS5.8AI score0.00953EPSS
SaveExploits3References2
CNNVD
CNNVD
•added 2026/06/09 12:00 a.m.•29 views

OSCAL-GUI 跨站脚本漏洞

OSCAL-GUI is a graphical interface tool developed by OSCAL Corporation for creating, editing, viewing, and managing OSCAL compliance data models. OSCAL-GUI has a cross-site scripting vulnerability, which stems from the failure to clean up malicious inputs injected through project request...

6.1CVSS5.5AI score0.00338EPSS
SaveExploits0References1
Rows per page
Query Builder