Lucene search
+L

47386 matches found

Positive Technologies
Positive Technologies
added 2026/08/22 12:00 a.m.17 views

PT-2026-79654

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chg txt...

5.7AI score0.00288EPSS
SaveExploits0References8
OSV
OSV
added 2026/08/21 11:57 p.m.13 views

CVE-2026-77781 Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys

Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods throw an exception when on malformed regular expressions. Each method falls back to a regex match when the key is not already stored in the hash, compiling the...

7.5CVSS5.6AI score
SaveExploits0References7
NVD
NVD
added 2026/08/21 10:16 p.m.16 views

CVE-2026-33240

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

8.8CVSS0.00269EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/21 9:25 p.m.13 views

EUVD-2026-64175

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

8.8CVSS5.3AI score0.00269EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/21 9:25 p.m.25 views

CVE-2026-33240

Combodo iTop , a web-based IT service management tool, is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API prior to version 3.2.3 . The flaw allows an attacker to inject malicious scripts that execute in a victim's browser when they interact ...

8.8CVSS5.3AI score0.00269EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/21 9:25 p.m.28 views

CVE-2026-33240 Combodo iTop: Reflected XSS in foreign key search criteria

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

8.8CVSS0.00269EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/21 9:25 p.m.7 views

CVE-2026-33240 Combodo iTop: Reflected XSS in foreign key search criteria

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting XSS vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3...

8.8CVSS5.4AI score
SaveExploits0References4
NVD
NVD
added 2026/08/21 7:17 p.m.9 views

CVE-2026-53762

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

6.2CVSS0.0006EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/21 6:50 p.m.197 views

CVE-2026-53762

VeraCrypt non-default builds compiled with WOLFCRYPT=1 and WOLFCRYPT_BACKEND contain a key-derivation flaw in src/Crypto/wolfCrypt.c. The functions derive_key_sha256 and derive_key_sha512 discard the configured iteration count and substitute wc_HKDF for PBKDF2-HMAC , meaning increasing the PIM or...

6.2CVSS5.4AI score0.0006EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/21 6:50 p.m.33 views

CVE-2026-53762 VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

6.2CVSS0.0006EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/21 6:50 p.m.25 views

CVE-2026-53762 VeraCryp: wolfCrypt backend bypasses VeraCrypt PBKDF2 iteration count (non-default WOLFCRYPT=1 builds)

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.29, non-default builds created with WOLFCRYPT=1 and WOLFCRYPTBACKEND route SHA-256 and SHA-512 volume-header key derivation through derivekeysha256 and derivekeysha512 in src/Crypto/wolfCrypt.c, where the...

6.2CVSS5.5AI score
SaveExploits0References5
NVD
NVD
added 2026/08/21 1:18 p.m.10 views

CVE-2026-77780

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

5.3CVSS0.00253EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/21 12:12 p.m.11 views

EUVD-2026-63935

Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, bank name and card last four digits via a...

5.3CVSS5.4AI score0.00253EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/21 11:29 a.m.29 views

CVE-2026-77759 IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records

Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/id, which is resolved without...

8.7CVSS0.0032EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/21 11:17 a.m.11 views

CVE-2026-77763

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derived every operation's target from pathkey, which returned either filepath.Joind.root, key or filepath.Cleand.root + key with no check that the result stayed beneath the root. Put, Ge...

7.1CVSS0.00325EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/21 11:14 a.m.14 views

MAL-2026-14352 Malicious code in tailwind-animate-css-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99a4ac9c32887fff975dd06912302125d243af4f0bb2567714ef69ec763997e0 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.7AI score
SaveExploits0References4
CVE
CVE
added 2026/08/21 11:05 a.m.25 views

CVE-2026-77763

JuiceFS filestore backend (pkg/object/file.go) contains a path traversal vulnerability. The path(key) function joined object keys onto the storage root using filepath.Join or filepath.Clean without verifying the resolved path remained beneath the root. All operations—Put, Get, Head, Delete, Chmod...

7.1CVSS5.5AI score0.00325EPSS
SaveExploits0References6
RedhatCVE
RedhatCVE
added 2026/08/21 9:45 a.m.7 views

CVE-2026-74567

A flaw was found in the Linux kernel's key management subsystem. An unprivileged local attacker could exploit an out-of-bounds read vulnerability in the keyringgetkeychunk function. By providing specially crafted keys, the attacker can cause the system to read beyond its intended memory boundarie...

7.1CVSS5.2AI score0.00117EPSS
SaveExploits0References4
Patchstack
Patchstack
added 2026/08/21 8:05 a.m.10 views

WordPress SmartCrawl plugin < 3.16.3 - Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability

Subscriber+ Private/Draft Post Title Disclosure and Post Meta Key Enumeration vulnerability discovered by Ezekiel Victor in WordPress Plugin SmartCrawl versions 3.16.3...

4.3CVSS5.2AI score0.00197EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/08/21 6:00 a.m.42 views

CVE-2026-16962 Tamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation

The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numeric order id, so an unauthenticated attacker can cancel or...

0.00182EPSS
SaveExploits0References1
Rows per page
Query Builder