Lucene search
+L

24939 matches found

EUVD
EUVD
•added 2026/08/07 4:07 p.m.•17 views

EUVD-2026-54517

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

5.3CVSS5.3AI score0.00228EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/08/07 4:07 p.m.•15 views

CVE-2026-17598 Nexus Repository 3 - Improper Input Validation in Scheduled Task Configuration

Sonatype Nexus Repository 3 did not properly filter internal configuration keys from user-supplied task properties when creating or updating a scheduled task through the administrative UI. An account holding permission to create at least one scheduled task type could supply a crafted property val...

5.3CVSS5.3AI score0.00228EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/07 12:11 p.m.•18 views

MAL-2026-13519 Malicious code in streak-kit-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18948f1c8e71b24d05e1ef6f749995bdc9098d610f791b86dc33f7d41dd8b1d3 The package advertises itself as a streak/calendar math library, but its main entry dist/index.mjs contains a top-level IIFE that, on any...

5.7AI score
SaveExploits0References2
Microsoft CVE
Microsoft CVE
•added 2026/08/07 7:17 a.m.•11 views

crypto: asymmetric_keys - fix OOB read in pefile_digest_pe_contents

...

4.4CVSS5.2AI score0.0022EPSS
SaveExploits0
OSV
OSV
•added 2026/08/07 2:43 a.m.•12 views

OESA-2026-3281 kronosnet security update

The kronosnet source Security Fixes: A vulnerability was found in kronosnet's version =1.34 cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw...

6.5CVSS5.8AI score0.00359EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
•added 2026/08/07 12:00 a.m.•14 views

Linux Distros Unpatched Vulnerability : CVE-2026-71851

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - crypto-js is a JavaScript library of crypto standards. Versions of crypto-js prior to 4.0.0 generate randomness in CryptoJS.lib.WordArray.random using a custom...

9CVSS5.8AI score0.0055EPSS
SaveExploits0References3
RubySec
RubySec
•added 2026/08/07 12:00 a.m.•11 views

Ruby JSON - JSON::ResumableParser#partial_value dereferences a freed input buffer and crashes on truncated duplicate-key streams

Summary Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but leaves state.start, state.cursor, and state.end pointing into released storage. When partialvalue reconstructs an incomplete object containing duplicate keys, the duplicate-key warning path calls...

8.7CVSS6.3AI score0.00428EPSS
SaveExploits0References1Affected Software1
Tenable Nessus
Tenable Nessus
•added 2026/08/07 12:00 a.m.•19 views

Ruby oj Gem < 3.17.3 Multiple Vulnerabilities

The version of the oj Ruby gem installed on the remote host is prior to 3.17.3. It is, therefore, affected by multiple vulnerabilities: - Oj::Doceachchild, when invoked recursively over a deeply nested JSON document, overflows a fixed-size stack buffer and aborts the process, leading to DoS...

7.5CVSS5.7AI score0.0046EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
•added 2026/08/07 12:00 a.m.•14 views

Linux Distros Unpatched Vulnerability : CVE-2026-71847

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, Ruby's JSON native C extension clears the consumed JSON::ResumableParser input buffer but...

8.7CVSS5.8AI score0.00428EPSS
SaveExploits0References3
NVD
NVD
•added 2026/08/06 10:18 p.m.•22 views

CVE-2026-70559

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

8.7CVSS0.00451EPSS
SaveExploits1References3
NVD
NVD
•added 2026/08/06 10:17 p.m.•13 views

CVE-2026-48088

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

9.4CVSS0.00377EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/06 9:54 p.m.•13 views

GHSA-957R-QF9P-67XW Craft CMS: Arbitrary file read via SplFileObject in non-sandboxed template contexts

The create Twig function introduced in 5.9.0 allows instantiation of arbitrary PHP classes from template code, restricted only by a 5-entry blocklist. SplFileObject is not in the blocklist, enabling arbitrary file read, including .env security key, DB credentials and the passwd file from...

6.9CVSS5.6AI score0.00376EPSS
SaveExploits0References8
EUVD
EUVD
•added 2026/08/06 9:34 p.m.•14 views

EUVD-2026-54174

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

9.4CVSS5.6AI score0.00377EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/06 9:34 p.m.•12 views

CVE-2026-48088 OpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route POST /api/tenants/tenantId/staff/staffId/crypto accepts and stores attacker-controlled ML-KEM-768 public keys against any tenant on the platform without...

9.4CVSS5.7AI score
SaveExploits0References4
CVE
CVE
•added 2026/08/06 9:34 p.m.•72 views

CVE-2026-48088

OpenReception’s OpenReception appointment-booking software (prior to version 1.0.4) is vulnerable to unauthenticated crypto key provisioning via POST /api/tenants/{tenantId}/staff/{staffId}/crypto, allowing attacker-controlled ML-KEM-768 public keys to be registered for any tenant. The handler lo...

9.4CVSS5.6AI score0.00377EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
•added 2026/08/06 7:43 p.m.•18 views

Contao crawler leaks auth credentials to external hosts

Summary Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for root page origins, cleaned options for everything else. The cleaner removes Cookie and Authorization headers, but it removes the non-Symfony...

2.6CVSS5.5AI score0.00243EPSS
SaveExploits0References8Affected Software2
attackerkb
attackerkb
•added 2026/08/06 7:36 p.m.•13 views

CVE-2026-70559

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

8.7CVSS5.9AI score0.00451EPSS
SaveExploits1References4
OSV
OSV
•added 2026/08/06 7:36 p.m.•19 views

CVE-2026-70559 Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

8.7CVSS5.8AI score
SaveExploits0References5
Atlassian
Atlassian
•added 2026/08/06 5:30 p.m.•10 views

DoS (Denial of Service) js-yaml Dependency in Jira Software Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 10.0.0, 10.1.1, 10.2.0, 10.3.0, 10.4.0, 10.5.0, 10.6.0, 10.7.1, 11.0.0, 11.1.0, 11.2.0, and 11.3.0 of Jira Software Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.5 and a CVSS Vector o...

7.5CVSS5.9AI score0.00585EPSS
SaveExploits1
NVD
NVD
•added 2026/08/06 3:16 p.m.•43 views

CVE-2026-53976

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

9.3CVSS0.02612EPSS
SaveExploits0References3
Rows per page
Query Builder