Lucene search
+L

27989 matches found

OSV
OSV
added 2026/08/06 2:20 p.m.5 views

OPENSUSE-SU-2026:21543-1 Security update for python-Django

This update for python-Django fixes the following issues: Changes in python-Django: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997 - CVE-2026-15337: potential denial-of-service vulnerability in checkforlanguage bsc1272998 - CVE-2026-15830: potential...

8.8CVSS5AI score0.01255EPSS
SaveExploits0References8
RedhatCVE
RedhatCVE
added 2026/08/06 12:10 p.m.6 views

CVE-2026-46581

A flaw was found in EAP. Any estate hosting a JSF app using the user-controlled-include pattern would permit EL injection, achieving unauthenticated RCE as the server process user...

8.1CVSS5.4AI score0.00437EPSS
SaveExploits1References3
EUVD
EUVD
added 2026/08/06 10:26 a.m.12 views

EUVD-2026-53856

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any or referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied...

7.5CVSS5.4AI score0.00409EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/06 8:00 a.m.66 views

CVE-2026-19021

SourceCodester Computer Repair Shop Management System 1.0 is affected by a remote SQL injection in the file /classes/Master.php?f=delete_product, caused by manipulated ID parameter. The vulnerability can be exploited without authentication and has publicly disclosed exploit details. No patch/reme...

7.5CVSS7AI score0.00263EPSS
SaveExploits0References6
SUSE CVE
SUSE CVE
added 2026/08/06 1:36 a.m.10 views

SUSE CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

7.5CVSS5.4AI score0.01028EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/06 12:00 a.m.8 views

CVE-2026-67689

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

6.3AI score0.00685EPSS
SaveExploits1References3
OSV
OSV
added 2026/08/05 7:17 p.m.7 views

CVE-2026-9196

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...

8.8CVSS5.6AI score
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/08/05 5:24 p.m.9 views

CVE-2026-51992

A flaw was found in ClickHouse Server. A SQL Injection vulnerability exists in the create dictionaries function, which allows a remote attacker to execute arbitrary code. This could lead to a complete compromise of the affected system...

9.8CVSS6.2AI score0.00515EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/05 4:50 p.m.16 views

CVE-2026-10716 Directus <12.1.0 - Authenticated time-based SQL injection in PostgreSQL/PostGIS collection creation

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields.type value starts with geometry but contains attacker-controlled SQL...

7.5CVSS5.7AI score
SaveExploits0References6
NVD
NVD
added 2026/08/05 4:16 p.m.10 views

CVE-2026-48834

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

7.5CVSS0.00494EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/05 4:03 p.m.15 views

EUVD-2026-53441

IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 has an XML External Entity XXE injection vulnerability. The vulnerability resides in the parseXmlPayload function within the event processing pipeline q1labscore.jar . When at least one log source type is configured...

8.2CVSS5.5AI score0.00348EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/08/05 3:07 p.m.8 views

CVE-2026-48834

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

5.4AI score0.00494EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/05 3:07 p.m.44 views

CVE-2026-48834 Apache Answer: Denial of service via crafted Accept-Language header parsing

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

0.00494EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/05 3:07 p.m.8 views

CVE-2026-48834 Apache Answer: Denial of service via crafted Accept-Language header parsing

Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. Users...

7.5CVSS5.3AI score
SaveExploits0References4
CVE
CVE
added 2026/08/05 3:07 p.m.53 views

CVE-2026-48834

Apache Answer is affected by CVE-2026-48834 due to improper handling of a length parameter, allowing unauthenticated attackers to trigger denial of service by sending a crafted Accept-Language header that causes excessive CPU usage during parsing. Affected versions are up to 2.0.1; upgrading to 2...

7.5CVSS5.4AI score0.00494EPSS
SaveExploits0References2Affected Software1
RedHat Linux
RedHat Linux
added 2026/08/05 2:27 p.m.12 views

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

8.7CVSS5.4AI score0.00637EPSS
SaveExploits0References11
NVD
NVD
added 2026/08/05 2:17 p.m.9 views

CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

9.1CVSS0.0018EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/05 1:44 p.m.41 views

CVE-2026-16443 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

7.4CVSS0.0018EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/05 1:44 p.m.16 views

EUVD-2026-53343

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

7.4CVSS5.4AI score0.0018EPSS
SaveExploits0References6
CVE
CVE
added 2026/08/05 1:44 p.m.52 views

CVE-2026-16443

CVE-2026-16443 affects Red Hat build of Keycloak: the keycloak-services SAML broker metadata import feature incorrectly disables signature validation for SAML responses when provider metadata lacks certain key usage attributes, even if a signing certificate is supplied. This enables an unauthenti...

9.1CVSS5.4AI score0.0018EPSS
SaveExploits0References6Affected Software1
Rows per page
Query Builder