Lucene search
+L

13433 matches found

BDU FSTEC
BDU FSTEC
added 2026/05/29 12:0 a.m.13 views

The vulnerability of the config.xml configuration file of the Notepad++ text editor allows a hacker to execute arbitrary code.

The vulnerability of the config.xml configuration file of the text editor Notepad++ is related to the lack of measures taken to eliminate special elements during the processing of the commandLineInterpreter parameter. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

7.8CVSS6AI score0.01314EPSS
SaveExploits5References5Affected Software1
CVE
CVE
added 2026/05/28 7:12 p.m.32 views

CVE-2026-49130

MPD (Music Player Daemon) prior to version 0.24.11 is affected by a CRLF injection vulnerability in the XSPF playlist plugin’s xspf_char_data function. By supplying a malicious XSPF playlist that exploits XML numeric character references, an attacker can cause Expat decoding to insert literal CR/...

6.9CVSS5.8AI score0.0026EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/05/27 8:48 p.m.21 views

EUVD-2026-32664

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...

8.6CVSS5.9AI score0.00188EPSS
SaveExploits1References3
OSV
OSV
added 2026/05/27 8:48 p.m.8 views

CVE-2026-45136 claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...

8.6CVSS6AI score
SaveExploits0References5
OSV
OSV
added 2026/05/27 8:46 p.m.14 views

GHSA-XX3C-QF5G-HC39 Symfony has an Argument Injection in SendmailTransport via Dash-Prefixed Recipient Address

Description Symfony Mailer selects a transport via the MAILERDSN environment variable / configuration e.g. smtp://..., sendmail://..., native://default. SendmailTransport invokes the local sendmail binary and supports two modes: -bs speak SMTP over stdin: the default and -t read the message on...

8.6CVSS5.8AI score0.00407EPSS
SaveExploits0References6
OSV
OSV
added 2026/05/27 8:42 p.m.14 views

GHSA-QPMX-3RFJ-7RHV Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

7.1CVSS5.8AI score0.00619EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2026/05/27 8:42 p.m.15 views

Symfony has Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

Description Symfony\Component\Mime\Address is the value-object every Symfony Mailer address to/cc/bcc/from/reply-to flows through; its constructor is documented as validating the address and throwing on invalid input, so developers treat it as a security boundary. The constructor accepts email...

6.3CVSS5.8AI score0.00619EPSS
SaveExploits0References6Affected Software2
ATTACKERKB
ATTACKERKB
added 2026/05/27 5:35 p.m.10 views

CVE-2026-45088

Dalfox is a powerful open-source XSS scanner and utility focused on automation. Prior to 2.13.0, when dalfox is run in REST API server mode, the custom-payload-file field in model.Options is JSON-tagged and deserialized directly from the attacker's request body, then propagated unchanged through...

7.5CVSS5.9AI score0.00251EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/05/27 5:24 p.m.11 views

CVE-2026-44345

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.39, src/bentoml/internal/container/frontend/dockerfile/templates/basev2.j2 interpolates docker.baseimage raw with no escaping, newline filtering, or validation. A malicious...

8.8CVSS5.9AI score0.00317EPSS
SaveExploits1References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/05/27 2:42 p.m.12 views

CVE-2026-44972 GuardDog: Unsanitized human-readable scan output allows terminal escape injection from malicious package content

GuardDog is a CLI tool to identify malicious PyPI packages. From 2.6.0 to 2.9.0, GuardDog includes attacker-controlled filenames, file locations, messages, and code snippets in its default human-readable output without escaping terminal control characters. A malicious package can therefore inject...

5CVSS5.9AI score0.00113EPSS
SaveExploits0References1
Wolfi
Wolfi
added 2026/05/27 1:48 p.m.20 views

CVE-2026-39828 vulnerabilities

Vulnerabilities for packages: snyk-cli, docker-machine-driver-harvester, prometheus, osv-scanner, gitea, kots, cloud-provider-aws, cilium-cli, k9s, spire-server, flux-image-automation-controller, argocd-image-updater, nerdctl, aactl, zarf, loki, kaf, kubernetes-dashboard, k3s, external-dns,...

8.8CVSS5.2AI score0.00369EPSS
SaveExploits0
Wolfi
Wolfi
added 2026/05/27 1:48 p.m.20 views

CVE-2026-46598 vulnerabilities

Vulnerabilities for packages: snyk-cli, prometheus, kots, cloud-provider-aws, cilium-cli, spire-server, nerdctl, aactl, loki, kaf, kubernetes-dashboard, k3s, external-dns, rancher, podman, zot, kine, minio, opentelemetry-collector, kyverno, containerd, fscrypt, telegraf, helm,...

5.3CVSS5.2AI score0.00412EPSS
SaveExploits0
Wolfi
Wolfi
added 2026/05/27 1:48 p.m.16 views

CVE-2026-39834 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-elasticache, crossplane-provider-family-azure, crossplane-provider-aws-firehose, vault-benchmark, argo-events, cilium-cli, crossplane-provider-aws-rds, caddy, flux-image-automation-controller, cloudflared, argocd-image-updater,...

9.1CVSS5.2AI score0.00525EPSS
SaveExploits0
Patchstack
Patchstack
added 2026/05/27 1:46 p.m.15 views

WordPress Line Agency theme <= 1.3.1 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by Bonds in WordPress Theme Line Agency versions = 1.3.1...

8.1CVSS5.8AI score0.00348EPSS
SaveExploits0Affected Software1
Chainguard
Chainguard
added 2026/05/27 1:18 p.m.16 views

CVE-2026-46595 vulnerabilities

Vulnerabilities for packages: skaffold, tekton-pipelines, etcd-fips, prometheus-mongodb-exporter, k9s, upwind-agent, containerd, flux-fips, zitadel, knative-kafka-broker, chisel-fips, prometheus-operator, kubevela-fips, omnictl-multiarch, trivy-fips, snyk-cli, opentofu, zot,...

10CVSS5.8AI score0.00503EPSS
SaveExploits0
Chainguard
Chainguard
added 2026/05/27 1:18 p.m.20 views

CVE-2026-39832 vulnerabilities

Vulnerabilities for packages: guac, skaffold, terragrunt, tekton-pipelines, melange, etcd-fips, prometheus-mongodb-exporter, k9s, upwind-agent, containerd, flux-fips, zitadel, knative-kafka-broker, prometheus-operator, chainloop-cli-fips, kubevela-fips, chainctl, omnictl-multiarch, trivy-fips,...

9.1CVSS5.2AI score0.006EPSS
SaveExploits0
Ubuntu
Ubuntu
added 2026/05/27 1:2 p.m.17 views

USN-8321-1: Papers vulnerability

It was discovered that Papers incorrectly handled PDF /GoToR actions. If a user were tricked into opening a specially crafted PDF file, an attacker could use this issue to manipulate command lines and possibly execute arbitrary code...

8.4CVSS5.8AI score0.00529EPSS
SaveExploits1
RedhatCVE
RedhatCVE
added 2026/05/27 12:34 p.m.19 views

CVE-2026-45842

A flaw was found in the Linux kernel's SLIP Serial Line Internet Protocol and PPP Point-to-Point Protocol components. An unprivileged local user can exploit this vulnerability by manipulating the PPPIOCSMAXCID ioctl to configure the SLIP Compressed Header SLHC state incorrectly. This...

5.5CVSS5.8AI score0.00127EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/05/27 12:28 p.m.18 views

CVE-2026-45843

A flaw was found in the Linux kernel's Serial Line Internet Protocol SLIP implementation. The slhcuncompress function, which handles VJ-compressed TCP headers, fails to perform proper bounds checks during packet processing. A remote attacker could exploit this by sending a specially crafted...

8.2CVSS5.8AI score0.00355EPSS
SaveExploits0References4
Fedora
Fedora
added 2026/05/27 1:27 a.m.18 views

[SECURITY] Fedora 43 Update: rust-sequoia-sq-1.3.1-11.fc43

Command-line frontends for Sequoia...

5.8AI score
SaveExploits0
Rows per page
Query Builder