Lucene search
+L

26165 matches found

OSV
OSV
added 2026/07/30 8:55 p.m.8 views

CVE-2026-66418 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

9.3CVSS5.6AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/30 8:55 p.m.35 views

CVE-2026-66418 OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

9.3CVSS0.00338EPSS
SaveExploits1References3
CVE
CVE
added 2026/07/30 8:55 p.m.32 views

CVE-2026-66418

OpenClaw Dashboard v3.0.0 is affected by a stored XSS in the login failure path. An unauthenticated attacker can submit a crafted username, which is recorded in the audit log and later rendered unescaped via innerHTML in the administrator notification panel. The permissive CSP (allowing inline ev...

9.3CVSS6AI score0.00338EPSS
SaveExploits1References3
EUVD
EUVD
added 2026/07/30 8:55 p.m.13 views

EUVD-2026-51309

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an...

9.3CVSS6AI score0.00338EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2026/07/30 8:37 p.m.7 views

CVE-2026-55777

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. Prior to 1.11, the parseios function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent...

5.3CVSS5.8AI score0.00263EPSS
SaveExploits0References3Affected Software1
NVD
NVD
added 2026/07/30 7:16 p.m.8 views

CVE-2024-40683

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

6.3CVSS0.00154EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/30 7:6 p.m.11 views

EUVD-2026-51275

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

4.3CVSS5.9AI score0.00176EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/30 6:11 p.m.10 views

EUVD-2024-55704

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

6.3CVSS5.9AI score0.00154EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/30 6:11 p.m.33 views

CVE-2024-40683 IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the...

6.3CVSS0.00154EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/30 6:11 p.m.25 views

CVE-2024-40683

CVE-2024-40683 affects IBM Operations Analytics – Log Analysis. The TOCTOU weakness in the built-in password management causes sessions not to be invalidated after a password change, potentially enabling an authenticated user to impersonate another user. Affected versions include 1.3.5.0–1.3.7.2 ...

6.3CVSS5.9AI score0.00154EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/30 5:16 p.m.5 views

CVE-2026-12945

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints...

7.1CVSS5.5AI score
SaveExploits0References1
NVD
NVD
added 2026/07/30 5:16 p.m.10 views

CVE-2026-12945

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints...

7.1CVSS0.00215EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/30 4:44 p.m.11 views

EUVD-2026-51242

IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints...

7.1CVSS5.9AI score0.00215EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/30 4:44 p.m.27 views

CVE-2026-12945

IBM Langflow OSS 1.0.0–1.10.1 is affected by CVE-2026-12945: authenticated users can access and manipulate other users’ build jobs due to improper access control on log retrieval and unauthenticated build endpoints. Affected product: Langflow OSS (1.0.0–1.10.1). Root cause: authorization bypass t...

7.1CVSS5.9AI score0.00215EPSS
SaveExploits0References1Affected Software1
SUSE CVE
SUSE CVE
added 2026/07/30 4:44 p.m.6 views

SUSE CVE-2026-47726

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.2, internal/api/audit.go:12 - handleGetAuditLog does no admin check. The route is bearer-auth gated only; any operator API key returns the full audit log via store.ListAuditEntries up to...

7.1CVSS7.5AI score0.00238EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
added 2026/07/30 4:39 p.m.7 views

SUSE CVE-2026-55437

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded...

5.4CVSS7.7AI score0.00179EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/30 4:7 p.m.4 views

MAL-2026-11349 Malicious code in pretty-log-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad32145cb24ae2a271cecb6379d30a531be17d84a0d71189d3a4afaec20af015 No malicious behavior was identified in this package version. There is no evidence of credential access, environment scraping, network exfiltration,...

5.7AI score
SaveExploits0References11
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/30 4:7 p.m.16 views

Malicious code in pretty-log-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad32145cb24ae2a271cecb6379d30a531be17d84a0d71189d3a4afaec20af015 No malicious behavior was identified in this package version. There is no evidence of credential access, environment scraping, network exfiltration,...

5.7AI score
SaveExploits0References11
OSV
OSV
added 2026/07/30 4:2 p.m.5 views

JLSEC-2026-1070 ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the...

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in color transformation to the log colorspace: when the operation fails, a small amount of memory is not released...

2.9CVSS5.9AI score0.00102EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/30 3:16 p.m.13 views

CVE-2026-12947

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user...

7.5CVSS0.00395EPSS
SaveExploits0References1
Rows per page
Query Builder