Lucene search
+L

28974 matches found

RedhatCVE
RedhatCVE
added 1 hour ago4 views

CVE-2026-71309

A flaw was found in rclone. The rclone serve restic component, which handles cloud storage operations, contains an incomplete path validation vulnerability. An attacker with access to the REST endpoint can exploit this by using specially crafted URL paths containing directory traversal sequences...

8.6CVSS5.4AI score
SaveExploits0References6
EUVD
EUVD
added 3 hours ago6 views

EUVD-2026-53705

A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function selecttools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carri...

6.5CVSS5.2AI score
SaveExploits0References7
EUVD
EUVD
added 6 hours ago6 views

EUVD-2026-53695

A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function getfilecontent of the file server.py of the component executetoolmanually Endpoint. The manipulation of the argument toolname/toolparams results in information disclosure. The attack can be launched...

6.9CVSS5.1AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added yesterday3 views

CVE-2026-18958

A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. Affected by this vulnerability is an unknown functionality of the file loginCheckTest.php of the component Login. The manipulation of the...

7.5CVSS7AI score
SaveExploits0References5
EUVD
EUVD
added yesterday5 views

EUVD-2026-53470

A vulnerability was determined in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6dbb44057bcd7f8c. This affects the function storeProfileImage of the file studentprofilepic.php of the component Shared Upload Helper. Executing a manipulati...

6.5CVSS6.3AI score
SaveExploits0References5
RedHat Linux
RedHat Linux
added yesterday2 views

keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...

8.1CVSS5.5AI score0.00308EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added yesterday4 views

CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

8.1CVSS5.5AI score
SaveExploits0References6
NVD
NVD
added yesterday3 views

CVE-2026-0516

A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains...

6.5CVSS
SaveExploits0References1
EUVD
EUVD
added yesterday4 views

EUVD-2026-53334

A improper neutralization of HTTP Headers for Scripting Syntax vulnerability in SonicOS could allow a remote attacker to manipulate the Host header and redirect firewall management users to arbitrary web domains...

6.5CVSS5.7AI score
SaveExploits0References1
NVD
NVD
added yesterday4 views

CVE-2026-8761

The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check in the CustomersController REST controller includes/REST/CustomersController.php, which re-registers WooCommerce's customer CRUD routes...

8.8CVSS0.00369EPSS
SaveExploits0References10
NVD
NVD
added yesterday8 views

CVE-2026-18901

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

8.6CVSS0.00454EPSS
SaveExploits0References6
CVE
CVE
added yesterday13 views

CVE-2026-18901

The CVE-2026-18901 entry concerns H3C NX15 V100R017 Web API. The vulnerable component is the function service.add in the /api/esps endpoint, whose manipulation can expose a dangerous routine. The vulnerability is exploitable remotely, and public exploits/PoCs have been disclosed. References indic...

8.6CVSS6.6AI score0.00454EPSS
SaveExploits0References6
Cvelist
Cvelist
added yesterday18 views

CVE-2026-18901 H3C NX15 Web API esps service.add routine

A security vulnerability has been detected in H3C NX15 V100R017. Affected is the function service.add of the file /api/esps of the component Web API. Such manipulation leads to exposed dangerous routine. The attack may be launched remotely. The exploit has been disclosed publicly and may be used...

8.6CVSS0.00454EPSS
SaveExploits0References6
Nuclei
Nuclei
added yesterday49 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/admin/?page=user/manageuser&id=. id: CVE-2022-31975 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: high description: | Online Fire Reporting System v1.0 is vulnerable to SQL...

7.2CVSS7.4AI score0.04967EPSS
SaveExploits1References3
Nuclei
Nuclei
added yesterday58 views

Online Fire Reporting System v1.0 - SQL injection

Online Fire Reporting System v1.0 is vulnerable to SQL Injection via /ofrs/classes/Master.php?f=deleteteam. id: CVE-2022-31977 info: name: Online Fire Reporting System v1.0 - SQL injection author: theamanrawat severity: critical description: | Online Fire Reporting System v1.0 is vulnerable to SQ...

9.8CVSS8AI score0.07313EPSS
SaveExploits1References3
Nuclei
Nuclei
added yesterday40 views

74cms - ajax_officebuilding.php SQL Injection

A SQL injection vulnerability exists in 74cms 3.2.0 via the x parameter to ajaxofficebuilding.php. id: CVE-2020-22210 info: name: 74cms - ajaxofficebuilding.php SQL Injection author: ritikchaddha severity: critical description: | A SQL injection vulnerability exists in 74cms 3.2.0 via the x...

9.8CVSS7.2AI score0.08579EPSS
SaveExploits1References3
Nuclei
Nuclei
added yesterday119 views

Versa Concerto API Path Based - Authentication Bypass

Authentication bypass in the Versa Concerto API, caused by URL decoding inconsistencies. It allowed unauthorized access to certain API endpoints by manipulating the URL path.This issue enabled attackers to bypass authentication controls and access restricted resources. id: CVE-2025-34027 info:...

10CVSS8AI score0.36602EPSS
SaveExploits0References4
Nuclei
Nuclei
added yesterday107 views

Joomla! JCK Editor SQL Injection

The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. id: CVE-2018-17254 info: name: Joomla! JCK Editor SQL Injection author: SumanKar severity: critical description: The JCK Editor component 6.4.4 for Joomla! allows SQL Injection vi...

9.8CVSS8AI score0.82976EPSS
SaveExploits6References5
Nuclei
Nuclei
added yesterday67 views

DedeCMS 5.7.109 - Server-Side Request Forgery

Manipulation of the rssurl parameter in codo.php leads to server-side request forgery in DedeCMS version 5.7.109. id: CVE-2023-3578 info: name: DedeCMS 5.7.109 - Server-Side Request Forgery author: ritikchaddha severity: critical description: | Manipulation of the rssurl parameter in codo.php lea...

9.8CVSS6.3AI score0.0357EPSS
SaveExploits1References2
Nuclei
Nuclei
added yesterday107 views

Label Studio - Sensitive Information Exposure

An attacker can construct a filter chain to filter tasks based on sensitive fields for all user accounts on the platform by exploiting Django's Object Relational Mapper ORM. Since the results of query can be manipulated by the ORM filter, an attacker can leak these sensitive fields character by...

7.5CVSS6.8AI score0.04055EPSS
SaveExploits3References3
Rows per page
Query Builder