Lucene search
+L

6336 matches found

NVD
NVD
added 4 days ago9 views

CVE-2026-54205

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

6.3CVSS0.0028EPSS
SaveExploits0References2
EUVD
EUVD
added 4 days ago11 views

EUVD-2026-54450

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

6.3CVSS5.6AI score0.0028EPSS
SaveExploits0References2
CVE
CVE
added 4 days ago36 views

CVE-2026-54207

CVE-2026-54207 affects Tobit TeamDavid’s Webbox move-archive feature (ArcEntryMove). The function accepts an arbitrary path, including UNC network paths like \Server\Share, which the server processes without validation. This can trigger outbound connections to attacker-controlled SMB servers, all...

6.3CVSS5.6AI score0.0028EPSS
SaveExploits0References2
Cvelist
Cvelist
added 4 days ago33 views

CVE-2026-54207 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in move archive functionality

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

6.3CVSS0.0028EPSS
SaveExploits0References2
Cvelist
Cvelist
added 4 days ago36 views

CVE-2026-54206 TeamDavid: Server-Side Request Forgery (SSRF) via 'pathname' parameter in sending functionality

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

6.3CVSS0.0028EPSS
SaveExploits0References2
CVE
CVE
added 4 days ago49 views

CVE-2026-54204

CVE-2026-54204 affects Tobit Laboratories AG TeamDavid’s Webbox. The search function accepts a pathnameroot parameter that can be set to UNC network locations; the server processes these values without validation, causing outbound connections to attacker-controlled SMB endpoints. This enables una...

7.7CVSS5.6AI score0.00325EPSS
SaveExploits0References2
EUVD
EUVD
added 4 days ago13 views

EUVD-2026-54347

Software installed and run as a non-privileged user may conduct improper GPU system calls to trigger OOB access and kernel null pointer dereference in an error path. Null pointer dereference occurs in an error path of a function running in kernel thread of execution leading to kernel exceptions,...

5.5CVSS5.7AI score0.00107EPSS
SaveExploits0References1
Cvelist
Cvelist
added 5 days ago26 views

CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks

Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...

5.9CVSS0.00755EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago8 views

CVE-2026-18427

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...

7.5CVSS0.00458EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 5 days ago8 views

CVE-2026-18427 @fastify/static vulnerable to route guard bypass via non-canonical path segments

@fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent directory segments, but it did not canonicalize dot segments, duplicate slashes, encoded dots, or backslashes before route matching and before delegatin...

7.5CVSS5.5AI score0.00458EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago10 views

CVE-2026-19008

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

6.5CVSS0.00342EPSS
SaveExploits0References8
Cvelist
Cvelist
added 5 days ago30 views

CVE-2026-19008 mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

6.5CVSS0.00342EPSS
SaveExploits0References8
OSV
OSV
added 5 days ago6 views

CVE-2026-19008 mf-yang openclaw-cn apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape link following

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

5.3CVSS5.1AI score
SaveExploits0References10
EUVD
EUVD
added 5 days ago8 views

EUVD-2026-53766

A vulnerability was identified in mf-yang openclaw-cn up to 0.2.1. This issue affects the function assertNoSymlinkEscape of the file src/agents/sandbox-paths.ts of the component applypatch Tool. Such manipulation leads to link following. It is possible to launch the attack remotely. The exploit i...

6.5CVSS5.1AI score0.00342EPSS
SaveExploits0References8
CVE
CVE
added 5 days ago40 views

CVE-2026-19008

Technical details about CVE-2026-19008 are not publicly available in the provided documents. Monitor for updates.

6.5CVSS6.2AI score0.00342EPSS
SaveExploits0References8
OSV
OSV
added 5 days ago4 views

UBUNTU-CVE-2026-64591

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid WARNING in sva unbind path The Intel IOMMU driver allows SVA on devices even if they do not support PCI/PRI. Commit 39c20c4e83b9 "iommu/vt-d: Only handle IOPF for SVA when PRI is supported" modified the SVA bind...

5.3AI score0.00164EPSS
SaveExploits0References6
OSV
OSV
added 5 days ago3 views

UBUNTU-CVE-2026-64594

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: initialize resetwork at allocation time ffsfskillsb unconditionally calls cancelworksync on ffs-resetwork when a functionfs instance is unmounted: ffsdataresetffs; cancelworksync&ffs-resetwork; However...

5.3AI score0.00164EPSS
SaveExploits0References11
Snyk
Snyk
added 6 days ago7 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the route rule matching. An attacker can gain unauthorized access to protected pages and sensitive data by crafting requests to mixed-case paths that bypass authentication middleware. Workaround This...

8.2CVSS5.4AI score0.00267EPSS
SaveExploits0References3
Snyk
Snyk
added 6 days ago9 views

Incorrect Authorization

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Incorrect Authorization in the route rule matching. An attacker can gain unauthorized access to protected pages and sensitive data by crafting requests to mixed-case paths that...

8.2CVSS5.5AI score0.00267EPSS
SaveExploits0References3
Patchstack
Patchstack
added 6 days ago7 views

NPM: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

NPM: Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates incomplete fix for CVE-2026-53721 vulnerability discovered by ? in WordPress Npm nuxt versions = 3.21.7, 3.21.10...

8.8CVSS5.4AI score0.00294EPSS
SaveExploits0References6Affected Software1
Rows per page
Query Builder