Lucene search
+L

27459 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/05 12:53 a.m.22 views

Malicious code in @ethlete/query (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d3334de45d8864ad96963e00aa263c3c1b09678abe9317058965a2b6b026abd The package was found to contain malicious code or consuming dependency that contains malicious code Source: google-open-source-security...

6.1AI score
SaveExploits0References3
Packet Storm News
Packet Storm News
added 2026/06/05 12:0 a.m.30 views

Revive Adserver 6.0.6 XSS / SQL Injection / Code Injection

Revive Adserver versions 6.0.6 and below suffer from access control, code injection, cross site scripting, and remote SQL injection vulnerabilities...

5.4CVSS5.6AI score0.00754EPSS
SaveExploits3
Positive Technologies
Positive Technologies
added 2026/06/05 12:0 a.m.24 views

PT-2026-46950

Name of the Vulnerable Software and Affected Versions Lyrion Music Server version 9.2.0 Description An unauthenticated stored cross-site scripting issue exists in the log viewer due to unescaped template variables. This allows attackers to execute arbitrary scripts in users' browsers by injecting...

7.2CVSS5.5AI score0.00183EPSS
SaveExploits2References6
Positive Technologies
Positive Technologies
added 2026/06/05 12:0 a.m.32 views

PT-2026-47007

A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manipulation of the argument room leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and...

7.5CVSS7AI score0.00263EPSS
SaveExploits0References7
Redos
Redos
added 2026/06/05 12:0 a.m.15 views

ROS-20260605-73-0020

The vulnerability in Portainer-Ce relates to the disclosure of information through query strings. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

7.7CVSS5.4AI score0.00316EPSS
SaveExploits1
Packet Storm News
Packet Storm News
added 2026/06/05 12:0 a.m.44 views

RecurGuard: Runtime Monitoring for Reasoning-Token Consumption Attacks

Reasoning-capable large language models can be induced to spend their generation budget on injected decoy tasks rather than answering the user's question, causing denial of service when no final answer is produced and denial of wallet when excess output tokens are billed. Input-side safety...

5.6AI score
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/05 12:0 a.m.29 views

PT-2026-47052

Name of the Vulnerable Software and Affected Versions OpenXDMoD versions prior to 10.0.3 Description An SQL injection allows an unauthenticated remote attacker to execute arbitrary SQL statements. This can result in the complete compromise of the underlying database. The issue requires no...

9.8CVSS6AI score0.00479EPSS
SaveExploits0References9
CNNVD
CNNVD
added 2026/06/05 12:0 a.m.13 views

DBI 安全漏洞

DBI is a Perl database interface tool developed under the open-source license of perl5-dbi. Versions of DBI prior to 1.648 contained security vulnerabilities; these vulnerabilities stemmed from heap overflows that occurred when pre-resolving SQL statements involving more than nine binders...

9.8CVSS5.6AI score0.00485EPSS
SaveExploits0References3
NVD
NVD
added 2026/06/04 8:16 p.m.17 views

CVE-2026-41522

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

7.1CVSS0.00246EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/04 7:31 p.m.14 views

CVE-2026-41522 Iris has an Improper Authorization issue

Iris is a web collaborative platform that helps incident responders share technical details during investigations. Prior to version 2.4.28, DFIR-IRIS exposes an optional GraphQL endpoint at /graphql that does not enforce the same authorization checks as the REST API. Any authenticated user can...

7.1CVSS5.6AI score0.00246EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/06/04 5:19 p.m.8 views

CVE-2026-10880

OSNexus QuantaStor SDS Manager is vulnerable to SQL injection in the login endpoint. The username field is not properly sanitized before being incorporated into a SQL query, allowing an unauthenticated remote attacker to bypass authentication and log in as an administrator without supplying a val...

9.8CVSS5.9AI score0.00436EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2026/06/04 3:16 p.m.17 views

CVE-2026-47706

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...

5.3CVSS0.00296EPSS
SaveExploits1References2
NVD
NVD
added 2026/06/04 3:16 p.m.17 views

CVE-2026-45739

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

4.3CVSS0.00218EPSS
SaveExploits0References5
OSV
OSV
added 2026/06/04 3:16 p.m.8 views

PYSEC-2026-2282

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

4.3CVSS6.1AI score0.00218EPSS
SaveExploits0References5
OSV
OSV
added 2026/06/04 2:38 p.m.10 views

GHSA-QFWV-87QJ-98XQ Strawberry GraphQL has a Circular Fragment Reference DOS

Summary The QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth function enters an infinite recursion, leading to a RecursionError and crashing the...

5.3CVSS5.8AI score0.00296EPSS
SaveExploits1References4
Snyk
Snyk
added 2026/06/04 2:25 p.m.14 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the GraphQL API Endpoint that lacks depth limiting and complexity analysis for SQL queries. An attacker can cause excessive resource consumption by sending specially crafted reques...

5.3CVSS5.5AI score0.0031EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/06/04 2:9 p.m.48 views

CVE-2026-45739 Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

3.1CVSS0.00218EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/06/04 2:9 p.m.16 views

EUVD-2026-34270

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as Authorization: Bearer , the value...

3.1CVSS5.8AI score0.00218EPSS
SaveExploits0References5
CVE
CVE
added 2026/06/04 2:6 p.m.63 views

CVE-2026-47706

The CVE affects Strawberry GraphQL versions 0.71.0–0.315.6, where the QueryDepthLimiter lacks cycle detection in fragment spreads, causing infinite recursion and an application-level DOS (RecursionError) during validation. The issue is fixed in 0.315.7. Remediation: upgrade to 0.315.7 or later. T...

5.3CVSS5.8AI score0.00296EPSS
SaveExploits1References2Affected Software1
Cvelist
Cvelist
added 2026/06/04 2:6 p.m.46 views

CVE-2026-47706 Strawberry GraphQL has a Circular Fragment Reference DOS

Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determinedepth...

5.3CVSS0.00296EPSS
SaveExploits1References2
Rows per page
Query Builder