Lucene search
+L

27511 matches found

NVD
NVD
added 2026/05/01 8:16 p.m.12 views

CVE-2026-7592

A weakness has been identified in itsourcecode Courier Management System 1.0. This affects an unknown function of the file /editstaff.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been made available to the public...

7.5CVSS0.00259EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2026/05/01 8:14 p.m.15 views

CVE-2026-31708

A flaw was found in the Linux kernel's Server Message Block SMB client. A malicious server can exploit an out-of-bounds read vulnerability by manipulating the OutputBufferLength during a QUERYINFO operation. This can lead to the exposure of sensitive kernel memory to userspace, resulting in...

8.1CVSS5.8AI score0.00307EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/05/01 7:0 p.m.5 views

CVE-2026-7591 TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection

A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MCP Tool Query Construction. Performing a manipulation of the argument request.params.arguments results in sql injection. The attac...

6.5CVSS6.4AI score0.00196EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/05/01 7:0 p.m.10 views

EUVD-2026-26709

A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MCP Tool Query Construction. Performing a manipulation of the argument request.params.arguments results in sql injection. The attac...

6.5CVSS6.4AI score0.00196EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/05/01 7:0 p.m.38 views

CVE-2026-7591 TimBroddin astro-mcp-server MCP Tool Query Construction index.ts sql injection

A security flaw has been discovered in TimBroddin astro-mcp-server up to 1.1.1. The impacted element is an unknown function of the file src/index.ts of the component MCP Tool Query Construction. Performing a manipulation of the argument request.params.arguments results in sql injection. The attac...

6.5CVSS0.00196EPSS
SaveExploits0References5
CVE
CVE
added 2026/05/01 7:0 p.m.30 views

CVE-2026-7591

CVE-2026-7591 : In TimBroddin’s astro-mcp-server (up to 1.1.1), the vulnerability exists in an unknown function within src/index.ts of the MCP Tool Query Construction. An attacker can manipulate the argument at request.params.arguments to trigger a SQL injection. The issue can be exploited remote...

6.5CVSS6.4AI score0.00196EPSS
SaveExploits0References5
NVD
NVD
added 2026/05/01 2:16 p.m.6 views

CVE-2026-31705

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2getea EA alignment smb2getea applies 4-byte alignment padding via memset after writing each EA entry. The bounds check on buffreelen is performed before the value memcpy, but the alignment...

9.8CVSS0.00389EPSS
SaveExploits0References6
NVD
NVD
added 2026/05/01 2:16 p.m.9 views

CVE-2026-31708

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2ioctlqueryinfo QUERYINFO path smb2ioctlqueryinfo has two response-copy branches: PASSTHRUFSCTL and the default QUERYINFO path. The QUERYINFO branch clamps qi.inputbufferlength to the server-report...

8.1CVSS0.00307EPSS
SaveExploits0References8
CVE
CVE
added 2026/05/01 2:15 p.m.32 views

CVE-2026-43034

Root cause CVE-2026-43034: in the bnxt_en driver of the Linux kernel, ctxm->type is populated from the firmware response (resp->type) and later used to index fixed backing-store metadata arrays, risking memory corruption. The fix changes ctxm->type to come from the current loop variable ...

5.5CVSS5.8AI score0.00121EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/05/01 2:15 p.m.7 views

CVE-2026-43034 bnxt_en: set backing store type from query type

In the Linux kernel, the following vulnerability has been resolved: bnxten: set backing store type from query type bnxthwrmfuncbackingstoreqcapsv2 stores resp-type from the firmware response in ctxm-type and later uses that value to index fixed backing-store metadata arrays such as ctxarr and...

5.9AI score
SaveExploits0References6
Debian CVE
Debian CVE
added 2026/05/01 2:15 p.m.10 views

CVE-2026-43034

In the Linux kernel, the following vulnerability has been resolved: bnxten: set backing store type from query type bnxthwrmfuncbackingstoreqcapsv2 stores resp-type from the firmware response in ctxm-type and later uses that value to index fixed backing-store metadata arrays such as ctxarr and...

5.5CVSS5.7AI score0.00121EPSS
SaveExploits0
CVE
CVE
added 2026/05/01 1:56 p.m.53 views

CVE-2026-31708

CVE-2026-31708 affects the Linux kernel SMB client. The issue occurs in smb2_ioctl_query_info() where, in the QUERY_INFO path, qi.input_buffer_length is clamped to the server’s OutputBufferLength and copied from qi_rsp->Buffer to userspace without verifying that the payload fits within rsp_iov...

8.1CVSS5.9AI score0.00307EPSS
SaveExploits0References8Affected Software1
Debian CVE
Debian CVE
added 2026/05/01 1:56 p.m.10 views

CVE-2026-31708

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2ioctlqueryinfo QUERYINFO path smb2ioctlqueryinfo has two response-copy branches: PASSTHRUFSCTL and the default QUERYINFO path. The QUERYINFO branch clamps qi.inputbufferlength to the server-report...

8.1CVSS5.9AI score0.00307EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/05/01 1:56 p.m.41 views

CVE-2026-31708 smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2ioctlqueryinfo QUERYINFO path smb2ioctlqueryinfo has two response-copy branches: PASSTHRUFSCTL and the default QUERYINFO path. The QUERYINFO branch clamps qi.inputbufferlength to the server-report...

8.1CVSS0.00307EPSS
SaveExploits0References8
OSV
OSV
added 2026/05/01 1:56 p.m.14 views

CVE-2026-31708 smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB read in smb2ioctlqueryinfo QUERYINFO path smb2ioctlqueryinfo has two response-copy branches: PASSTHRUFSCTL and the default QUERYINFO path. The QUERYINFO branch clamps qi.inputbufferlength to the server-report...

8.1CVSS5.8AI score
SaveExploits0References11
EUVD
EUVD
added 2026/05/01 1:56 p.m.19 views

EUVD-2026-26514

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2getea EA alignment smb2getea applies 4-byte alignment padding via memset after writing each EA entry. The bounds check on buffreelen is performed before the value memcpy, but the alignment...

5.9AI score0.00389EPSS
SaveExploits0References5
CVE
CVE
added 2026/05/01 1:56 p.m.93 views

CVE-2026-31705

The CVE-2026-31705 issue affects the ksmbd component of the Linux kernel, where an out-of-bounds write occurs in smb2_get_ea() during EA alignment padding. After writing each EA entry, a 4-byte alignment padding is applied with memset() unconditionally, potentially overwriting adjacent kernel hea...

9.8CVSS5.9AI score0.00389EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/05/01 1:56 p.m.8 views

CVE-2026-31705 ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2getea EA alignment smb2getea applies 4-byte alignment padding via memset after writing each EA entry. The bounds check on buffreelen is performed before the value memcpy, but the alignment...

9.8CVSS6.8AI score
SaveExploits0References9
Cvelist
Cvelist
added 2026/05/01 1:56 p.m.48 views

CVE-2026-31705 ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds write in smb2getea EA alignment smb2getea applies 4-byte alignment padding via memset after writing each EA entry. The bounds check on buffreelen is performed before the value memcpy, but the alignment...

9.8CVSS0.00389EPSS
SaveExploits0References6
GithubExploit
GithubExploit
added 2026/05/01 1:36 p.m.310 views

Exploit for CVE-2026-42167

\ CVE-2026-42167 POC Pre-Authentication Remote Code Executio...

8.1CVSS6.1AI score0.04275EPSS
SaveExploits7
Rows per page
Query Builder