CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

1373 matches found

CVE-2026-47428

A flaw was found in Vitest, a testing framework. In Vitest Browser Mode, a remote attacker could craft a specific browser-runner URL that, when visited, would allow the execution of arbitrary JavaScript code within the Vitest server. This vulnerability could also lead to the recovery of the...

9.6CVSS6.3AI score0.0005EPSS

Exploits0References10

Nuclei•added yesterday•75 views

GitLab CE/EE - Information Disclosure

GitLab CE/EE is susceptible to information disclosure. An attacker can access runner registration tokens using quick actions commands, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. Affected versions are from 12.10 before 14.6.5,...

10CVSS7.2AI score0.13227EPSS

Exploits0References5

OSSF Malicious Packages•added 2026/07/08 4:20 p.m.•11 views

Malicious code in @luminarycloudinternal/frodo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58ed68e675b2b6cde30e6b7c8e34077eda805a4bde64ca7cd2c68c6f4370ee5f Package published under a scope shadowing internal Luminary Cloud packages @luminarycloudinternal at version 9999.0.1 — the canonical...

5.9AI score

Exploits0References4

NVD•added 2026/07/08 4:16 p.m.•10 views

CVE-2026-54344

ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow interpolates github.event.comment.body directly into a bash conditional in a run step, allowing any GitHub user who can comment on an open pull request with a...

4.7CVSS0.00171EPSS

Exploits0References1

EUVD•added 2026/07/08 1:49 p.m.•7 views

EUVD-2026-42263

n8n before 1.123.55, 2.25.7, and 2.26.2 contains an authorization bypass in the POST /workflows/workflowId/test-runs/new endpoint, which authorizes access using the workflow:read scope instead of workflow:execute. An authenticated user with read-only access to a workflow can trigger a real...

7.4CVSS6.1AI score0.00161EPSS

Exploits0References2

EUVD•added 2026/07/02 4:58 p.m.•10 views

EUVD-2026-36315

OpenClaw: Embedded runner policy could be confused by provider aliases...

4.8CVSS5.7AI score0.00093EPSS

Exploits0References3

OSV•added 2026/07/02 4:58 p.m.•4 views

GHSA-P39J-X9H5-Q66M OpenClaw: Embedded runner policy could be confused by provider aliases

Summary Embedded runner policy could be confused by provider aliases. In affected versions, a request using provider aliases could compare policy against an alias instead of the canonical provider identity. This advisory is scoped to the named feature and configuration. It does not change...

4.8CVSS5.9AI score0.00093EPSS

Exploits0References4

EUVD•added 2026/07/01 12:34 a.m.•11 views

EUVD-2026-40453

n8n before 2.25.7 and 2.26.x before 2.26.2 contains an abstract syntax tree AST security validator bypass in the Python Code node. An authenticated user with permission to create or modify workflows containing a Python Code node can bypass the validator and access the task executor module...

5.3CVSS5.8AI score0.00245EPSS

Exploits0References3

NVD•added 2026/06/30 11:17 p.m.•7 views

CVE-2026-56777

5.3CVSS0.00245EPSS

Exploits0References2