Lucene search
+L

1406538 matches found

CVE
CVE
added 1 hour ago35 views

CVE-2026-48051

Papra (document management platform) prior to version 26.5.0 is vulnerable to SSRF via its webhook delivery system. The issue arises because the SSRF protection checks only the registered webhook URL and ignores redirects; the HTTP client (ofetch) automatically follows 3xx redirects, and the redi...

3.5CVSS5.8AI score0.00025EPSS
SaveExploits0References1
CVE
CVE
added 2 hours ago31 views

CVE-2026-64642

CVE-2026-64642 affects Next.js (16.0.0–16.2.10) where crafted requests to App Router apps built with Turbopack and a single locale entry in config.i18n.locales can bypass middleware or proxy authentication. Root cause: improper handling of authentication flow under specific App Router configurati...

8.3CVSS5.8AI score
SaveExploits0References4
Circl
Circl
added 2 hours ago3 views

CVE-2026-12394

creationtimestamp| type| source ---|---|--- 2026-07-27 17:10:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnf7mmhgz24...

9.8CVSS5.8AI score
SaveExploits0References1
Qualys Blog
Qualys Blog
added 3 hours ago5 views

Qualys Expands Serverless Security with Vulnerability Scanning for AWS Lambda

Key Takeaways Qualys now delivers automated AWS Lambda vulnerability scanning , extending serverless security beyond posture checks CSPM into workload-level risk visibility. CSPM alone only catches misconfigurations excessive permissions, exposure, logging, encryption — it can't detect vulnerable...

6.1AI score
SaveExploits0
NVD
NVD
added 3 hours ago5 views

CVE-2026-55953

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

9.1CVSS
SaveExploits0References7
RedhatCVE
RedhatCVE
added 3 hours ago2 views

CVE-2026-52686

A flaw was found in pdns-recursor. This vulnerability allows a remote attacker to bypass DNSSEC Domain Name System Security Extensions validation. The flaw occurs because the system accepts wildcard expansion proofs NSEC/NSEC3 records without proper signature validation when the wildcard answer i...

3.7CVSS5.8AI score0.00113EPSS
SaveExploits0References4
EUVD
EUVD
added 3 hours ago4 views

EUVD-2026-49334

VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...

10CVSS6AI score
SaveExploits0References1
Circl
Circl
added 3 hours ago2 views

CVE-2026-13597

creationtimestamp| type| source ---|---|--- 2026-07-27 16:04:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrnbjklh6g24...

9.1CVSS5.8AI score
SaveExploits0References1
RedhatCVE
RedhatCVE
added 4 hours ago2 views

CVE-2026-59898

A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security...

5.3CVSS5.8AI score
SaveExploits0References4
RedhatCVE
RedhatCVE
added 4 hours ago2 views

CVE-2026-56821

A flaw was found in netty-handler-ssl-ocsp, a component of the Netty network application framework. The Online Certificate Status Protocol OCSP stapling validator in this component does not properly check certificate revocation status. This can allow an attacker to use revoked certificates withou...

5.7CVSS5.7AI score
SaveExploits0References3
EUVD
EUVD
added 4 hours ago4 views

EUVD-2026-49325

Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service by sending a crafted X.509 certificate chain during the TLS handshake. During RFC 5280 policy processing in publickey:pkixpathvalidation/3...

8.7CVSS6AI score
SaveExploits0References6
RedhatCVE
RedhatCVE
added 4 hours ago2 views

CVE-2026-56822

A flaw was found in Netty's netty-handler-ssl-ocsp component. This vulnerability involves a time-of-check/time-of-use TOCTOU race condition within the OCSP stapling validator. A remote attacker could exploit this timing window, allowing them to use a certificate that has been revoked for...

7.4CVSS5.7AI score
SaveExploits0References4
Cvelist
Cvelist
added 4 hours ago10 views

CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

The Erlang/OTP ssl TLS 1.2 and earlier and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the suites offered by the client in ClientHello. The client-side tlshandshake:hello/5 handler validates the negotiated protocol version and the downgrade...

9.1CVSS
SaveExploits0References7
NVD
NVD
added 4 hours ago5 views

CVE-2026-65564

Unauthenticated Sensitive Data Exposure in MapPress Maps for WordPress = 2.97.6 versions...

5.3CVSS
SaveExploits0References1
NVD
NVD
added 4 hours ago2 views

CVE-2026-10819

Mattermost versions 11.6.x = 11.6.5, 10.11.x = 10.11.20, 11.8.x = 11.8.1, 11.7.x = 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom...

6.5CVSS
SaveExploits0References1
Circl
Circl
added 4 hours ago3 views

CVE-2026-13332

creationtimestamp| type| source ---|---|--- 2026-07-27 15:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrn66bnwxn2u...

9.1CVSS5.8AI score
SaveExploits0References1
Cvelist
Cvelist
added 5 hours ago5 views

CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In sslcertificate:handleincompletechain/5, the received chain is passed to sslcertificate:buildcertificatechain/5, which walks issuer relationships via...

8.7CVSS
SaveExploits0References7
CVE
CVE
added 5 hours ago3 views

CVE-2026-10819

The CVE CVE-2026-10819 affects Mattermost server versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, and 11.7.x

6.5CVSS5.8AI score
SaveExploits0References1
EUVD
EUVD
added 5 hours ago3 views

EUVD-2026-49253

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server v...

4.3CVSS5.9AI score
SaveExploits0References1
Cvelist
Cvelist
added 5 hours ago9 views

CVE-2026-66475 WordPress Checkout Field Editor for WooCommerce &#8211; Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Shop manager Cross Site Scripting XSS in Checkout Field Editor for WooCommerce Checkout Manager = 3.0.5 versions...

5.9CVSS
SaveExploits0References1
Rows per page
Query Builder