Lucene search
+L

24879 matches found

UbuntuCve
UbuntuCve
•added 2026/08/01 1:17 p.m.•15 views

CVE-2026-67320

axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by creating a null-prototype object, but request interceptors run after the merge; a common immutable interceptor pattern such as ...config or...

8.3CVSS5.3AI score0.00523EPSS
SaveExploits1References4
EUVD
EUVD
•added 2026/08/01 12:22 p.m.•21 views

EUVD-2026-51808

GitPython 3.1.50 fails to recognize joined short-option forms such as -u the short form of --upload-pack= when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clonefrom..., multioptions=..., allowunsafeoptions=False, an attacker can...

9.8CVSS5.7AI score0.00644EPSS
SaveExploits1References2
CBLMariner
CBLMariner
•added 2026/08/01 3:56 a.m.•17 views

CVE-2026-58040 affecting package nodejs for versions less than 24.18.1-1

CVE-2026-58040 affecting package nodejs for versions less than 24.18.1-1. An upgraded version of the package is available that resolves this issue...

6.3CVSS6.7AI score0.003EPSS
SaveExploits0
SUSE CVE
SUSE CVE
•added 2026/08/01 12:06 a.m.•16 views

SUSE CVE-2026-54715

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in nix systems or through the browser. In version 1.10.2, parsebrowser assumes the matched browser token begins with Opera and moves a trailing version substring to match plus five, allowing a crafted User-Age...

7.1CVSS5.5AI score0.00445EPSS
SaveExploits0References3
OSV
OSV
•added 2026/08/01 12:00 a.m.•7 views

OPENSUSE-SU-2026:11417-1 libntpc1-1.2.5-1.1 on GA media

These are all security issues fixed in the libntpc1-1.2.5-1.1 package on the GA media of openSUSE Tumbleweed...

4.7CVSS5.5AI score0.00111EPSS
SaveExploits0References1
NVD
NVD
•added 2026/07/31 11:17 p.m.•16 views

CVE-2026-53573

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This...

4.8CVSS0.00648EPSS
SaveExploits0References7
Cvelist
Cvelist
•added 2026/07/31 10:58 p.m.•47 views

CVE-2026-45377 Decidim: Private exports can be downloaded through reusable links

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the normal downloadyourdata flow requires the requester to be logged in as the export owner, but the resulting Active Storage blob redirect URL can be replayed without...

6.5CVSS0.00453EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/07/31 7:38 p.m.•17 views

CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

8.1CVSS6AI score0.00687EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
•added 2026/07/31 7:00 p.m.•11 views

CVE-2026-53505 Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor's filters:proportion filter does not enforce an upper bound on and runs in the post-transform phase. An attacker can trigger extremely large resizes CPU/memory exhaustion and cause denial of service. This issu...

7.5CVSS5.5AI score0.00609EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
•added 2026/07/31 4:38 p.m.•13 views

SUSE CVE-2026-50642

diff-so-fancy does not properly sanitize non-SGR terminal control sequences before outputting diff data. The application only strips ANSI SGR sequences while allowing other control characters, including carriage return \r and escape sequences e.g., OSC, CSI, to pass through unsanitized. An attack...

4.8CVSS5.8AI score0.00229EPSS
SaveExploits0References3
NVD
NVD
•added 2026/07/31 4:16 p.m.•19 views

CVE-2026-17346

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...

8.8CVSS0.00615EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
•added 2026/07/31 3:59 p.m.•14 views

CVE-2026-17349 pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

/misc/workspace/adhocconnectserver, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone, which copies every column from the source row, including userid, shared, sharedusername, and the stored credential fields...

9.6CVSS5.5AI score0.00395EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/07/31 3:59 p.m.•22 views

EUVD-2026-51560

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

7.7CVSS5.9AI score0.00716EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
•added 2026/07/31 1:48 p.m.•18 views

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

9.8CVSS5.5AI score0.00738EPSS
SaveExploits0References2
Slackware Linux
Slackware Linux
•added 2026/07/31 4:17 a.m.•26 views

[slackware-security] php

New php packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/php82/php82-8.2.33-i586-1slack15.0.txz: Upgraded. This update fixes security issues: GD: Upgrade libgd. PGSQL: Fixed GHSA-7qpv-r5mr-78m4 SQL injecti...

9.8CVSS5.9AI score0.0033EPSS
SaveExploits2
Cvelist
Cvelist
•added 2026/07/31 4:06 a.m.•51 views

CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

7.5CVSS0.00635EPSS
SaveExploits0References3
OSV
OSV
•added 2026/07/31 4:06 a.m.•12 views

CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

7.5CVSS5.5AI score
SaveExploits0References5
Vulnrichment
Vulnrichment
•added 2026/07/31 4:06 a.m.•12 views

CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

7.5CVSS5.5AI score0.00635EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
•added 2026/07/31 12:54 a.m.•9 views

SUSE CVE-2026-4525

If a Vault auth mount is configured to pass through the "Authorization" header, and the "Authorization" header is used to authenticate to Vault, Vault forwarded the Vault token to the auth plugin backend. Fixed in 2.0.0, 1.21.5, 1.20.10, and 1.19.16...

8.8CVSS7.3AI score0.00586EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
•added 2026/07/31 12:54 a.m.•10 views

SUSE CVE-2026-5052

Vault's PKI engine's ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0,...

8.6CVSS7.7AI score0.00389EPSS
SaveExploits0References2
Rows per page
Query Builder