Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

42970 matches found

Vulnrichment
Vulnrichment•added 2026/06/11 2:30 p.m.•20 views

CVE-2026-11839 Arbitrary File Upload in Basarsoft's Rotaban

Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell to a Web Server. This issue affects Rotaban: from V2026.06.002 before V2026.06.003...

9.9CVSS5.8AI score0.00335EPSS
SaveExploits0References1
Cvelist
Cvelist•added 2026/06/11 2:30 p.m.•55 views

CVE-2026-11839 Arbitrary File Upload in Basarsoft's Rotaban

Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell to a Web Server. This issue affects Rotaban: from V2026.06.002 before V2026.06.003...

9.9CVSS0.00335EPSS
SaveExploits0References1
EUVD
EUVD•added 2026/06/11 2:30 p.m.•31 views

EUVD-2026-36249

Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell to a Web Server. This issue affects Rotaban: from V2026.06.002 before V2026.06.003...

9.9CVSS5.4AI score0.00335EPSS
SaveExploits0References1
osv_clsa
osv_clsa•added 2026/06/11 2:08 p.m.•11 views

CLSA-2026-1781186905 samba: Fix of CVE-2026-4408

CVE-2026-4408: escape shell metacharacters in the client-controlled username before substituting it into the "check password script" via %u, preventing remote command injection...

9.8CVSS8.2AI score0.02501EPSS
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages•added 2026/06/11 1:12 p.m.•33 views

Malicious code in optional-cpu-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4dbbb7dd9c604ef3e5782d477d4db7c04c50f7906b19af03e63a540e0a44166e On npm install, both the install and postinstall lifecycle scripts run node install.js, which requires lib/sync.js. That file hardcodes BASE =...

5.7AI score
SaveExploits0References2
osv_mal
osv_mal•added 2026/06/11 12:42 p.m.•29 views

MAL-2026-5643 Malicious code in parket-slot (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6dc700128da5b494d5325086ec183ce7c746d44d88dc7f609bfb9f2eab9fa072 On npm install, the package's postinstall script node test.js auto-executes a multi-stage attack against the installer's machine. It recursively scan...

5.6AI score
SaveExploits0References2
osv_clsa
osv_clsa•added 2026/06/11 12:35 p.m.•13 views

CLSA-2026-1781181291 Fix CVE(s): CVE-2026-4408

SECURITY UPDATE: shell injection in "check password script" via %u substitution. Samba did not sanitize or quote the username before substituting it into the configured check password script, allowing crafted usernames containing shell metacharacters to inject arbitrary commands executed by smbd....

9.8CVSS8AI score0.02501EPSS
SaveExploits0References2
osv_mal
osv_mal•added 2026/06/11 7:19 a.m.•34 views

MAL-2026-5613 Malicious code in internallib_v346 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f3f2c0990e02417fdf7012e6531393e81f786bb16019d0efdb03c049817f90 Package name targets an internal-only namespace and ships a reverse-shell payload. index.js line 5 unconditionally invokes exec'/bin/bash -c "bash -i...

5.5AI score
SaveExploits0References7
OSSF Malicious Packages
OSSF Malicious Packages•added 2026/06/11 7:19 a.m.•33 views

Malicious code in internallib_v346 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16f3f2c0990e02417fdf7012e6531393e81f786bb16019d0efdb03c049817f90 Package name targets an internal-only namespace and ships a reverse-shell payload. index.js line 5 unconditionally invokes exec'/bin/bash -c "bash -i...

5.4AI score
SaveExploits0References7
osv_mal
osv_mal•added 2026/06/11 6:17 a.m.•36 views

MAL-2026-5620 Malicious code in telebot-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d3c49bb558149b55f90b708ff47e24f6f856a88abb4b2ed477633c3df43d4e2 The package advertises itself as a configurable Telegram bot server README and.env.example reference TELEGRAMBOTTOKEN and ALLOWEDUSERIDS, but the cod...

6AI score
SaveExploits0References1
osv_mal
osv_mal•added 2026/06/11 5:00 a.m.•32 views

MAL-2026-5561 Malicious code in @bestlzk/sectest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cfce552ac72417ec7db2c48e0e13b1d060007167e82bd0f9b10799efe85e7f4 On npm install, postinstall.js collects platform, Node version, current working directory, and OS username, then POSTs them as JSON to...

6.4AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages•added 2026/06/11 5:00 a.m.•32 views

Malicious code in @bestlzk/sectest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0cfce552ac72417ec7db2c48e0e13b1d060007167e82bd0f9b10799efe85e7f4 On npm install, postinstall.js collects platform, Node version, current working directory, and OS username, then POSTs them as JSON to...

6.4AI score
SaveExploits0References1
osv_mal
osv_mal•added 2026/06/11 3:14 a.m.•79 views

MAL-2026-5549 Malicious code in @403name/fsevent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f86ca4502cc824c3684e8f1e08b088b974b4339829461b50d45e3fbc6f808eb On require, index.js runs an IIFE that gates to macOS, skips when CI or GITHUBACTIONS is set, waits 30-90 seconds, and writes a one-shot marker at...

6.3AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages•added 2026/06/11 3:14 a.m.•75 views

Malicious code in @403name/fsevent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f86ca4502cc824c3684e8f1e08b088b974b4339829461b50d45e3fbc6f808eb On require, index.js runs an IIFE that gates to macOS, skips when CI or GITHUBACTIONS is set, waits 30-90 seconds, and writes a one-shot marker at...

6.3AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages•added 2026/06/11 2:58 a.m.•32 views

Malicious code in solana-web3-community (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 202fa4daf22c4ecace931dfbdbeee6821fe42c14956d35c763c55051528dee12 Package masquerades as the official @solana/web3.js SDK name solana-web3-community, author 'Solana Labs Maintainers ', repository...

5.5AI score
SaveExploits0References8
osv_mal
osv_mal•added 2026/06/11 2:58 a.m.•61 views

MAL-2026-5560 Malicious code in solana-web3-community (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 202fa4daf22c4ecace931dfbdbeee6821fe42c14956d35c763c55051528dee12 Package masquerades as the official @solana/web3.js SDK name solana-web3-community, author 'Solana Labs Maintainers ', repository...

5.5AI score
SaveExploits0References8
OSSF Malicious Packages
OSSF Malicious Packages•added 2026/06/11 1:46 a.m.•34 views

Malicious code in acme-widget-layout-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff800752007d4e55ddc8172e04c8d75ac04d61b499cc58d97f016cd34d70d6c4 On import, src/acmewidgetlayoututils/init.py executes a textbook reverse-shell pattern: it opens a TCP socket, duplicates the socket file descriptor...

5.8AI score
SaveExploits0References4
osv_mal
osv_mal•added 2026/06/11 1:46 a.m.•37 views

MAL-2026-5545 Malicious code in acme-widget-layout-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff800752007d4e55ddc8172e04c8d75ac04d61b499cc58d97f016cd34d70d6c4 On import, src/acmewidgetlayoututils/init.py executes a textbook reverse-shell pattern: it opens a TCP socket, duplicates the socket file descriptor...

5.8AI score
SaveExploits0References4
osv_cleanstart
osv_cleanstart•added 2026/06/11 12:51 a.m.•39 views

CLEANSTART-2026-WA48911 authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users

Multiple security vulnerabilities affect the percona-server-mongodb-operator package. An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. See...

9.8CVSS6.3AI score0.0691EPSS
SaveExploits3References61
Positive Technologies
Positive Technologies•added 2026/06/11 12:00 a.m.•45 views

PT-2026-48670

Unrestricted upload of file with dangerous type vulnerability in Başarsoft Information Technologies Inc. Rotaban allows Upload a Web Shell to a Web Server. This issue affects Rotaban: from V2026.06.002 before V2026.06.003...

9.9CVSS5.4AI score0.00335EPSS
SaveExploits0References2
Rows per page
Query Builder