Lucene search
+L

13758 matches found

Cvelist
Cvelist
•added 2026/09/10 6:07 p.m.•41 views

CVE-2026-88035 Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...

5.7CVSS0.00141EPSS
SaveExploits0References1
MongoDB
MongoDB
•added 2026/09/10 6:07 p.m.•11 views

Heap buffer overflow via wrapped size check during SASL username canonicalization in MongoDB C Driver

A size check in the client-side authentication path of the MongoDB C Driver can wrap around, so an unusually large user-name value is accepted and copied past the end of a small buffer. A party able to set the driver's connection settings may cause the application that embeds the driver to...

5.7CVSS5.8AI score0.00141EPSS
SaveExploits0References1Affected Software1
OSV
OSV
•added 2026/09/10 2:48 p.m.•8 views

GO-2026-6424 SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers in github.com/siyuan-note/siyuan/kernel

SiYuan: Non-administrator responses from /api/system/getConf omit three secrets that the configuration-export path explicitly strips, disclosing the session-cookie signing key and the OS username to anonymous readers in github.com/siyuan-note/siyuan/kernel...

9.2CVSS5.7AI score0.00409EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/10 2:48 p.m.•7 views

GO-2026-6398 SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath in github.com/siyuan-note/siyuan/kernel...

6.9CVSS5.7AI score0.00325EPSS
SaveExploits0References4
OSV
OSV
•added 2026/09/10 9:45 a.m.•7 views

PYSEC-2026-3937 vLLM: Unauthenticated Internal Path and Username Disclosure via Validation Error Messages

Summary When the vLLM API receives a malformed request e.g., invalid JSON or missing required fields, FastAPI raises a Pydantic RequestValidationError. The validationexceptionhandler in vllm/entrypoints/openai/serverutils.py converts this exception to a string via strexc, which includes the...

5.3CVSS5.8AI score0.00419EPSS
SaveExploits0References8
OSV
OSV
•added 2026/09/10 9:44 a.m.•7 views

PYSEC-2026-3809 asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...

5.9CVSS6AI score0.00393EPSS
SaveExploits0References7
PyPA
PyPA
•added 2026/09/10 9:44 a.m.•7 views

asyncssh has an incomplete fix for CVE-2026-45309 — AuthorizedKeysFile %u still escapes the intended directory via a leading ~ (and weakly via ${ENV}) username substitution

Incomplete fix for CVE-2026-45309 GHSA-g794-3fmp-753h. The 2.23.0 guard that sanitises the SSH username before %u substitution in AuthorizedKeysFile blocks /, \ and .., but does not block a leading or $ENV, both of which are re-introduced by later expansion and reach the file open — defeating the...

8.2CVSS6AI score0.00592EPSS
SaveExploits1References7Affected Software1
NVD
NVD
•added 2026/09/10 9:17 a.m.•9 views

CVE-2026-88282

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

7.2CVSS0.0054EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/10 9:17 a.m.•8 views

CVE-2026-88273

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

7.2CVSS0.00705EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/10 9:17 a.m.•12 views

CVE-2026-88272

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...

7.2CVSS0.0054EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/10 8:23 a.m.•41 views

CVE-2026-88282 GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

7.2CVSS0.0054EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/10 8:23 a.m.•12 views

EUVD-2026-75316

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

7.2CVSS5.8AI score0.0054EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/10 8:23 a.m.•13 views

CVE-2026-88282 GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...

7.2CVSS5.8AI score0.0054EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/10 8:23 a.m.•16 views

CVE-2026-88282

GeoVision GV-LPC2211 (LPC series) V1.13 contains a stored command injection vulnerability in its FTP username field. An administrator who sets an FTP username containing shell metacharacters can trigger arbitrary root command execution during a subsequent FTP-account update operation. The vulnera...

7.2CVSS5.8AI score0.0054EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/09/10 8:20 a.m.•13 views

CVE-2026-88273 GV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

7.2CVSS6.2AI score0.00705EPSS
SaveExploits0References1
CVE
CVE
•added 2026/09/10 8:20 a.m.•18 views

CVE-2026-88273

GeoVision GV-LPC2211 (version V1.13 ) is affected by a command injection vulnerability in its PPPoE username configuration. An administrator-controlled PPPoE username value can escape a sourced shell configuration assignment , allowing the execution of arbitrary commands as root . The attack requ...

7.2CVSS6.2AI score0.00705EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/10 8:20 a.m.•44 views

CVE-2026-88273 GV-LPC2011/LPC2211 - PPPoE Username Shell-Configuration Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

7.2CVSS0.00705EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/10 8:20 a.m.•11 views

EUVD-2026-75307

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute arbitrary commands as root...

7.2CVSS6.2AI score0.00705EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/10 8:19 a.m.•44 views

CVE-2026-88272 GV-LPC2011/LPC2211 - Stored Administrator-Username Command Injection

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...

7.2CVSS0.0054EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/10 8:19 a.m.•16 views

EUVD-2026-75305

GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...

7.2CVSS5.8AI score0.0054EPSS
SaveExploits0References1
Rows per page
Query Builder