7604 matches found
PT-2026-50065
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Universal Work Queue versions 12.2.3 through 12.2.15 Description An issue exists in the Work Provider Site Level Administration component of the Oracle Universal Work Queue. A low privileged attacker with network...
CVE-2026-52718
creationtimestamp| type| source ---|---|--- 2026-06-15 21:02:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moe6n7ygzu2v...
GHSA-WQP7-X3PW-XC5R Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Summary When serving static files on Windows, StaticFiles resolves the requested path with os.path.realpath. If a UNC path such as \attacker.com\share reaches the resolver, realpath causes the process to open a connection to the remote host over SMB port 445. This is a server-side request forgery...
CVE-2026-12210
A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may b...
CVE-2026-12210 universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery
A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may b...
CVE-2026-12210
CVE-2026-12210 affects the universal-tool-calling-protocol project, specifically the python-utcp 1.1.0 release, with a vulnerability in the utcp-gql/utcp-websocket component that enables server-side request forgery. The description notes a remote, public exploit and a lack of vendor response. The...
EUVD-2026-36684
A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may b...
PT-2026-49172
Name of the Vulnerable Software and Affected Versions python-utcp version 1.1.0 Description A server-side request forgery SSRF exists in the utcp-gql/utcp-websocket component of the universal-tool-calling-protocol. This issue allows a remote attacker to initiate a manipulation that results in the...
POC_cve_2026_35273
POCcve202635273 Universal Unauthenticated RCE via PeopleSof...
GHSA-8HG8-63C5-GWMX
creationtimestamp| type| source ---|---|--- 2026-06-12 16:00:32+00:00| seen| https://bsky.app/profile/euvd-bot.bsky.social/post/3mo44dsnzdc2y...
CVE-2026-8694
Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints...
CVE-2026-8694 Improper access control on the API documentation endpoint in PowerShell Universal
Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints...
CVE-2026-8694
CVE-2026-8694 involves an improper access control flaw in Devolutions PowerShell Universal up to version 2026.1.7, where an unauthenticated remote attacker can obtain the OpenAPI specification of user-defined REST endpoints. The affected component is the OpenAPI/REST endpoint documentation expose...
CVE-2026-8694 Improper access control on the API documentation endpoint in PowerShell Universal
Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints...
CVE-2026-49347
creationtimestamp| type| source ---|---|--- 2026-06-12 13:36:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo3ud4luzf2r...
CVE-2026-48612
creationtimestamp| type| source ---|---|--- 2026-06-12 05:00:18+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mo2xh6tipn24 2026-06-12 05:19:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mo2yjlei6u2g 2026-07-04 09:29:28+00:00| seen|...
PT-2026-48887
Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints...
CVE-2026-45599
Use after free in Universal Plug and Play upnp.dll allows an unauthorized attacker to execute code over a network...