Lucene search
+L

8304 matches found

ATTACKERKB
ATTACKERKB
added 2026/07/20 11:32 p.m.5 views

CVE-2026-63728

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

8.1CVSS5.5AI score0.00145EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/20 11:32 p.m.39 views

CVE-2026-63728 Gitleaks Secret Exfiltration via Non-Hermetic Sprig Template Functions in Report Template Feature

Gitleaks prior to 8.30.1 contains a template injection vulnerability that allows attackers who can supply or influence report templates to read arbitrary environment variables and exfiltrate sensitive data by leveraging non-hermetic Sprig template functions. Attackers can craft malicious report...

8.1CVSS0.00145EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/20 10:20 p.m.10 views

GHSA-F4GW-2P7V-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NOPROXY rules. In Node.js applications that use HTTPPROXY or HTTPSPROXY together with NOPROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:/ can be routed...

6.9CVSS5.5AI score0.00291EPSS
SaveExploits0References8
NVD
NVD
added 2026/07/20 9:16 p.m.8 views

CVE-2026-44508

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-43618. Reason: This candidate is a duplicate of CVE-2026-43618. Notes: All CVE users should reference CVE-2026-43618 instead of this candidate...

0.00274EPSS
SaveExploits0
OSV
OSV
added 2026/07/20 8:45 p.m.5 views

BIT-NGINX-GATEWAY-2026-42533 NGINX Map directive and Regex matching vulnerability

A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and a string expression references the map's regex capture variables before referencing the map output variable. Alternatively, the same result could be achieved by using a non-cacheable variable i...

9.2CVSS6.6AI score0.03596EPSS
SaveExploits5References2
Debian CVE
Debian CVE
added 2026/07/20 8:30 p.m.8 views

CVE-2026-44508

Removed by vendor...

5.2AI score0.00274EPSS
SaveExploits0
CVE
CVE
added 2026/07/20 8:30 p.m.21 views

CVE-2026-44508

CVE-2026-44508 is rejected; this candidate is a duplicate of CVE-2026-43618 and should not be used.

5.7AI score0.00274EPSS
SaveExploits0
OSV
OSV
added 2026/07/20 5:53 p.m.6 views

MAL-2026-10927 Malicious code in roles-royce (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 318b93ddaafba751bab93b48efbef99f4eb45f143b019d7ff0f74735e434f378 rolesroyce/init.py invokes a hidden checkenv routine at import time that spawns a background thread harvesting installer secrets — SSH private keys...

5.8AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/20 9:12 a.m.24 views

Malicious code in paperclip-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793 No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No...

5.6AI score
SaveExploits0References3
OSV
OSV
added 2026/07/20 9:12 a.m.10 views

MAL-2026-10869 Malicious code in paperclip-ai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e26f6f66830ed0cc58e91483e1df3bc59e622f19078ae2dc88fa8d7f85933793 No install-time or import-time network I/O, credential access, dropper, silent-relay, or backdoor behavior was identified in this package version. No...

5.6AI score
SaveExploits0References3
OSV
OSV
added 2026/07/20 12:0 a.m.4 views

MAL-2026-10941 Malicious code in aftermath-finance (npm)

The aftermath-finance package was published to the npm registry by user 'jet0010001' maintainer email [email protected] as part of a dependency-confusion / reconnaissance campaign impersonating the Aftermath Finance SDK Aftermath Finance is a DeFi protocol on the Sui blockchain. The package...

5.7AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/20 12:0 a.m.7 views

PT-2026-61746

Name of the Vulnerable Software and Affected Versions Gitleaks versions prior to 8.30.1 Description A template injection issue exists where attackers who can supply or influence report templates can read arbitrary environment variables and exfiltrate sensitive data. This is achieved by leveraging...

8.1CVSS5.9AI score0.00145EPSS
SaveExploits0References10
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/20 12:0 a.m.15 views

Malicious code in zer0onetencent2 (npm)

The zer0onetencent2 package was published to the npm registry by user 't2423048543' maintainer email [email protected]. It is described as 'A simple date formatting utility' but ships no such functionality; index.js only exports a hello stub returning the package name, indicating a package...

5.7AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/19 3:40 p.m.32 views

CVE-2026-64174 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

0.00172EPSS
SaveExploits0References8
Cvelist
Cvelist
added 2026/07/19 3:40 p.m.31 views

CVE-2026-64092 batman-adv: tp_meter: fix tp_vars reference leak in receiver shutdown

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

0.0018EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/07/19 3:40 p.m.8 views

EUVD-2026-45777

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

5.4AI score0.0018EPSS
SaveExploits0References7
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/18 11:43 a.m.26 views

Malicious code in mlflow-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7192c53fc1e0b62e2c373a8a6beabfeb3777cae3aacfe23ca374eab1c2839a7 The package impersonates the MLflow project author 'MLflow Community' , homepage https://github.com/mlflow/mlflow but provides no MLflow UI...

6.7AI score
SaveExploits0References3
OSV
OSV
added 2026/07/18 11:43 a.m.9 views

MAL-2026-10779 Malicious code in mlflow-ui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7192c53fc1e0b62e2c373a8a6beabfeb3777cae3aacfe23ca374eab1c2839a7 The package impersonates the MLflow project author 'MLflow Community' , homepage https://github.com/mlflow/mlflow but provides no MLflow UI...

6.7AI score
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/07/18 12:0 a.m.9 views

Linux Distros Unpatched Vulnerability : CVE-2026-56740

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number...

7.5CVSS5.4AI score0.00504EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/17 10:17 p.m.4 views

DEBIAN-CVE-2026-56740

JLine is a Java library for handling console input. Prior to 3.30.14, 4.0.16, and 4.2.1, the JLine3 Telnet server remote-telnet module does not limit the number of environment variables a client may inject via the Telnet NEW-ENVIRON option, and TelnetIO.readNEVariables in TelnetIO.java:1127-1180...

7.5CVSS5.3AI score0.00504EPSS
SaveExploits0References1
Rows per page
Query Builder