Lucene search
+L

8606 matches found

CVE
CVE
added 2026/06/15 6:54 p.m.41 views

CVE-2026-47835

In Spring AI Vector Stores, the vulnerability arises from improper handling of special characters that could lead to arbitrary query execution in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components are spring-ai-elasticsearch-store, spring-ai-opensearch-store, and spring-ai-gemfi...

8.6CVSS5.6AI score0.00304EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/06/15 6:54 p.m.67 views

CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

8.6CVSS0.00304EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/06/15 6:54 p.m.10 views

CVE-2026-47835 Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0...

8.6CVSS5.7AI score0.00304EPSS
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/15 5:23 p.m.17 views

Malicious code in flowcardano (npm)

flow/surf-lending DeFi cred-exfil campaign sibling c1655. Cardano-themed Sentinel-9.9.9 dependency-confusion squat. preinstall node index.js || true exfils env secrets mnemonic/private-key/token/blockfrost to raw C2 2.25.140.71:8443/surflending/npm-confusion same C2 as...

5.4AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/15 12:0 a.m.19 views

PT-2026-49314

Name of the Vulnerable Software and Affected Versions flatnotes version 5.5.4 Description An arbitrary file upload issue exists in the attachment handling component. This allows attackers to execute arbitrary code by uploading a specially crafted HTML or SVG file. Recommendations At the moment,...

9.8CVSS6.2AI score0.00441EPSS
SaveExploits0References3
CVE
CVE
added 2026/06/15 12:0 a.m.31 views

CVE-2026-39196

Datadog Vector v0.54.0 contains a SQL injection in the set_uri_query parameter of KeyPartitioner::partition. The vulnerability could allow an attacker to access sensitive database information via crafted SQL statements. Affected component: Vector’s data routing/partition logic (KeyPartitioner::pa...

9.8CVSS5.7AI score0.00321EPSS
SaveExploits0References1
VulnCheck KEV
VulnCheck KEV
added 2026/06/15 12:0 a.m.15 views

VulnCheck KEV: CVE-2026-39813

A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attacker to escalation of privilege via specially crafted HTTP requests...

9.8CVSS5.8AI score0.2306EPSS
SaveIn wildExploits2References5
CVE
CVE
added 2026/06/15 12:0 a.m.25 views

CVE-2026-39197

Summary: CVE-2026-39197 affects Datadog Vector v0.54.0 with a vulnerability in the /util/http/prelude.rs endpoint that can trigger a Denial of Service (DoS) via a crafted request or payload. The CVSS-derived metrics indicate NETWORK attack vector, low attack complexity, required privileges, and h...

6.5CVSS5.4AI score0.00289EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/15 12:0 a.m.34 views

CVE-2026-39196

Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the seturiquery parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive database information via crafted SQL statements...

0.00321EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/15 12:0 a.m.13 views

PT-2026-49303

Name of the Vulnerable Software and Affected Versions Vector version 0.54.0 Description An issue in the '/util/http/prelude.rs' endpoint allows attackers to cause a Denial of Service DoS, which is a condition where a service becomes unavailable to its intended users, by sending a crafted request ...

6.5CVSS5.2AI score0.00289EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/06/15 12:0 a.m.33 views

CVE-2026-39197

An issue in the /util/http/prelude.rs endpoint of Datadog, Inc Vector v0.54.0 allows attackers to cause a Denial of Service DoS via a crafted request or payload...

0.00289EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/15 12:0 a.m.35 views

CVE-2026-50873

An arbitrary file upload vulnerability in the attachment handling component of flatnotes v5.5.4 allows attackers to execute arbitrary code via uploading a crafted HTML or SVG file...

0.00441EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/15 12:0 a.m.25 views

PT-2026-49302

Name of the Vulnerable Software and Affected Versions Vector versions prior to 0.55.0 Description The ClickHouse sink contains a SQL/identifier injection flaw. The software escaped the table identifier but interpolated the database value raw into the INSERT statement, allowing a crafted database...

9.8CVSS5.4AI score0.00321EPSS
SaveExploits0References3
GithubExploit
GithubExploit
added 2026/06/14 9:6 p.m.129 views

Exploit for CVE-2022-30190

Explotación de Follina CVE-2022-30190 Follina CVE-2022-3...

9.3CVSS8AI score0.99374EPSS
SaveExploits63
Microsoft CVE
Microsoft CVE
added 2026/06/13 8:2 a.m.14 views

AES-OCB IV Ignored on EVP_Cipher() Path

...

7.5CVSS5.8AI score0.00603EPSS
SaveExploits0
SUSE CVE
SUSE CVE
added 2026/06/13 2:17 a.m.16 views

SUSE CVE-2026-45445

Issue summary: When an application drives an AES-OCB context through the public EVPCipher one-shot interface, the application-supplied initialisation vector IV is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV...

6.5CVSS5.7AI score0.00603EPSS
SaveExploits0References13
OSV
OSV
added 2026/06/12 8:48 p.m.8 views

CVE-2026-54396 MISP AuthKey edit endpoint allows authenticated user email enumeration

An information disclosure vulnerability exists in the MISP AuthKey edit functionality. When a validation error occurs during an AuthKey edit request, the user dropdown was populated using the attacker-controlled AuthKey.userid value from the submitted request data. An authenticated user with...

5.3CVSS6.1AI score
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/12 8:34 p.m.18 views

Malicious code in chalk-plus-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 08276c56353501373a202d28f6af6ee2a7c0b20d28a07d99c4c16309df46269c package.json declares postinstall=node lib/utils/index.js, which spawns a detached child process running lib/utils/smtp-connection/index.js. That...

5.9AI score
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/06/12 6:27 p.m.19 views

Budibase: Unvalidated VectorDB Host Parameter Enables SSRF

Summary The VectorDB configuration endpoint in Budibase accepts a host parameter that undergoes no validation against internal IP ranges, reserved hostnames, or URL schemes. Any authenticated user with builder-level access can supply an arbitrary host value such as 169.254.169.254 or localhost,...

5.3CVSS5.6AI score0.00226EPSS
SaveExploits0References3Affected Software1
EUVD
EUVD
added 2026/06/12 6:27 p.m.17 views

EUVD-2026-32605

Budibase: Unvalidated VectorDB Host Parameter Enables SSRF...

5.3CVSS5.2AI score0.00226EPSS
SaveExploits0References2
Rows per page
Query Builder