Lucene search
+L

4462 matches found

NVD
NVD
added 2026/07/27 5:16 p.m.14 views

CVE-2026-66390

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

6.1CVSS0.00357EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/27 10:57 a.m.61 views

CVE-2026-45112

CVE-2026-45112 affects Apache Thrift Java bindings, with an unbounded read/resource allocation vulnerability that can lead to denial of service. The issue involves versions 0.19.0 up to (but not including) 0.24.0. The recommended remediations are to upgrade to version 0.24.0, which fixes the issu...

7.5CVSS5.8AI score0.01075EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2026/07/27 8:01 a.m.43 views

CVE-2026-65765 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities...

6.9CVSS0.00313EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/27 5:48 a.m.18 views

BIT-OPENBAO-2025-54999 OpenBao: Timing Side-Channel in Userpass Auth Method

OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 through 2.3.1, when using OpenBao's userpass auth method, user enumeration was possible due to timing difference between non-existent users an...

3.7CVSS6AI score0.00193EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 2026/07/27 12:00 a.m.11 views

Atlassian Jira Service Management Data Center and Server 10.0.x / 10.1.1 / 10.2.x / 10.3.x < 10.3.7 / 10.4.x / 10.5.x / 10.6.x / 11.x < 11.3.8 (JSDSERVER-16652)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16652 advisory. - This High severity BASM Broken Authentication & Session Management vulnerability was introduced in...

8.1CVSS5.9AI score0.00133EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/25 12:00 p.m.30 views

RUSTSEC-2026-0216 Remote Denial of Service via malformed NIP‑44 v2 payload

The NIP-44 v2 decryption path in the nostr crate contains a reachable panic when processing a short or empty ciphertext. After the HMAC check passes and the ciphertext is decrypted via ChaCha20, the code reads a 2‑byte unpadded‑length prefix via buffer0..2 without first verifying that the decrypt...

7.5CVSS5.8AI score
SaveExploits0References3
vulnersOsv
vulnersOsv
added 2026/07/24 9:44 p.m.21 views

@budibase/cli (>=3.0.0, <=3.2.26), @budibase/pro (>=3.0.0, <=3.2.26) +2 more potentially affected by unknown CVE via @budibase/backend-core (>=3.0.0, <=3.2.26)

@budibase/backend-core NPM version =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.0.0, =3.2.26 Source cves: unknown CVE Source advisory: SNYK:JS-BUDIBASEBACKENDCORE-18308464...

5.4AI score
SaveExploits0
vulnersOsv
vulnersOsv
added 2026/07/24 9:43 p.m.14 views

budibase (>=0.0.3, <=0.0.31) potentially affected by unknown CVE via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: unknown CVE Source advisory: SNYK:JS-BUDIBASESERVER-18308465...

5.4AI score
SaveExploits0
vulnersOsv
vulnersOsv
added 2026/07/24 9:25 p.m.14 views

budibase (>=0.0.3, <=0.0.31) potentially affected by unknown CVE via @budibase/server (>=0.0.1, <=0.0.31)

@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: unknown CVE Source advisory: SNYK:JS-BUDIBASESERVER-18308470...

5.4AI score
SaveExploits0
Patchstack
Patchstack
added 2026/07/24 9:12 p.m.16 views

NPM: react-server-dom: Denial of Service in Server Functions

NPM: react-server-dom: Denial of Service in Server Functions vulnerability discovered by ? in WordPress Npm react-server-dom-turbopack versions = 19.0.0, 19.0.8...

7.5CVSS5.8AI score0.006EPSS
SaveExploits0References3Affected Software1
vulnersOsv
vulnersOsv
added 2026/07/24 4:22 p.m.13 views

@akemona-org/strapi-connector-mongoose (>=3.18.2, <=3.19.3), @albertoielpo/kk-cli (>=1.1.0, <=1.1.2) +30 more potentially affected by CVE-2026-73562 via mongoose (>=9.0.0, <=9.7.1)

mongoose NPM version =9.0.0, =3.18.2, =1.1.0, =1.0.0, =12.3.0, =11.0.36, =8.2.3, =0.2.29, =0.0.1, =11.7.0, =4.0.0, =2.0.0, =2.0.0, =0.4.1, =0.1.24, =0.7.0, =0.11.0 and more Source cves: CVE-2026-73562 Source advisory: OSV:GHSA-664H-WQGQ-64GW...

6.5CVSS5.7AI score0.00369EPSS
SaveExploits0
vulnersOsv
vulnersOsv
added 2026/07/24 2:07 p.m.12 views

actix-remote (0.1.0), agnostic (>=0.2.5, <=0.2.6) +272 more potentially affected by CVE-2026-25800 via quinn-proto (>=0.2.0, <=0.11.9)

quinn-proto CARGO version =0.2.0, =0.2.5, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.5.0, =2.0.0, =0.2.3, =0.2.11 and more Source cves: CVE-2026-25800 Source advisory: OSV:GHSA-4W2J-M93H-CJ5J...

7.5CVSS5.8AI score0.00609EPSS
SaveExploits0
Vulnrichment
Vulnrichment
added 2026/07/24 3:27 a.m.15 views

CVE-2026-11922 Rate-limit Bypass in zenml-io/zenml

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the...

6.5CVSS5.9AI score0.00179EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/24 12:00 a.m.28 views

PT-2026-67307

Name of the Vulnerable Software and Affected Versions better-auth versions 1.1.3 through 1.6.21 better-auth versions 1.7.0-beta.0 through 1.7.0-beta.9 Description A pre-account hijacking flaw allows account takeover when open email and password registration is enabled alongside magic-link or...

8.7CVSS5.5AI score0.00264EPSS
SaveExploits0References11
vulnersOsv
vulnersOsv
added 2026/07/23 7:36 p.m.13 views

@0xmike/web-kit (>=0.0.6, <=0.1.1), @acmekit/acmekit (>=2.13.1, <=2.13.94) +284 more potentially affected by CVE-2026-53668 via react-router-dom (>=6.30.2, <=6.30.4)

react-router-dom NPM version =6.30.2, =0.0.6, =2.13.1, =2.13.1, =2.13.1, =2.13.1, =1.4.0, =0.0.1, =1.2.0, =0.1.0, =0.0.6, =2.0.1, =4.1.0 - @automattic/data-stores 3.2.2 - @automattic/domain-search 1.1.0 - @automattic/jetpack-ai-calypso 2.1.0 and more Source cves: CVE-2026-53668 Source advisory:...

6.9CVSS5.8AI score0.0028EPSS
SaveExploits0
Patchstack
Patchstack
added 2026/07/23 7:34 p.m.12 views

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors() in React Router SSR Hydration

NPM: React Router: Arbitrary Constructor Injection via deserializeErrors in React Router SSR Hydration vulnerability discovered by ? in WordPress Npm react-router versions = 6.4.0, 7.18.0...

6.1CVSS5.4AI score0.00305EPSS
SaveExploits0References6Affected Software1
EUVD
EUVD
added 2026/07/23 7:00 p.m.21 views

EUVD-2026-48372

FFmpeg versions 3.4 through 8.1.2 contain an out-of-bounds write vulnerability in the vffloodfill video filter that allows attackers to corrupt heap memory by supplying a dynamically sized video stream with filtergraph reinitialization disabled via -reinitfilter 0. When configinput allocates the...

7.8CVSS6.2AI score0.00125EPSS
SaveExploits0References3
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/23 4:44 p.m.20 views

Security Bulletin: Multiple vulnerabilities in IBM Desktop App

Summary Multiple vulnerabilities were addressed in IBM Aspera Desktop App v1.1.0. Vulnerability Details CVEID:CVE-2026-11980 DESCRIPTION: IBM Aspera Desktop App can allow arbitrary code execution by loading DLL files at start-up. CWE:CWE-242: Use of Inherently Dangerous Function CVSS Source: IBM...

9.3CVSS6.3AI score0.00304EPSS
SaveExploits0Affected Software4
Cvelist
Cvelist
added 2026/07/23 4:38 p.m.43 views

CVE-2026-65761 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions...

9.3CVSS0.00928EPSS
SaveExploits2References2
NVD
NVD
added 2026/07/23 12:18 p.m.12 views

CVE-2026-65475

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30...

6.5CVSS0.00224EPSS
SaveExploits0References1
Rows per page
Query Builder