CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

4412 matches found

vulnersOsv•added 2026/07/22 11:08 p.m.•16 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +936 more potentially affected by CVE-2026-64648 via next (>=16.0.0, <=16.2.10)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-64648 Source advisory:...

6CVSS5.8AI score0.00336EPSS

SaveExploits0

vulnersOsv•added 2026/07/22 11:06 p.m.•13 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +936 more potentially affected by CVE-2026-64647 via next (>=16.0.0, <=16.2.10)

6.3CVSS5.8AI score0.00351EPSS

SaveExploits0

vulnersOsv•added 2026/07/22 11:02 p.m.•17 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +936 more potentially affected by CVE-2026-64646 via next (>=16.0.0, <=16.2.10)

6.3CVSS5.8AI score0.00531EPSS

SaveExploits0

Patchstack•added 2026/07/22 11:02 p.m.•14 views

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

NPM: Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname vulnerability discovered by ? in WordPress Npm next versions = 12.0.0, 15.5.21...

8.3CVSS5.3AI score0.00837EPSS

SaveExploits0References6Affected Software1

vulnersOsv•added 2026/07/22 11:02 p.m.•13 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +936 more potentially affected by CVE-2026-64645 via next (>=16.0.0, <=16.2.10)

8.3CVSS5.8AI score0.00837EPSS

SaveExploits0

vulnersOsv•added 2026/07/22 11:02 p.m.•12 views

3d-effect-cinema (>=0.1.0, <=0.4.1), 47th (0.1.0) +240 more potentially affected by CVE-2026-64644 via next (>=15.5.0, <=15.5.20)

next NPM version =15.5.0, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2026-64644 Source advisory: SNYK:JS-NEXT-18231604...

6.3CVSS5.8AI score0.00675EPSS

SaveExploits0

vulnersOsv•added 2026/07/22 11:02 p.m.•11 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +936 more potentially affected by CVE-2026-64644 via next (>=16.0.0, <=16.2.10)

6.3CVSS5.8AI score0.00675EPSS

SaveExploits0

vulnersOsv•added 2026/07/22 11:02 p.m.•11 views

3d-effect-cinema (>=0.1.0, <=0.4.1), 47th (0.1.0) +240 more potentially affected by CVE-2026-64644 via next (>=15.5.0, <=15.5.20)

6.3CVSS5.8AI score0.00675EPSS

SaveExploits0

vulnersOsv•added 2026/07/22 10:59 p.m.•11 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +936 more potentially affected by CVE-2026-64641 via next (>=16.0.0, <=16.2.10)

8.2CVSS5.8AI score0.01375EPSS

SaveExploits0

Debian CVE•added 2026/07/22 5:06 p.m.•23 views

CVE-2026-64834

FFmpeg versions 0.6.3 through 8.1.2 contain an infinite loop vulnerability in the RTP/ASF demuxer within libavformat/rtpdecasf.c that allows remote attackers to cause denial of service by sending a crafted RTP/ASF stream. The rtpasffixheader function fails to validate a minimum chunksize when...

8.7CVSS5.4AI score0.00503EPSS

SaveExploits0

OSV•added 2026/07/22 2:17 p.m.•7 views

UBUNTU-CVE-2026-50248

In NLnet Labs Unbound 1.7.0 up to and including 1.25.1, when an auth/rpz zone has a configured primary hostname that resolves to BOGUS A/AAAA, it is still considered as a possible XFR endpoint. A malicious actor that can spoof the hostname's A/AAAA record no valid RRSIG required becomes the zone'...

6.5CVSS5.8AI score0.00128EPSS

SaveExploits0References3

OSV•added 2026/07/22 2:17 p.m.•8 views

UBUNTU-CVE-2026-50046

In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS DoT forwarded queries is tied to a struct's 'servicedquery' lifetime but also referenced by another struct 'waitingtcp'. When the owning struct is jostled out of the mesh while the DoT TCP stream is...

5.9CVSS5.8AI score0.00237EPSS

SaveExploits0References3

OSV•added 2026/07/22 2:17 p.m.•10 views

UBUNTU-CVE-2026-55708

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the contro...

3.1CVSS5.8AI score0.0015EPSS

SaveExploits0References3

OSV•added 2026/07/22 2:17 p.m.•17 views

UBUNTU-CVE-2026-32665

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, when downstream DNS-over-QUIC DoQ is enabled, the first two bidirectional streams on a new QUIC connection streamid 0 and 4 bypass the per-stream 'quic-size' gate entirely, and large input buffers are allocated later, after only the 2-byte...

7.5CVSS5.7AI score0.00285EPSS

SaveExploits0References3

OSV•added 2026/07/22 2:13 p.m.•9 views

CVE-2026-48029 libheif: heap OOB read in ImageItem_Grid::decode_grid_tile via irot-induced tile-coordinate underflow

libheif is a HEIF and AVIF file format decoder and encoder. Versions 1.19.0 through 1.21.2 have a heap OOB read in ImageItemGrid::decodegridtile via irot-induced tile-coordinate underflow. Version 1.22.0 fixes the issue...

7.1CVSS4.7AI score

SaveExploits0References4

Debian CVE•added 2026/07/22 2:13 p.m.•39 views

CVE-2026-48029

7.1CVSS4.7AI score0.00304EPSS

SaveExploits1

CVE•added 2026/07/22 2:02 p.m.•28 views

CVE-2026-2395

Technical details are not publicly available in the provided documents. No specifics on affected components, versions, or fix are included here. Monitor for updates from the vendor and security advisories.

9.8CVSS5.9AI score0.00468EPSS

SaveExploits0References1

Debian CVE•added 2026/07/22 1:10 p.m.•26 views

CVE-2026-56444

In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout discard-timeout 0' contrary to the suggested values, the discard-timeout branch during the serve expired logic drops an aged client reply without...

5.9CVSS5.3AI score0.00257EPSS

SaveExploits0

Debian CVE•added 2026/07/22 1:10 p.m.•30 views

CVE-2026-55991

In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion if compiled with assertions on and terminate the entire Unbound process using a single DNS-over-QUIC DoQ connection and one normal DNS query. This is caused by an erroneous...

5.9CVSS5.3AI score0.00237EPSS

SaveExploits0

attackerkb•added 2026/07/22 7:05 a.m.•19 views

CVE-2026-63047

Joomla Extension - joomdonation.com - Invoice data exfiltration via incorrect ACL check in Events Booking 5.0.0-5.8.1 - The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information...

7.5CVSS5.3AI score0.00394EPSS

SaveExploits0References2Affected Software1

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by