Lucene search
+L

64807 matches found

Nuclei
Nuclei
added yesterday22 views

Xerte Online Toolkits <= 3.15 - Remote Code Execution

Xerte Online Toolkits versions 3.15 and earlier expose the elFinder file manager connector at /editor/elfinder/php/connector.php without authentication CVE-2026-34413, because the access-control redirect for unauthenticated users does not call exit/die and execution continues server-side. This is...

9.8CVSS6AI score0.03575EPSS
SaveExploits2References6
Nuclei
Nuclei
added yesterday23 views

Gotenberg - Command Injection

Gotenberg 8.31.0 contains a command injection caused by lack of validation on JSON metadata keys in /forms/pdfengines/metadata/write endpoint, letting unauthenticated attackers execute OS commands, exploit requires crafted HTTP request. id: CVE-2026-42589 info: name: Gotenberg - Command Injection...

9.8CVSS8.7AI score0.03013EPSS
SaveExploits2References3
Nuclei
Nuclei
added yesterday31 views

YouPHPTube Encoder - Arbitrary File Write

Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube.The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack. id: CVE-2019-5128 info: name: YouPHPTube Encoder - Arbitrary...

10CVSS8.6AI score0.30174EPSS
SaveExploits1References1
Nuclei
Nuclei
added yesterday182 views

Camaleon CMS < 2.8.1 Arbitrary File Write to RCE

An arbitrary file write vulnerability accessible via the upload method of the MediaController allows authenticated users to write arbitrary files to any location on the web server Camaleon CMS is running on depending on the permissions of the underlying filesystem. E.g. This can lead to a remote...

9.9CVSS6.5AI score0.37358EPSS
SaveExploits2References5
Nuclei
Nuclei
added yesterday19 views

dash-uploader 0.1.0 - 0.7.0a2 - Unauthenticated Arbitrary File Write via Path Traversal

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a directory traversal vulnerability caused by improper handling in dashuploader/httprequesthandler.py components, letting remote attackers execute arbitrary code, exploit requires no special privileges. id: CVE-2026-38360 info: name:...

9.8CVSS9AI score0.05982EPSS
SaveExploits4References4
Nuclei
Nuclei
added yesterday18 views

LeadConnector < 3.0.22 - Unauthenticated Arbitrary Data Write

LeadConnector WordPress plugin 3.0.22 contains a broken access control caused by missing authorization in a REST route, letting unauthenticated attackers overwrite existing data remotely, exploit requires no authentication. id: CVE-2026-1890 info: name: LeadConnector 3.0.22 - Unauthenticated...

5.3CVSS5.2AI score0.00682EPSS
SaveExploits0References2
Nuclei
Nuclei
added yesterday29 views

esm.sh <= v136 - Arbitrary File Write via Path Traversal

esm.sh = 136 contains a path traversal caused by improper canonicalization of the X-Zone-Id HTTP header, letting attackers write files outside the intended storage directory, exploit requires crafted header input. id: CVE-2025-59342 info: name: esm.sh = v136 - Arbitrary File Write via Path...

6.9CVSS8.6AI score0.02829EPSS
SaveExploits2References3
Nuclei
Nuclei
added yesterday51 views

PyTorch TorchServe SSRF

TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken advantage of to compromise the integrity...

10CVSS8.1AI score0.35256EPSS
SaveExploits6References3
Nuclei
Nuclei
added yesterday6 views

JoomShaper Helix3 <=3.1.0 - Unauthenticated Arbitrary JSON File Write

JoomShaper Helix3 template framework versions 1.0 through 3.1.0 for Joomla expose an unauthenticated AJAX handler plgajaxhelix3 accessible via the Joomla comajax component. The onAjaxHelix3 plugin method processes dataaction=save requests without any authentication check or CSRF token validation...

7.5CVSS5.6AI score0.28307EPSS
SaveExploits6References3
OSV
OSV
added yesterday4 views

MINI-7P8J-CXXJ-MMC8

Bulletin has no description...

7.5CVSS5AI score0.0059EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added yesterday4 views

PT-2026-72891

DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse. preparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with atoisrc an...

5.6AI score
SaveExploits0References5
Positive Technologies
Positive Technologies
added yesterday10 views

PT-2026-72938

In the Linux kernel, the following vulnerability has been resolved: binfmt misc: use exe file deny write access for the interpreter clone For MISC FMT OPEN FILE entries load misc binary clones the registered interpreter file and denies write access to the clone via plain deny write access. The...

5.4AI score
SaveExploits0References4
Positive Technologies
Positive Technologies
added yesterday7 views

PT-2026-72951

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd usbmidi akai output snd usbmidi akai output computes its fill-loop bound buf end = ep-max transfer - MAX AKAI SYSEX LEN - 1; as a signed int, so a small device-advertised bulk-OUT max transfe...

5.6AI score
SaveExploits0References6
Positive Technologies
Positive Technologies
added yesterday7 views

PT-2026-72627

In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix writes pending leak on write request failures raid10 make request acquires a writes pending reference with md write start before dispatching write requests. Several failure paths in raid10 write request complete th...

5.3AI score0.00162EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added yesterday7 views

PT-2026-72319

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: reject short AUTH RECEIVE buffers nvmet execute auth receive trusts the AUTH RECEIVE allocation length after checking only that it is nonzero and matches the transfer length. In the SUCCESS1 and FAILURE1/default state...

5.9AI score0.0025EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added yesterday7 views

PT-2026-72214

In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwrit...

5.8AI score0.0021EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added yesterday6 views

PT-2026-72207

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in move data The loopback move data performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

5.3AI score0.002EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added yesterday5 views

PT-2026-72380

In the Linux kernel, the following vulnerability has been resolved: ntfs3: bound to move in indx insert into root before hdr insert head indx insert into root promotes a full resident $INDEX ROOT into $INDEX ALLOCATION and copies all non-last resident root entries into a newly allocated INDEX...

5.9AI score0.00215EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added yesterday4 views

PT-2026-72351

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL h transaction deref in ocfs2 assure trans credits BUG A direct write over unwritten extents can panic the kernel in ocfs2 assure trans credits when the journal aborts during DIO completion. The crash is a general...

5.5AI score0.0022EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added yesterday5 views

PT-2026-72553

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writethrough to use collection offload Fix writethrough write to set NETFS RREQ OFFLOAD COLLECTION on the request so that collection is processed asynchronously rather than only right at the end - and also so that...

5.4AI score0.00206EPSS
SaveExploits0References4
Rows per page
Query Builder