Lucene search
+L

55166 matches found

CVE
CVE
added 2026/09/02 3:40 p.m.16 views

CVE-2026-84651

Jenkins 2.579 and earlier (LTS 2.568.2 and earlier) contain an unsafe deserialization flaw in the REST API and CLI endpoints used to update agent configuration. An attacker holding Agent/Configure permission on one agent can specify a different agent's name in the submitted XML, overwriting that ...

6.3CVSS5.9AI score0.00208EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 3:40 p.m.34 views

CVE-2026-84651

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a submitted configuration from overwriting a different agent by specifying that agent's name in the submitted XML document, allowing attackers with Agent/Configure...

0.00208EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/02 3:40 p.m.33 views

CVE-2026-84646

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

0.00243EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/02 3:40 p.m.16 views

CVE-2026-84646

Jenkins (versions 2.579 and earlier, LTS 2.568.2 and earlier) is affected by a lack of type restriction in XML deserialization , allowing an attacker with Overall/Read permission to create user objects by submitting crafted XML. The root cause is that user objects can appear as nested field value...

4.3CVSS5.9AI score0.00243EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/02 3:40 p.m.7 views

EUVD-2026-70112

In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, allowing attackers with Overall/Read permission to create user objects by submitting crafted XML...

4.3CVSS5.9AI score0.00243EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/02 3:18 p.m.6 views

NPM: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

NPM: xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

6.3CVSS5.9AI score0.00355EPSS
SaveExploits0References9Affected Software1
Github Security Blog
Github Security Blog
added 2026/09/02 3:18 p.m.9 views

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

Summary An EntityReference node can be created with an invalid, attacker-controlled name through Document.createEntityReferencename. When this node is serialized directly with: js serializer.serializeToStringref, requireWellFormed: true the invalid nodeName is emitted into the serialized XML...

6.3CVSS5.8AI score0.00355EPSS
SaveExploits0References9Affected Software2
EUVD
EUVD
added 2026/09/02 3:18 p.m.9 views

EUVD-2026-69222

xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization...

6.3CVSS5.8AI score0.00355EPSS
SaveExploits0References8
OSV
OSV
added 2026/09/02 3:18 p.m.6 views

GHSA-6GMQ-8VP8-GCM6 xmldom: XML fragment injection via invalid EntityReference.nodeName during requireWellFormed serialization

Summary An EntityReference node can be created with an invalid, attacker-controlled name through Document.createEntityReferencename. When this node is serialized directly with: js serializer.serializeToStringref, requireWellFormed: true the invalid nodeName is emitted into the serialized XML...

6.3CVSS5.8AI score0.00355EPSS
SaveExploits0References9
Kitploit
Kitploit
added 2026/09/02 2:58 p.m.5 views

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 Una herramienta de explotación para probar vulnerabilidades de Ejecución Remota de Código RCE en el plugin de WordPress WPCode Lite Insert Headers and Footers v2.3.5. Esta vulnerabilidad se origina al registrar el Tipo de Contenido Personalizado CPT wpcode sin definir un...

8.8CVSS5.9AI score0.01862EPSS
SaveExploits2
RedhatCVE
RedhatCVE
added 2026/09/02 2:34 p.m.9 views

CVE-2026-83619

A flaw was found in xmldom, a JavaScript module used for processing XML documents. A remote attacker could exploit a vulnerability in the XML parser by submitting a specially crafted XML input. This could lead to a Denial of Service DoS, causing the affected system to become unresponsive by...

8.7CVSS5.9AI score0.00301EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/02 2:34 p.m.10 views

EUVD-2026-67073

NLTK: Quadratic CPU Exhaustion in XMLCorpusView.readxmlfragment...

6.3CVSS5.8AI score0.00222EPSS
SaveExploits0References5
OSV
OSV
added 2026/09/02 2:34 p.m.7 views

GHSA-VP2X-QP44-57V7 NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...

6.3CVSS6AI score0.00222EPSS
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2026/09/02 2:34 p.m.10 views

NLTK: Quadratic CPU Exhaustion in `XMLCorpusView._read_xml_fragment()`

Summary XMLCorpusView.readxmlfragment reads a corpus file in 1 KiB blocks, appending each block to a growing fragment string, then calls VALIDXMLRE.matchfragment on the full accumulated buffer every iteration. Because each iteration rescans the entire accumulated fragment, the total amount of wor...

6.3CVSS6AI score0.00222EPSS
SaveExploits0References6Affected Software1
RedHat Linux
RedHat Linux
added 2026/09/02 2:24 p.m.6 views

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

7.5CVSS6AI score0.00568EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/09/02 12:25 p.m.6 views

encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue

A flaw was found in the encoding/xml package of Go. The DecodeElement function failed to correctly track recursion depth, which could lead to stack exhaustion. A remote attacker could exploit this vulnerability by providing a specially crafted XML input, resulting in a Denial of Service DoS for t...

7.5CVSS6AI score0.00568EPSS
SaveExploits0References8
Kitploit
Kitploit
added 2026/09/02 11:53 a.m.5 views

CVE-2014-0195

XML-RPC WordPress Brute-Force Exploit Script This repository contains a Python-based proof of concept PoC for brute-forcing login credentials on WordPress instances vulnerable to CVE-2014-0195, where the XML-RPC system.multicall function can be exploited to attempt multiple login requests in a...

6.8CVSS7.1AI score0.99977EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/02 10:27 a.m.6 views

CVE-2020-4463

IBM Maximo Asset Management es vulnerable a la divulgación de información mediante la vulnerabilidad XXE CVE-2020-4463 IBM Maximo Asset Management es vulnerable a un ataque de inyección de entidades externas XML XXE al procesar datos XML. Un atacante remoto podría explotar esta vulnerabilidad par...

8.2CVSS7.6AI score0.3159EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/02 10:24 a.m.4 views

CVE-2020-2555

EXP prueba...

9.8CVSS8.1AI score0.97116EPSS
SaveExploits26
Kitploit
Kitploit
added 2026/09/02 10:20 a.m.5 views

CVE-2022-0219

CVE-2022-0219 Jadx es vulnerable a una restricción inadecuada de entidades externas XML CWE-611 al exportar a gradle un archivo APK malicioso mediante la opción -e que contenga un AndroidManifest.xml / strings.xml manipulado. Puede provocar la divulgación de archivos locales cuando se utiliza des...

5.5CVSS6AI score0.01054EPSS
SaveExploits1References1
Rows per page
Query Builder