Lucene search
+L

591335 matches found

Cvelist
Cvelist
added 5 days ago26 views

CVE-2026-71381 Adobe Genuine Software Integrity Service | CWE-863 Incorrect Authorization

Adobe Genuine Software Integrity Service was affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could have leveraged this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue...

4CVSS0.00158EPSS
SaveExploits0References1
CVE
CVE
added 5 days ago55 views

CVE-2026-71381

The CVE-2026-71381 entry concerns the Adobe Genuine Software Integrity Service and an Incorrect Authorization flaw that could bypass security features, enabling an attacker with local access to obtain unauthorized limited write capabilities. The advisory notes no user interaction is required, whi...

4CVSS5.4AI score0.00158EPSS
SaveExploits0References1
EUVD
EUVD
added 5 days ago11 views

EUVD-2026-54650

Adobe Genuine Software Integrity Service was affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could have leveraged this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue...

4CVSS5.4AI score0.00158EPSS
SaveExploits0References1
OSV
OSV
added 5 days ago16 views

CVE-2026-47663 Pathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutation

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...

8.7CVSS5.4AI score
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 5 days ago8 views

CVE-2026-47662

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's typed CRUD/search/batch FHIR surface allows an authenticated caller with only coarse operation authorities to act on...

8.7CVSS5.3AI score0.00239EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 5 days ago10 views

CVE-2026-61808

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

9.8CVSS0.00345EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago10 views

CVE-2026-48039

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.109, AuthInjectionMiddleware.dispatch at httpauthintegration.py:272 unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 40...

9.1CVSS0.00344EPSS
SaveExploits0References3
NVD
NVD
added 5 days ago11 views

CVE-2026-19012

Consul Community Edition and Consul Enterprise 1.18.0 through 2.0.2 are vulnerable to an authenticated denial of service in the Enterprise-to-Community Edition downgrade path that may allow an authorized caller to crash the Consul server. A caller with config-entry write permission can submit a...

5.3CVSS0.00245EPSS
SaveExploits0References1
OSV
OSV
added 5 days ago14 views

CVE-2026-61808 LightRAG: Missing Authentication for Critical API Functions in Default Configuration

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

9.8CVSS5.5AI score
SaveExploits0References4
Cvelist
Cvelist
added 5 days ago28 views

CVE-2026-61808 LightRAG: Missing Authentication for Critical API Functions in Default Configuration

LightRAG provides simple and fast retrieval-augmented generation. Through version 1.5.4, the LightRAG API server binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modi...

9.8CVSS0.00345EPSS
SaveExploits0References2
CVE
CVE
added 5 days ago57 views

CVE-2026-61808

CVE-2026-61808 affects LightRAG up to version 1.5.4, where the API server binds to all network interfaces with authentication disabled by default. This allows an unauthenticated network attacker to read indexed documents, upload or delete documents, modify the knowledge graph, cancel pipelines, c...

9.8CVSS5.4AI score0.00345EPSS
SaveExploits0References2
Nuclei
Nuclei
added 5 days ago187 views

Nacos <1.4.1 - Authentication Bypass

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

8.6CVSS7.3AI score0.65498EPSS
SaveExploits2References5
Nuclei
Nuclei
added 5 days ago776 views

aiohttp - Directory Traversal

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. When using aiohttp as a web server and configuring static routes, it is necessary to specify the root path for static files. Additionally, the option 'followsymlinks' can be used to determine whether to follow symboli...

7.5CVSS6.5AI score0.76875EPSS
SaveExploits17References3
Nuclei
Nuclei
added 5 days ago96 views

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

10CVSS7.5AI score0.59259EPSS
SaveExploits1References5
Nuclei
Nuclei
added 5 days ago27 views

FreePBX >= 17.0.2.36 && < 17.0.3 - Authenticated Command Injection

FreePBX Endpoint Manager 17.0.2.36 to = 17.0.2.36 && 17.0.3 - Authenticated Command Injection author: th3y severity: critical description: | FreePBX Endpoint Manager 17.0.2.36 to 17.0.3 contains a command injection caused by improper sanitization in filestore module's testconnection checksshconne...

8.6CVSS7.7AI score0.84618EPSS
SaveExploits4References3
Nuclei
Nuclei
added 5 days ago46 views

Laravel Livewire v3 - Remote Command Execution

Livewire v3 Laravel contains a vulnerability in its component hydration/update mechanism that can be exploited to reach remote command execution RCE without authentication under certain conditions. id: CVE-2025-54068 info: name: Laravel Livewire v3 - Remote Command Execution author: flame-11...

9.8CVSS9.2AI score0.95805EPSS
SaveExploits5References5
Nuclei
Nuclei
added 5 days ago42 views

Mitel MiCollab <= 9.8.0.33 - SQL Injection

A vulnerability in NuPoint Messenger NPM of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. A successful exploit could allow an attacker to access sensitive information and execute arbitrary...

9.8CVSS8.9AI score0.9811EPSS
SaveExploits3References2
Nuclei
Nuclei
added 5 days ago87 views

Zoho ManageEngine OpManager - SQL Injection

Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or conduct a SQL...

7.5CVSS7.7AI score0.66347EPSS
SaveExploits1References2
Nuclei
Nuclei
added 5 days ago30 views

Sophos Firewall <= 19.0 MR1 - Remote Code Execution

Sophos Firewall version v19.0 MR1 and older is vulnerable to code injection in the User Portal and Webadmin, allowing a remote unauthenticated attacker to execute arbitrary code. id: CVE-2022-3236 info: name: Sophos Firewall = 19.0 MR1 - Remote Code Execution author: daffainfo severity: critical...

9.8CVSS9.3AI score0.98905EPSS
SaveExploits0References2
Nuclei
Nuclei
added 5 days ago22 views

OpenCATS - Command Injection

OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard. id: CVE-2026-277...

9.2CVSS5.6AI score0.34629EPSS
SaveExploits2References4
Rows per page
Query Builder