Lucene search
+L

588587 matches found

CVE
CVE
added yesterday25 views

CVE-2026-53976

OpenChamber 1.11.7 suffers a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw. An unauthenticated remote attacker can supply the allowOutsideWorkspace=true query parameter with an absolute path, bypassing the workspace boundary check in resolv...

9.3CVSS5.7AI score
SaveExploits0References3
RedhatCVE
RedhatCVE
added yesterday5 views

CVE-2026-58043

A flaw in the Node.js Permission Model allows attackers to bypass --permission restrictions, enabling unauthorized read or write access to files and directories. Mitigation Avoid enabling the Node.js Permission Model by not using the --permission flag when starting Node.js applications. This...

7.5CVSS7.2AI score0.0014EPSS
SaveExploits0References4
Cvelist
Cvelist
added yesterday18 views

CVE-2026-15246 RealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass

The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capability, before granting a paid membership package, allowing any authenticated user such as a Subscriber to obtain paid membership packages...

4.3CVSS
SaveExploits0References1
NVD
NVD
added yesterday7 views

CVE-2026-18501

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

6.4CVSS
SaveExploits0References2
NVD
NVD
added yesterday8 views

CVE-2026-16731

OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

9.5CVSS
SaveExploits0References1
NVD
NVD
added yesterday8 views

CVE-2026-16315

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

9.4CVSS
SaveExploits0References1
EUVD
EUVD
added yesterday6 views

EUVD-2026-53933

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes datasocket and filefd descriptors while worker threads concurrently...

8.2CVSS5.5AI score
SaveExploits0References2
Cvelist
Cvelist
added yesterday20 views

CVE-2026-70637 LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes datasocket and filefd descriptors while worker threads concurrently...

8.2CVSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added yesterday6 views

CVE-2026-70637

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes datasocket and filefd descriptors while worker threads concurrently...

8.2CVSS5.5AI score
SaveExploits0References3
CVE
CVE
added yesterday14 views

CVE-2026-70637

LightFTP 2.4 contains data race vulnerabilities in ftpserv.c allowing anonymous attackers to trigger undefined behavior by issuing LIST followed by ABOR without authentication. The control thread may close data_socket and file_fd descriptors while worker threads concurrently access the same field...

8.2CVSS5.5AI score
SaveExploits0References2
Microsoft CVE
Microsoft CVE
added yesterday6 views

Azure SQL Database Elevation of Privilege Vulnerability

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.7AI score
SaveExploits0
OSV
OSV
added yesterday6 views

MAL-2026-13424 Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

5.5AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added yesterday7 views

Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

5.5AI score
SaveExploits0References5
EUVD
EUVD
added yesterday6 views

EUVD-2026-53931

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

9.1CVSS5.6AI score
SaveExploits0References1
EUVD
EUVD
added yesterday7 views

EUVD-2026-53930

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

9.8CVSS6.4AI score
SaveExploits0References1
Cvelist
Cvelist
added yesterday20 views

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

9.8CVSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday4 views

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the...

9.8CVSS6.4AI score
SaveExploits0References2
CVE
CVE
added yesterday14 views

CVE-2026-67261

Dell Virtual Storage Integrator for VMware vSphere Client (VSI) before version 10.11.1.0 contains an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could execute arbitrary OS commands on the VSI host with root privileges, potentially leading to full sy...

9.8CVSS6.4AI score
SaveExploits0References1
Cvelist
Cvelist
added yesterday19 views

CVE-2026-64993

Dell RVTools versions prior to 4.8.1, contains an improper certificate validation vulnerability in the collector. A remote unauthenticated attacker could potentially exploit this vulnerability leading to loss of confidentiality and integrity...

6.8CVSS
SaveExploits0References1
EUVD
EUVD
added yesterday6 views

EUVD-2026-53926

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

6.4CVSS5.7AI score
SaveExploits0References2
Rows per page
Query Builder