Lucene search
+L

554829 matches found

CVE
CVE
added 4 days ago38 views

CVE-2026-58244

Technical details (affected components, root cause, exploitability, and remediation) are not publicly available in the provided documents. Monitor for updates.

4.3CVSS5.3AI score0.00168EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
added 4 days ago7 views

SUSE CVE-2026-6993

A security flaw has been discovered in go-kratos kratos up to 2.9.2. This impacts the function NewServer of the file transport/http/server.go of the component http.DefaultServeMux Fallback Handler. The manipulation results in unintended intermediary. The attack may be launched remotely. The explo...

6.9CVSS5.2AI score0.00315EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
added 4 days ago6 views

SUSE CVE-2026-34783

Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal vulnerability in Ferret's IO::FS::WRITE standard library function allows a malicious website to write arbitrary files to the filesystem of the machine running Ferret. When an operator scrapes a...

8.1CVSS6.3AI score0.00514EPSS
SaveExploits1References2
SUSE CVE
SUSE CVE
added 4 days ago7 views

SUSE CVE-2026-52846

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, Caddy's stripHTML template function cannot reliably remove all HTML tags from input strings. Certain malformed HTML, such as img src=x onerror=alert, can bypass the tag-stripping logic, potentially leaving dangerous...

4.2CVSS5.3AI score0.00189EPSS
SaveExploits1References2
Positive Technologies
Positive Technologies
added 4 days ago3 views

PT-2026-70167

n8n before 2.31.5 and before 2.32.1 contain a sandbox escape vulnerability in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the...

8.7CVSS5.6AI score0.00371EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago3 views

PT-2026-70929

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode pointer inplace function within cJSON Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape...

8.7CVSS5.3AI score0.00258EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago3 views

PT-2026-70224

Name of the Vulnerable Software and Affected Versions Tesseract versions prior to 5.5.3 Description A heap out-of-bounds write can occur during OCR recognition when a crafted .traineddata LSTM model component is loaded through the deserializer. This happens because an unchecked signed integer...

6.8CVSS5.2AI score0.00126EPSS
SaveExploits0References6
VulnCheck KEV
VulnCheck KEV
added 4 days ago7 views

VulnCheck KEV: CVE-2026-33497

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the downloadprofilepicture function of the /profilepictures/foldername/filename endpoint, the foldername and filename parameters are not strictly filtered, which allows the secretkey to be re...

8.7CVSS5.2AI score0.19584EPSS
SaveIn wildExploits1References2
Positive Technologies
Positive Technologies
added 4 days ago4 views

PT-2026-70199

Craft CMS versions = 5.0.0-RC1 before 5.10.7 and = 4.0.0-RC1 before 4.18.3 contain a remote code execution vulnerability in the Twig sandbox mechanism. Because Craft marks the ElementInterface as safe via the AllowedInSandbox attribute and the sandbox allowlisting extends to the entire class...

8.8CVSS6.4AI score0.00539EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago2 views

PT-2026-70197

Craft CMS 5.0.0-RC1 before 5.10.6 and 4.0.0-RC1 before 4.18.2 contain an arbitrary file read vulnerability. The create Twig function restricts class instantiation using a 5-entry blocklist that does not include SplFileObject, allowing an authenticated administrator with allowAdminChanges=true to...

8.7CVSS5.5AI score0.00218EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago3 views

PT-2026-70148

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file pa...

6.5CVSS5.4AI score0.00325EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago1 views

PT-2026-70150

Name of the Vulnerable Software and Affected Versions Pinry versions prior to 2.1.14 Description A server-side request forgery SSRF issue exists in the pin-from-URL feature. This occurs because the application passes a user-supplied URL directly to the requests.get function without validating the...

7.5CVSS5.5AI score0.00283EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago1 views

PT-2026-70261

Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access...

8.3CVSS6.1AI score0.00388EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 4 days ago1 views

PT-2026-70101

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description The software improperly handles conversion-table values within the search highlighting feature. The highlight function either returns underlying text directly when no search query is...

5.1CVSS5.2AI score0.00247EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago1 views

PT-2026-70099

Name of the Vulnerable Software and Affected Versions cti-transmute affected versions not specified Description An issue exists where a tag's icon value can be stored and subsequently interpolated into HTML using Vue's v-html directive. The mapIcon function previously constructed an HTML string...

5.1CVSS5.4AI score0.00234EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago2 views

PT-2026-70140

Name of the Vulnerable Software and Affected Versions Ghost Foundation Ghost versions 5.x Description An issue with broken access control allows authenticated users with the Author role to delete posts belonging to other users. This occurs because the permissible function in the post model lacks ...

8.1CVSS5.2AI score0.0021EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago1 views

PT-2026-70873

telegram-search contains a stored cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript in victims' browsers by sending crafted messages containing unsanitized HTML to a shared Telegram group. The highlightKeyword function in MessageList.vue passes raw...

8.7CVSS5.6AI score0.00364EPSS
SaveExploits0References6
BDU FSTEC
BDU FSTEC
added 4 days ago3 views

The vulnerability of the formCertListInfo() function in the /goform/CertListInfo file of the Tenda CH22 router microprogramming system, which allows a hacker to execute arbitrary commands.

The vulnerability of the formCertListInfo function in the /goform/CertListInfo file of the Tenda CH22 router microsystem is related to the failure to take measures to neutralize special elements. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

9CVSS8.4AI score0.02216EPSS
SaveExploits0References2Affected Software1
Positive Technologies
Positive Technologies
added 4 days ago3 views

PT-2026-70930

libgit2 versions v0.27.0 through v1.9.0 built with the libssh2 SSH backend USE SSH=libssh2 contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as...

9.6CVSS5.9AI score0.00859EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 4 days ago3 views

PT-2026-70902

CivetWeb commit 4a4f0c95 contains a heap and stack buffer overflow vulnerability in the read websocket function that allows unauthenticated remote attackers to corrupt memory by sending compressed WebSocket frames when both USE ZLIB and MG EXPERIMENTAL INTERFACES are defined. Attackers can...

8.3CVSS5.8AI score0.00467EPSS
SaveExploits0References3
Rows per page
Query Builder