Lucene search
+L

90012 matches found

EUVD
EUVD
added 2026/07/16 12:31 a.m.12 views

EUVD-2026-44843

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

9.1CVSS6.2AI score0.00224EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2026/07/16 12:0 a.m.12 views

CVE-2026-47089

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. This action should have been restricted ...

4.3CVSS6.1AI score0.00178EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/16 12:0 a.m.19 views

PT-2026-60597

Name of the Vulnerable Software and Affected Versions Windows Admin Center affected versions not specified Description Improper neutralization of input during web page generation leads to a cross-site scripting XSS issue. This allows an unauthorized attacker to perform spoofing over a network...

6.1CVSS4.6AI score0.00235EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/16 12:0 a.m.18 views

PT-2026-60557

Name of the Vulnerable Software and Affected Versions cyrus-imapd versions prior to 3.12.3 Description An authenticated user can access sensitive information by calling the IMAP LISTRIGHTS command against any named mailbox. This allows the user to identify which principals have specific access...

4.3CVSS5.2AI score0.00178EPSS
SaveExploits0References23
Positive Technologies
Positive Technologies
added 2026/07/16 12:0 a.m.19 views

PT-2026-60698

Name of the Vulnerable Software and Affected Versions Pheditor versions 2.0.1 through 2.0.5 Description Pheditor contains a hardcoded default password admin stored as a SHA-512 hash in the pheditor.php file. The application lacks a mechanism to force a password change upon the first login. An...

9.8CVSS6.3AI score0.00603EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/16 12:0 a.m.19 views

PT-2026-60552

Name of the Vulnerable Software and Affected Versions cyrus-imapd versions prior to 3.12.3 Description An issue exists where the LOCALDELETE IMAP command bypasses Access Control List ACL checks. This allows an authenticated user without administrative privileges to execute the LOCALDELETE command...

6.5CVSS5.4AI score0.00214EPSS
SaveExploits0References23
Debian CVE
Debian CVE
added 2026/07/16 12:0 a.m.8 views

CVE-2026-47089

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMAP LISTRIGHTS against any mailbox they could name and learn what principals had what access to it. This action should have been restricted ...

4.3CVSS5.4AI score0.00178EPSS
SaveExploits0
Tenable Nessus
Tenable Nessus
added 2026/07/16 12:0 a.m.23 views

Linux Distros Unpatched Vulnerability : CVE-2026-8384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected:...

5.3CVSS5.3AI score0.00228EPSS
SaveExploits1References4
Debian CVE
Debian CVE
added 2026/07/16 12:0 a.m.8 views

CVE-2026-47084

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions...

6.5CVSS5.3AI score0.00214EPSS
SaveExploits0
NVD
NVD
added 2026/07/15 10:17 p.m.13 views

CVE-2026-55445

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite'/open/', '/api/$1' rewrites the whitelisted /open/ path after JWT...

9.3CVSS0.00404EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/15 10:17 p.m.16 views

CVE-2026-54458

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page th...

9.6CVSS0.00303EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/15 10:17 p.m.12 views

CVE-2026-53444

Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidcserver.js, server/models/org.js, and server/models/team.js are globally callable without the admin authorization checks used by their non-OIDC counterparts. Authenticated use...

7.6CVSS0.00238EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/15 10:16 p.m.12 views

CVE-2026-50182

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YouTubeAPI Gallery Pagination. The $GET'search' query parameter is concatenated directly into the href attribute of two pagination links in...

6.1CVSS0.00178EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/15 10:16 p.m.19 views

CVE-2026-26719

Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request containing a malicious script...

6.1CVSS0.00356EPSS
SaveExploits1References1
NVD
NVD
added 2026/07/15 10:16 p.m.11 views

CVE-2026-26718

A Cross-Site Request Forgery CSRF vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform unauthorized modifications to Glue IDE shell scripts. The affected endpoint lacks proper CSRF token validation and accepts arbitrary HTTP methods via a permissive...

9.1CVSS0.00224EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2026/07/15 9:33 p.m.9 views

CVE-2026-54458

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page th...

9.6CVSS6.3AI score0.00303EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2026/07/15 9:33 p.m.50 views

CVE-2026-54458 AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page th...

9.6CVSS0.00303EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/15 9:33 p.m.9 views

CVE-2026-54458 AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page th...

9.6CVSS6.3AI score
SaveExploits0References4
CVE
CVE
added 2026/07/15 9:33 p.m.41 views

CVE-2026-54458

CVE-2026-54458 (AVideo YPTSocket XSS) affects WWBN’s AVideo with the YPTSocket plugin (versions prior to 29.0). The vulnerability is an unauthenticated stored DOM XSS: getWebSocket.json.php issues a signed WebSocket token; MessageSQLiteV2::onOpen reads webSocketSelfURI and page_title from the Web...

9.6CVSS6.3AI score0.00303EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/15 9:20 p.m.42 views

CVE-2026-55445 Qinglong: Incomplete fix for CVE-2026-3965: Improper Authentication

Qinglong is a timed task management platform supporting Python3, JavaScript, Shell, and Typescript. Prior to 2.20.1, the init guard middleware in back/loaders/express.ts checks /api/user/init but not /open/user/init, while rewrite'/open/', '/api/$1' rewrites the whitelisted /open/ path after JWT...

9.3CVSS0.00404EPSS
SaveExploits0References3
Rows per page
Query Builder