Lucene search
+L

90358 matches found

CVE
CVE
added 2026/06/25 3:57 p.m.22 views

CVE-2026-55439

Halo: Path traversal vulnerability (CVE-2026-55439) in the backup download endpoint allows authenticated administrators to read arbitrary files from the server when upgrading before 2.24.3. The issue arises because the backup filename in GET /apis/console.api.migration.halo.run/v1alpha1/backups/{...

5.5CVSS6AI score0.00337EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/25 3:50 p.m.10 views

EUVD-2026-39459

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences...

8.1CVSS6AI score0.00567EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/25 3:0 p.m.46 views

CVE-2026-55477

3X-UI before version 3.3.1 is affected. An authenticated administrator can abuse the database import functionality to write arbitrary files on the host by altering Xray configuration values stored in the database, enabling code execution and persistent access as the Xray process user (including r...

7.2CVSS6.4AI score0.00342EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/25 9:31 a.m.17 views

EUVD-2026-39190

Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access control. A logged-in user with no administrative privilege may access physical memory...

6.8CVSS5.8AI score0.00113EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/06/25 9:16 a.m.9 views

CVE-2026-53236

In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SOATTACHFILTER to priv users This patch restricts the use of SOATTACHFILTER cBPF on TCP sockets to users with CAPNETADMIN capability. This blocks potential side-channel attack where an unprivileged application...

5.5CVSS6AI score0.00123EPSS
SaveExploits0References8
OSV
OSV
added 2026/06/25 9:16 a.m.8 views

UBUNTU-CVE-2026-53236

In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SOATTACHFILTER to priv users This patch restricts the use of SOATTACHFILTER cBPF on TCP sockets to users with CAPNETADMIN capability. This blocks potential side-channel attack where an unprivileged application...

5.5CVSS5.7AI score0.00123EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/06/25 8:39 a.m.10 views

EUVD-2026-39327

In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SOATTACHFILTER to priv users This patch restricts the use of SOATTACHFILTER cBPF on TCP sockets to users with CAPNETADMIN capability. This blocks potential side-channel attack where an unprivileged application...

5.8AI score0.00123EPSS
SaveExploits0References6
OSV
OSV
added 2026/06/25 8:39 a.m.8 views

CVE-2026-53236 tcp: restrict SO_ATTACH_FILTER to priv users

In the Linux kernel, the following vulnerability has been resolved: tcp: restrict SOATTACHFILTER to priv users This patch restricts the use of SOATTACHFILTER cBPF on TCP sockets to users with CAPNETADMIN capability. This blocks potential side-channel attack where an unprivileged application...

5.8AI score
SaveExploits0References9
CVE
CVE
added 2026/06/25 7:3 a.m.35 views

CVE-2026-56129

CVE-2026-56129 concerns a vulnerability in a Generic IO & Memory Access driver for PCs from Toshiba Corporation and Dynabook Inc. that exposes its IOCTL with insufficient access control. The flaw enables a logged-in user with no administrative privilege to access physical memory through the drive...

6.8CVSS5.8AI score0.00113EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/06/25 7:3 a.m.63 views

CVE-2026-56129

Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access control. A logged-in user with no administrative privilege may access physical memory...

6.8CVSS0.00113EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/06/25 7:3 a.m.16 views

CVE-2026-56129

Generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access control. A logged-in user with no administrative privilege may access physical memory...

6.8CVSS5.8AI score0.00113EPSS
SaveExploits0References4
ICS
ICS
added 2026/06/25 5:0 a.m.15 views

EVoke Systems Charging Station Management System

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could enable attackers to gain unauthorized administrative control over vulnerable charging stations or disrupt charging services through denial-of-service attacks. 2. RECOMMENDED PRACTICES CISA recommends users take defensive...

9.4CVSS5.9AI score0.00415EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/06/25 12:0 a.m.28 views

PT-2026-52655

Name of the Vulnerable Software and Affected Versions Lemur affected versions not specified Description Passwords are stored in plaintext in the users.password column when a user's password is updated. This occurs because the User model only triggers password hashing during the before insert even...

4.9CVSS5.8AI score
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/06/25 12:0 a.m.47 views

PT-2026-52606

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.6.30 Description A cross-site scripting issue exists in the default security configuration of the Admin plugin page editor. Privileged users with page editing capabilities can inject malicious scripts to execute...

5.4CVSS6AI score0.00167EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/25 12:0 a.m.13 views

PT-2026-52507

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A missing authorization check in the GroupResource.addChild endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing...

7.7CVSS5.8AI score0.00289EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/25 12:0 a.m.16 views

PT-2026-52643

Name of the Vulnerable Software and Affected Versions Lemur affected versions not specified Description An authorization bypass exists in the StrictRolePermission and AuthorityCreatorPermission classes within lemur/auth/permissions.py. When the configuration flags LEMUR STRICT ROLE ENFORCEMENT an...

8.8CVSS6AI score0.00035EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/25 12:0 a.m.22 views

PT-2026-52574

Name of the Vulnerable Software and Affected Versions Bitwarden Server versions prior to 2026.5.0 Description An issue exists where authenticated Custom users with the ManageUsers permission can escalate privileges to remove Admin accounts from an organization. This occurs due to a missing role...

7.1CVSS5.8AI score0.00353EPSS
SaveExploits1References8
Positive Technologies
Positive Technologies
added 2026/06/25 12:0 a.m.18 views

PT-2026-52654

Name of the Vulnerable Software and Affected Versions Lemur affected versions not specified Description An authorization bypass exists in the PUT /api/1/roles/ endpoint. The handler incorrectly allows any user who is a member of a specific role to modify that role, as the permission check is...

6.3CVSS5.8AI score
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/06/25 12:0 a.m.34 views

PT-2026-52506

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue exists where a remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, can bypass client Uniform...

7.3CVSS6.5AI score0.00419EPSS
SaveExploits0References8
Snyk
Snyk
added 2026/06/24 10:16 p.m.8 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the API endpoints responsible for managing repository settings. An attacker can modify admin-only repository configurations, such as disabling the native issue tracker or wiki, injecting external tracker or...

7.1CVSS6AI score0.00335EPSS
SaveExploits0References2
Rows per page
Query Builder