CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

51310 matches found

Snyk•added 2026/05/11 9:00 p.m.•20 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS

SaveExploits3References2

Snyk•added 2026/05/11 9:00 p.m.•20 views

Embedded Malicious Code

9.8CVSS6AI score0.02342EPSS

SaveExploits3References2

Cvelist•added 2026/05/11 8:08 p.m.•40 views

CVE-2026-28860

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the...

0.0038EPSS

SaveExploits0References8

Cvelist•added 2026/05/11 7:51 p.m.•46 views

CVE-2026-42883 Audiobookshelf: Cross-library file exfiltration via unscoped bulk download endpoint

Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/libraries/:id/download endpoint validates that the requesting user has access to the library specified in the URL path, but fetches downloadable items solely by attacker-provided IDs without constraining...

6.5CVSS0.00205EPSS

SaveExploits0References1

Cvelist•added 2026/05/11 6:00 p.m.•51 views

CVE-2026-45222 Summarize Insecure Daemon Configuration File Permissions

Summarize versions through 0.14.1, fixed in commit 0cfb0fb, creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in /.summarize/daemon.json...

6.9CVSS0.00098EPSS

SaveExploits0References3

OSV•added 2026/05/11 4:17 p.m.•6 views

CVE-2026-34091

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...

7.5CVSS5.9AI score

SaveExploits0References1

vulnersOsv•added 2026/05/11 4:12 p.m.•3 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +759 more potentially affected by CVE-2026-44572 via next (>=16.0.0, <=16.2.4)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-44572 Source advisory:...

5.9CVSS4.7AI score0.00284EPSS

SaveExploits0

vulnersOsv•added 2026/05/11 4:12 p.m.•3 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +759 more potentially affected by CVE-2026-44572 via next (>=16.0.0, <=16.2.4)

5.9CVSS4.7AI score0.00284EPSS

SaveExploits0

Snyk•added 2026/05/11 3:59 p.m.•9 views

Privilege Dropping / Lowering Errors

Overview Affected versions of this package are vulnerable to Privilege Dropping / Lowering Errors in the metrics exporter. An attacker can gain PostgreSQL superuser privileges and execute arbitrary OS commands as the postgres user inside the primary pod by exploiting the ability to plant shadow...

9.9CVSS6.7AI score0.0048EPSS

SaveExploits0References3

vulnersOsv•added 2026/05/11 3:57 p.m.•3 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +759 more potentially affected by CVE-2026-44581 via next (>=16.0.0, <=16.2.4)

4.7CVSS4.9AI score0.00222EPSS

SaveExploits1

vulnersOsv•added 2026/05/11 3:57 p.m.•3 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +759 more potentially affected by CVE-2026-44581 via next (>=16.0.0, <=16.2.4)

4.7CVSS4.9AI score0.00222EPSS

SaveExploits1

vulnersOsv•added 2026/05/11 3:56 p.m.•3 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +759 more potentially affected by CVE-2026-44582 via next (>=16.0.0, <=16.2.4)

3.7CVSS4.7AI score0.00215EPSS

SaveExploits1

vulnersOsv•added 2026/05/11 3:56 p.m.•3 views

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +1370 more potentially affected by CVE-2026-44579 via next (>=15.0.0, <=15.5.15)

next NPM version =15.0.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2026-44579 Source advisory: SNYK:JS-NEXT-16638678...

7.5CVSS7.3AI score0.00746EPSS

SaveExploits1

vulnersOsv•added 2026/05/11 3:56 p.m.•3 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +759 more potentially affected by CVE-2026-44577 via next (>=16.0.0, <=16.2.4)

7.5CVSS7.3AI score0.00739EPSS

SaveExploits1

vulnersOsv•added 2026/05/11 3:54 p.m.•6 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +759 more potentially affected by CVE-2026-44576 via next (>=16.0.0, <=16.2.4)

5.4CVSS5.5AI score0.00295EPSS

SaveExploits0

Vulnrichment•added 2026/05/11 3:00 p.m.•8 views

CVE-2026-34092 Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...

2.1CVSS5.8AI score0.00237EPSS

SaveExploits0References1

CVE•added 2026/05/11 2:50 p.m.•27 views

CVE-2026-34090

The vulnerability CVE-2026-34090 affects Wikimedia Foundation CheckUser, versions 1.45.0 to 1.45.1. It exposes sensitive information to an unauthorized actor (confidentiality impact). No exploit details are provided in the connected documents. Remediation: upgrade to version 1.45.2 (per PT-2026-3...

7.5CVSS5.8AI score0.0028EPSS

SaveExploits0References1Affected Software1

vulnersOsv•added 2026/05/11 2:50 p.m.•2 views

@c0va23/react-router-dev (7.8.3-alpha.2), @holocron.so/cli (>=0.6.0, <=0.16.0) +16 more potentially affected by unknown CVE via @vitejs/plugin-rsc (>=0.4.11, <=0.5.24)

@vitejs/plugin-rsc NPM version =0.4.11, =0.6.0, =0.5.0, =0.0.1, =0.0.0-1ae0b37, =0.0.0-experimental-14dc7c1, =0.0.0-pr-32412-sha-076721d1, =1.0.2, =0.1.0, =0.0.1, =1.18.0-rsc.19, =0.1.0, =0.0.1-alpha.0, =0.0.1-alpha.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-W94C-4VHP-22GX...

5.4AI score

SaveExploits0

CVE•added 2026/05/11 2:43 p.m.•88 views

CVE-2026-34088

CVE-2026-34088 (MediaWiki) is a disclosed exposure vulnerability affecting MediaWiki versions before 1.43.7, 1.44.4, and 1.45.2. The connected sources confirm a broad vulnerability family in MediaWiki leading to information disclosure to unauthorized actors. Debian’s advisory DSA-6208-1 notes mul...

7.5CVSS5.8AI score0.0029EPSS

SaveExploits0References1Affected Software1

vulnersOsv•added 2026/05/11 2:42 p.m.•2 views

0perator (>=0.1.0, <=0.3.0), 0pflow (>=0.1.0-dev.00aaa03, <=0.1.0) +3053 more potentially affected by CVE-2026-44902 via @opentelemetry/sdk-node (>=0.10.2, <=0.216.0)

@opentelemetry/sdk-node NPM version =0.10.2, =0.1.0, =0.1.0-dev.00aaa03, =5.0.0, =0.1.1, =0.0.1, =0.8.0, =0.1.1, =0.1.1, =0.1.1, =0.1.8, =0.1.5, =1.0.5, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =0.2.0, =0.2.13 and more Source cves: CVE-2026-44902 Source advisory:...

7.5CVSS5.3AI score0.00472EPSS

SaveExploits1

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by