Lucene search
+L

59754 matches found

Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.24 views

PT-2026-58851

Name of the Vulnerable Software and Affected Versions zhinianboke xianyu-auto-reply versions prior to 19fc3282a1bb78a05c34945c088525d20e081cbd Description An issue in the Backend User Endpoint allows remote attackers to perform manipulations that result in missing authorization. This occurs withi...

7.5CVSS7AI score0.00297EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.28 views

PT-2026-57978

Name of the Vulnerable Software and Affected Versions Apache Kylin versions 4 through 5.0.3 Description An SQL Injection issue exists where improper neutralization of special elements used in an SQL command occurs. This happens when a backend API refreshes the table catalog, which may lead to the...

9.8CVSS6.1AI score0.00409EPSS
SaveExploits0References11
OSV
OSV
added 2026/07/13 11:41 p.m.9 views

GHSA-XF7X-X43H-RPQH json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS

Circular JSON Schema $ref causes unbounded CPU DoS in jsonrepair Summary SchemaRepairer.resolveschema in jsonrepair follows JSON Schema $ref pointers in an unbounded while loop without any cycle detection. An attacker who can supply a schema containing a self-referencing $ref e.g., via the demo...

7.5CVSS6.2AI score
SaveExploits0References3
NVD
NVD
added 2026/07/13 11:16 p.m.13 views

CVE-2026-57856

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

8.8CVSS0.00389EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/13 11:16 p.m.16 views

CVE-2026-57855

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php executes bucket commands ls, upload, removefiles, rename, createfolder without performing any ACL or role check. Any authenticated...

8.8CVSS0.00283EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/13 10:41 p.m.39 views

CVE-2026-57856 Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

8.8CVSS0.00389EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/07/13 10:41 p.m.8 views

CVE-2026-57856

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

8.8CVSS6.1AI score0.00389EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/13 10:41 p.m.7 views

CVE-2026-57856 Cockpit CMS Path Traversal via Bucket Name in Bucket File Storage API

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

8.7CVSS6.1AI score
SaveExploits0References7
OSV
OSV
added 2026/07/13 10:33 p.m.6 views

CVE-2026-57855 Cockpit CMS Missing Authorization in Bucket File Storage API

Cockpit CMS contains a missing authorization vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php executes bucket commands ls, upload, removefiles, rename, createfolder without performing any ACL or role check. Any authenticated...

8.7CVSS6.1AI score
SaveExploits0References6
OSV
OSV
added 2026/07/13 10:17 p.m.10 views

MAL-2026-10511 Malicious code in type-swap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6db27d60a7dec38dafef8ed810203dc0130cf340eae162410dfcb7b21a4e2658 The package's declared main entry index.js exports a middleware factory that, when invoked by a consumer, spawns lib/caller.js as a detached child...

6.5AI score
SaveExploits0References2
NVD
NVD
added 2026/07/13 10:16 p.m.12 views

CVE-2026-62327

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

9.3CVSS0.00371EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/13 9:37 p.m.8 views

CVE-2026-62328 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation historie...

8.7CVSS6.1AI score0.02244EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/13 9:37 p.m.44 views

CVE-2026-62328 9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated request logs and retrieve complete AI conversation historie...

8.7CVSS0.00371EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/13 9:37 p.m.9 views

CVE-2026-62327

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

9.3CVSS6.1AI score0.00371EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/13 9:30 p.m.39 views

CVE-2026-59801

CVE-2026-59801 affects 9Router up to version 0.4.41 and is caused by missing authentication middleware in Next.js API routes under src/app/api/providers/*. It allows unauthenticated remote interaction with provider management endpoints, enabling enumeration, creation, modification, or deletion of...

9.8CVSS6.1AI score0.02244EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/13 9:30 p.m.51 views

CVE-2026-59801 9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middleware in the Next.js API routes under...

9.8CVSS0.02244EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/07/13 8:2 p.m.8 views

OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing

A flaw was found in OpenEXR, an image storage format library for the motion picture industry. An integer overflow vulnerability exists in the ImageChannel::resize function, which can be triggered when processing a specially crafted OpenEXR image file through the OpenEXRUtil public API. This can...

8.8CVSS6.2AI score0.00439EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 2026/07/13 8:1 p.m.6 views

OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing

A flaw was found in OpenEXR, an image storage format library for the motion picture industry. An integer overflow vulnerability exists in the ImageChannel::resize function, which can be triggered when processing a specially crafted OpenEXR image file through the OpenEXRUtil public API. This can...

8.8CVSS6.2AI score0.00439EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 2026/07/13 7:46 p.m.10 views

OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing

A flaw was found in OpenEXR, an image storage format library for the motion picture industry. An integer overflow vulnerability exists in the ImageChannel::resize function, which can be triggered when processing a specially crafted OpenEXR image file through the OpenEXRUtil public API. This can...

8.8CVSS6.2AI score0.00439EPSS
SaveExploits1References7
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/13 7:29 p.m.12 views

Security Bulletin: Vulnerability in follow-redirects bundled with IBM Fusion and IBM Fusion HCI

Summary IBM Fusion and IBM Fusion HCI include the follow-redirects library, which is affected by an information exposure vulnerability. CVE-2026-40895 Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement for Node's http and https modules...

7.5CVSS7AI score0.00486EPSS
SaveExploits0Affected Software2
Rows per page
Query Builder