Lucene search
+L

59769 matches found

ATTACKERKB
ATTACKERKB
added 2026/07/09 6:27 p.m.10 views

CVE-2026-59148

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: with write methods...

8.8CVSS6AI score0.00173EPSS
SaveExploits0References6Affected Software1
CVE
CVE
added 2026/07/09 5:46 p.m.37 views

CVE-2026-61344

CVE-2026-61344 affects the Superior Court of California Hearing Reminder Service (hrs.courts.ca.gov). The API endpoint exposes court reminder records containing potentially sensitive information without authentication, indicating an unauthenticated information disclosure. The root cause is an exp...

6.9CVSS5.9AI score0.00272EPSS
SaveExploits0References3
ICS
ICS
added 2026/07/09 5:33 p.m.11 views

Superior Court of California Hearing Reminder Service unauthenticated information disclosure

RISK EVALUATION The Hearing Reminder Service for the Superior Court of California at https://www.hrs.courts.ca.gov exposes an API endpoint that returns sensitive court reminder records without authentication. 2. RECOMMENDED PRACTICES Fixed April 28th, 2026. 3. DESCRIPTION The Superior Court of...

6.9CVSS6.1AI score0.00272EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/09 4:30 p.m.11 views

CVE-2026-15192

A vulnerability has been found in mettle sendportal up to 3.0.1. This issue affects the function sendgrid/postmark/postal/mailjet of the component APIv1 Webhooks. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to...

6.9CVSS5.3AI score0.00572EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/07/09 4:20 p.m.11 views

MAL-2026-10058 Malicious code in cookie-js-ease (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2908ef4ab9f019d4675b39066f876acb959cd9814b47bb66f8f4554c517abe0d [email protected] impersonates the popular js-cookie library same repository URL, banner comment, API surface, and reused upstream author name...

6.4AI score
SaveExploits0References1
NVD
NVD
added 2026/07/09 4:16 p.m.12 views

CVE-2026-42486

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

9.4CVSS0.00134EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/09 4:16 p.m.12 views

CVE-2026-15188

A weakness has been identified in manjurulhoque django-job-portal up to dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. Affected by this vulnerability is the function EditEmployeeProfileAPIView of the file accounts/api/views.py of the component Employee Dashboard Endpoint. This manipulation of the...

6.5CVSS0.00209EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/09 4:16 p.m.8 views

ALPINE-CVE-2026-23560

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

9.4CVSS7.1AI score0.0014EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/09 3:56 p.m.11 views

CVE-2026-59227

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verified account and did not enforce the global image-edit switch or the per-user image-generation permission, allowing a non-admin user to...

4.3CVSS6AI score0.00259EPSS
SaveExploits1References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/09 3:30 p.m.10 views

CVE-2026-59206

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API, allowing unauthenticated reques...

7.1CVSS5.9AI score0.0038EPSS
SaveExploits0References4Affected Software1
RedHat Linux
RedHat Linux
added 2026/07/09 3:29 p.m.11 views

cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening

A flaw was found in Apache CXF. The EndpointReferenceUtils and W3CMultiSchemaFactory classes within Apache CXF construct a SAXParserFactory without proper security configurations. This oversight enables out-of-band OOB external entity resolution, a type of XML External Entity XXE vulnerability. A...

9.8CVSS5.8AI score0.00527EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/09 3:28 p.m.23 views

MAL-2026-10046 Malicious code in chai-as-smart (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbeb8dc929ba80789f3386d489e22fc4efa5fa43b2901a4d6aa8524c03168a58 On require, index.js spawns lib/initializeCaller.js as a detached background process. That script decodes a base64-hidden URL...

6.5AI score
SaveExploits0References1
NVD
NVD
added 2026/07/09 3:16 p.m.14 views

CVE-2026-54801

A vulnerability has been identified in CPCI85 Central Processing/Communication All versions V26.20, SICORE Base system All versions V26.20.0. The affected application contains insufficient validation of authentication credentials when processing administrative account modifications through the we...

8.6CVSS0.0034EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/09 3:16 p.m.11 views

CVE-2026-42486 Multiple RBAC issues in XAPI

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

9.4CVSS7.2AI score0.0014EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/09 3:16 p.m.41 views

CVE-2026-42486 Multiple RBAC issues in XAPI

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

9.4CVSS0.00134EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/09 3:15 p.m.34 views

CVE-2026-23562

The CVE-2026-23562 entry concerns RBAC mis-configuration in XAPI. The advisory notes that the PCI passthrough configuration was normally restricted to pool-admin, but one API did not enforce this check, allowing a vm-admin to access unintended host hardware. This is described alongside related RB...

9.4CVSS7.2AI score0.00134EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/09 3:12 p.m.9 views

CVE-2026-23560 Multiple RBAC issues in XAPI

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

9.4CVSS6AI score0.0014EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/09 2:30 p.m.42 views

CVE-2026-15187 enquirer Public Package API Enquirer.set prototype pollution

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...

5.3CVSS0.00248EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/09 2:30 p.m.9 views

CVE-2026-15187 enquirer Public Package API Enquirer.set prototype pollution

A security flaw has been discovered in enquirer up to 2.4.1. Affected is the function Enquirer.set of the component Public Package API. The manipulation of the argument question.name results in improperly controlled modification of object prototype attributes. The attack can be launched remotely...

5.3CVSS5.8AI score
SaveExploits0References9
CVE
CVE
added 2026/07/09 2:30 p.m.26 views

CVE-2026-15187

The CVE-2026-15187 issue affects the enquirer package (versions up to 2.4.1) and specifically the Enquirer.set function. The root cause is a prototype pollution vulnerability caused by manipulating the argument name (question.name), allowing improper modification of object prototype attributes. I...

5.3CVSS5.6AI score0.00248EPSS
SaveExploits0References7
Rows per page
Query Builder