Lucene search
+L

60663 matches found

Github Security Blog
Github Security Blog
added 2026/06/10 12:31 a.m.8 views

Spring REST Docs REST Assured & WebFlux are vulnerable to Improper Restriction of XML External Entity Reference

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

5.9CVSS5.4AI score0.00223EPSS
SaveExploits0References5Affected Software2
NVD
NVD
added 2026/06/10 12:16 a.m.19 views

CVE-2026-46518

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scripting vulnerability in the prescription CSS/HTML multi-print feature allows a patient portal user to execute arbitrary JavaScript in a...

8.7CVSS0.00208EPSS
SaveExploits1References1
NVD
NVD
added 2026/06/10 12:16 a.m.29 views

CVE-2026-40991

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

5.9CVSS0.00223EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.30 views

Fission 输入验证错误漏洞

Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.25.0 contained a input validation vulnerability. This vulnerability stemmed from the HTTPTriggerSpec.Validate method, which ignored the RelativeURL and Prefix fields during validation. As a...

4.3CVSS5.3AI score0.00227EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.22 views

KubeV2V Migration assessment 跨站脚本漏洞

The Migration Planner UI is an open-source migration planning front-end tool developed by KubeV2V. The Migration Planner UI has a cross-site scripting vulnerability. This vulnerability arises from the ability of attackers to register malicious discovery agents containing JavaScript code. When an...

7.3CVSS5.8AI score0.00187EPSS
SaveExploits0References3
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.19 views

WordPress plugin BuddyPress 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

5.3CVSS5.5AI score0.00227EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.25 views

PT-2026-48539

Name of the Vulnerable Software and Affected Versions opentelemetry-operator affected versions not specified Description The TargetAllocator in the OpenTelemetry Operator processes ServiceMonitor resources and converts endpoints into Prometheus scrape configurations. A tenant with permissions to...

7.7CVSS6AI score0.00017EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.33 views

PT-2026-48443

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments,...

9.1CVSS5.5AI score0.00294EPSS
SaveExploits0References4
Tenable Nessus
Tenable Nessus
added 2026/06/10 12:0 a.m.20 views

Debian dsa-6333 : mistral-api - security update

The remote Debian 12 / 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6333 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6333-1 [email protected] https://www.debian.org/security/...

9.9CVSS5.5AI score0.00733EPSS
SaveExploits0References5
vulnersOsv
vulnersOsv
added 2026/06/10 12:0 a.m.12 views

com.apollographql.federation:federation-spring-subscription-callback (>=4.2.0 <=5.5.0), com.contentmunch:blog-api (>=2.0.0.RELEASE <=2.0.1.RELEASE) +136 more potentially affected by CVE-2026-41699 via org.springframework.graphql:spring-graphql (>=1.0.0 <=1.4.5)

org.springframework.graphql:spring-graphql MAVEN version =1.0.0, =4.2.0, =2.0.0.RELEASE, =1.0.1, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0, =2.0RC1 - com.graphql-java-generator:graphql-maven-plugin-samples-CustomTemplates-client =2.0RC1 -...

9.8CVSS5.7AI score0.0043EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.26 views

PT-2026-48407

Ghidra before 12.1 contains a heap-use-after-free vulnerability in SleighBuilder::generatePointerAdd caused by iterator invalidation when PcodeCacher::allocateInstruction reallocates the issued vector. Attackers can trigger memory corruption by decompiling malicious binaries through the public...

6.9CVSS5.5AI score0.00169EPSS
SaveExploits1References4
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.24 views

VMware Spring REST Docs 代码问题漏洞

VMware Spring REST Docs is a REST API documentation generation framework developed by VMware, Inc. There are code-related vulnerabilities in VMware Spring REST Docs. These vulnerabilities arise when using spring-restdocs-webtestclient or spring-restdocs-restassistant to record remote APIs accesse...

5.9CVSS5.5AI score0.00223EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/09 11:46 p.m.6 views

CVE-2026-40991 XML External Entity (XXE) injection when documenting untrusted XML content

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

5.9CVSS5.3AI score
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/06/09 11:46 p.m.14 views

CVE-2026-40991 XML External Entity (XXE) injection when documenting untrusted XML content

When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote API accessed over HTTP, an attacker who compromises the API or tricks the user into documenting a malicious API can perform an XXE injection attack when the documentation-generating tests are next execute...

5.9CVSS5.5AI score0.00223EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/09 11:46 p.m.36 views

CVE-2026-40991

The CVE-2026-40991 issue affects Spring REST Docs: 4.0.0; 3.0.0–3.0.5; and 2.0.0.RELEASE–2.0.8.RELEASE. When using spring-restdocs-webtestclient or spring-restdocs-restassured to document a remote HTTP API, an attacker who compromises the API or tricks a user into documenting a malicious API can ...

5.9CVSS5.5AI score0.00223EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/06/09 11:44 p.m.44 views

CVE-2026-53675 BuddyPress 14.4.0 Friends List IDOR via REST API

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary userid because the getitemspermissionscheck meth...

5.3CVSS0.00227EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/06/09 11:44 p.m.13 views

CVE-2026-53675 BuddyPress 14.4.0 Friends List IDOR via REST API

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the friends REST API that allows any authenticated attacker to enumerate another user's complete friend list. Attackers can query the friends endpoint with an arbitrary userid because the getitemspermissionscheck meth...

5.3CVSS5.6AI score0.00227EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/06/09 11:44 p.m.46 views

CVE-2026-53673 BuddyPress 14.4.0 Private Message IDOR via REST API user_id Parameter

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API that allows authenticated attackers to access arbitrary private message threads by supplying a userid parameter in the request. Attackers can pass another user's identifier to the...

8.6CVSS0.00371EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/06/09 8:59 p.m.19 views

CVE-2026-46484

Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Headplane was vulnerable to a path traversal / authorization bypass in the Headscale API client used by node and user rename operations. This issue has been patched in versions 0.6.3 and 0.7.0-beta.3...

8.1CVSS5.4AI score0.00374EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/06/09 8:59 p.m.25 views

CVE-2026-25555

OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attackers to gain admin access by supplying an empty X-Api-Key header value. Attackers can exploit the middleware's comparison of the supplied...

9.8CVSS5.5AI score0.01824EPSS
SaveExploits1References1
Rows per page
Query Builder