Lucene search
+L

59626 matches found

EUVD
EUVD
added 2026/07/27 3:43 p.m.10 views

EUVD-2026-49331

phpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATIONEDIT and ATTACHMENTADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload ...

9.4CVSS6.6AI score0.00241EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/07/27 2:47 p.m.9 views

openjdk: OpenJDK: Enhance Jar handling (Oracle CPU 2026-07)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

7.5CVSS7.1AI score0.00256EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/27 7:16 a.m.19 views

CVE-2026-13714

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all...

9.8CVSS0.00462EPSS
SaveExploits1References1
NVD
NVD
added 2026/07/27 7:16 a.m.15 views

CVE-2026-13390

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...

5.3CVSS0.00182EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/27 6:0 a.m.11 views

CVE-2026-13390

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...

5.9AI score0.00182EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/27 6:0 a.m.23 views

CVE-2026-13390

CVE-2026-13390 affects the WordPress plugin The Events Calendar (pre-6.16.5.1). The issue is an missing authorization check on an Event Aggregator import REST API route and an integrity check bypass for a specific status, enabling unauthenticated attackers to mark import records as failed and to ...

5.3CVSS5.9AI score0.00182EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/07/27 4:16 a.m.54 views

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative function...

9.8CVSS7.4AI score0.83622EPSS
SaveExploits5References4
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.11 views

PT-2026-65080

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 Devolutions Server versions 2026.1.23.0 and earlier Description Improper access control in the role membership management endpoint allows an authenticated non-administrative user with...

8.8CVSS5.4AI score0.00232EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.16 views

PT-2026-64905

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress ECS Connection Manager affected versions not specified Progress Object Scale Connection Manager affected versions not specified Progress MOVEit WAF affected versions not...

8.4CVSS6AI score0.00717EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/27 12:0 a.m.8 views

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

5.9AI score0.00327EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.12 views

PT-2026-65301

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...

9.2CVSS6AI score0.00277EPSS
SaveExploits0References1
Arista
Arista
added 2026/07/27 12:0 a.m.9 views

Security Advisory 0145

Security Advisory 0145 PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release Description: SQL injection in a flow metrics API method enabling server-side request forgery CVE: CVE-2026 -17191 CVSSv3.1 Base Score: 9.1...

9.1CVSS5.8AI score0.02826EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.16 views

PT-2026-64999

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description A remote code execution issue exists in the configuration API. Authenticated administrators possessing CONFIGURATION EDIT and ATTACHMENT ADD privileges can write arbitrary PHP files by manipulating...

9.4CVSS6.6AI score0.00241EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/07/26 9:45 a.m.40 views

CVE-2026-17458 mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

6.5CVSS0.00228EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/07/26 9:45 a.m.14 views

EUVD-2026-49053

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

6.5CVSS5.5AI score0.00228EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/26 6:30 a.m.29 views

CVE-2024-14040

CVE-2024-14040 affects the Linux kernel’s nexthop handling in ECMP/CLOS networks. The patch increases the nexthop weight width from 8-bit to 16-bit to accommodate large weight ratios (e.g., 1000:999) that don’t fit in 8 bits. The UAPI changes introduce a weight_high field and split fields to pres...

7.8CVSS5.6AI score0.0011EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/26 6:28 a.m.6 views

CVE-2026-64530 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

9.8CVSS5.7AI score
SaveExploits0References10
Wolfi
Wolfi
added 2026/07/25 8:23 p.m.19 views

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: fluent-operator, rancher-webhook, spqr, gitlab-kas, external-secrets-operator, flux-notification-controller, cilium, cert-manager, cert-manager-istio-csr, crossplane, kubernetes-csi-external-attacher, grafana, k8ssandra-client, node-feature-discovery, tetragon,...

5.4AI score
SaveExploits0
Chainguard
Chainguard
added 2026/07/25 2:16 p.m.20 views

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: ansible-operator-fips, ocm-kubernetes-controller, crossplane-function-auto-ready, kubernetes-csi-external-resizer, chainloop-cli-fips, kwok, elastic-agent, cluster-api-gcp-controller-fips, envoy-ai-gateway, kueue-fips, open-cluster-management-fips,...

5.4AI score
SaveExploits0
NVD
NVD
added 2026/07/25 11:17 a.m.11 views

CVE-2026-66013

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

9.3CVSS0.00388EPSS
SaveExploits0References2
Rows per page
Query Builder