Lucene search
+L

59623 matches found

NVD
NVD
added 2026/07/27 7:16 a.m.15 views

CVE-2026-13390

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...

5.3CVSS0.00182EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/27 6:0 a.m.11 views

CVE-2026-13390

The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as failed and to store...

5.9AI score0.00182EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/27 6:0 a.m.23 views

CVE-2026-13390

CVE-2026-13390 affects the WordPress plugin The Events Calendar (pre-6.16.5.1). The issue is an missing authorization check on an Event Aggregator import REST API route and an integrity check bypass for a specific status, enabling unauthenticated attackers to mark import records as failed and to ...

5.3CVSS5.9AI score0.00182EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/07/27 4:16 a.m.54 views

SolarWinds Web Help Desk - Authentication Bypass

SolarWinds Web Help Desk 12.8.8 HF1 and earlier contains an authentication bypass vulnerability in the WebObjects session handling. By crafting a request with a manipulated path component to an internal admin page endpoint, an unauthenticated attacker can access privileged administrative function...

9.8CVSS7.4AI score0.83622EPSS
SaveExploits5References4
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.11 views

PT-2026-65080

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 Devolutions Server versions 2026.1.23.0 and earlier Description Improper access control in the role membership management endpoint allows an authenticated non-administrative user with...

8.8CVSS5.4AI score0.00232EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.16 views

PT-2026-64905

Name of the Vulnerable Software and Affected Versions Progress Software LoadMaster affected versions not specified Progress ECS Connection Manager affected versions not specified Progress Object Scale Connection Manager affected versions not specified Progress MOVEit WAF affected versions not...

8.4CVSS6AI score0.00717EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/27 12:0 a.m.8 views

CVE-2021-32084

An issue was discovered in Quest KACE Systems Deployment Appliance SMA 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API,...

5.9AI score0.00327EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.12 views

PT-2026-65301

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...

9.2CVSS6AI score0.00277EPSS
SaveExploits0References1
Arista
Arista
added 2026/07/27 12:0 a.m.9 views

Security Advisory 0145

Security Advisory 0145 PDF Date: July 27, 2026 Revision | Date | Changes ---|---|--- 1.0 | July 27, 2026 | Initial release Description: SQL injection in a flow metrics API method enabling server-side request forgery CVE: CVE-2026 -17191 CVSSv3.1 Base Score: 9.1...

9.1CVSS5.8AI score0.02826EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/07/27 12:0 a.m.16 views

PT-2026-64999

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description A remote code execution issue exists in the configuration API. Authenticated administrators possessing CONFIGURATION EDIT and ATTACHMENT ADD privileges can write arbitrary PHP files by manipulating...

9.4CVSS6.6AI score0.00241EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/07/26 9:45 a.m.40 views

CVE-2026-17458 mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

6.5CVSS0.00228EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/07/26 9:45 a.m.14 views

EUVD-2026-49053

A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack...

6.5CVSS5.5AI score0.00228EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/26 6:30 a.m.29 views

CVE-2024-14040

CVE-2024-14040 affects the Linux kernel’s nexthop handling in ECMP/CLOS networks. The patch increases the nexthop weight width from 8-bit to 16-bit to accommodate large weight ratios (e.g., 1000:999) that don’t fit in 8 bits. The UAPI changes introduce a weight_high field and split fields to pres...

7.8CVSS5.6AI score0.0011EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/26 6:28 a.m.6 views

CVE-2026-64530 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

9.8CVSS5.7AI score
SaveExploits0References10
Wolfi
Wolfi
added 2026/07/25 8:23 p.m.19 views

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: fluent-operator, rancher-webhook, spqr, gitlab-kas, external-secrets-operator, flux-notification-controller, cilium, cert-manager, cert-manager-istio-csr, crossplane, kubernetes-csi-external-attacher, grafana, k8ssandra-client, node-feature-discovery, tetragon,...

5.4AI score
SaveExploits0
Chainguard
Chainguard
added 2026/07/25 2:16 p.m.20 views

GHSA-GCJH-H69Q-9W9G vulnerabilities

Vulnerabilities for packages: ansible-operator-fips, ocm-kubernetes-controller, crossplane-function-auto-ready, kubernetes-csi-external-resizer, chainloop-cli-fips, kwok, elastic-agent, cluster-api-gcp-controller-fips, envoy-ai-gateway, kueue-fips, open-cluster-management-fips,...

5.4AI score
SaveExploits0
NVD
NVD
added 2026/07/25 11:17 a.m.11 views

CVE-2026-66013

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

9.3CVSS0.00388EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/25 10:45 a.m.11 views

EUVD-2026-49044

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

9.3CVSS5.9AI score0.00388EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/25 10:45 a.m.41 views

CVE-2026-66013 OpenRemote before 1.26.2 Authentication Bypass via Console Registration

OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without...

9.3CVSS0.00388EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/25 10:17 a.m.7 views

UBUNTU-CVE-2026-64314

In the Linux kernel, the following vulnerability has been resolved: crypto: chacha20poly1305 - validate poly1305 template argument chachapolycreate still accepts the compatibility poly1305 parameter in the template name, but it assumes the second template argument is always present and immediatel...

5.6AI score0.00198EPSS
SaveExploits0References6
Rows per page
Query Builder