Lucene search
+L

59679 matches found

CVE
CVE
added 2026/07/20 3:43 p.m.18 views

CVE-2026-45797

CVE-2026-45797 affects HeyForm (open-source form builder). Before version 3.0.0-rc.7, the /api/upload endpoint allowed unauthenticated file uploads, including SVGs. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express’s serve-static middle...

6.4CVSS5AI score0.00404EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/20 3:43 p.m.37 views

CVE-2026-45797 HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing...

6.4CVSS0.00404EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/20 3:43 p.m.5 views

CVE-2026-45797 HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload

HeyForm is an open-source form builder. Prior to version 3.0.0-rc.7, the /api/upload endpoint allows unauthenticated file uploads including SVG files. Uploaded SVGs are stored in the static assets directory and served with Content-Type: image/svg+xml by Express's serve-static middleware, allowing...

6.4CVSS4.9AI score
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/07/20 3:31 p.m.7 views

CVE-2026-63102 rConfig Core < 8.2.8 Privilege Escalation via Users API role field

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

5.4CVSS5.5AI score0.00246EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/20 3:31 p.m.37 views

CVE-2026-63102 rConfig Core < 8.2.8 Privilege Escalation via Users API role field

rConfig Core before 8.2.8 contains a privilege escalation vulnerability that allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. Attackers can exploit the missing allowlist...

5.4CVSS0.00246EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/20 3:26 p.m.7 views

CVE-2026-28220 Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

8.4CVSS5.8AI score
SaveExploits0References3
CVE
CVE
added 2026/07/20 3:26 p.m.36 views

CVE-2026-28220

CVE-2026-28220 concerns the Wazuh Cluster Distributed API (DAPI). Before version 4.14.5, the master node could be coerced to deserialize an attacker-controlled callable and run it under an attacker-controlled RBAC context due to a permissive as_wazuh_object() deserialization and client-supplied r...

9.1CVSS5.8AI score0.00396EPSS
SaveExploits1References1Affected Software1
OSV
OSV
added 2026/07/20 3:24 p.m.7 views

USN-8566-1 linux, linux-gcp, linux-gke, linux-realtime vulnerabilities

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. CVE-2025-54518 Several security issues...

9.8CVSS7.1AI score0.03234EPSS
SaveExploits9References445
NVD
NVD
added 2026/07/20 3:16 p.m.7 views

CVE-2026-62183

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...

9.8CVSS0.00411EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/07/20 3:2 p.m.7 views

CVE-2026-48824 Mailpit: Sibling-endpoint memory-exhaustion DoS via unbounded JSON body on /api/v1/messages, /api/v1/tags, and /api/v1/message/{id}/release (incomplete fix of GHSA-fpxj-m5q8-fphw)

Mailpit is an email testing tool and API for developers. Prior to version 1.30.1, the fix for GHSA-fpxj-m5q8-fphw CVE-2026-45710, "Mailpit: Set a default 50MB p/m limit to prevent DoS via unlimited SMTP DATA and /api/v1/send body sizes" wrapped only POST /api/v1/send with http.MaxBytesReader. The...

5.3CVSS5.4AI score0.00421EPSS
SaveExploits1References2
CVE
CVE
added 2026/07/20 3:2 p.m.37 views

CVE-2026-48824

Mailpit versions before 1.30.1 expose a pre-auth memory-exhaustion DoS via unbounded JSON bodies on four endpoints: PUT /api/v1/messages, DELETE /api/v1/messages, PUT /api/v1/tags, and POST /api/v1/message/{id}/release. The root cause is json.NewDecoder(r.Body) used without a body-size cap, unlik...

5.3CVSS5.4AI score0.00421EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2026/07/20 3:1 p.m.4 views

CVE-2026-45713 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

7.5CVSS5.4AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/20 3:1 p.m.37 views

CVE-2026-45713 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

7.5CVSS0.00388EPSS
SaveExploits1References2
The Hacker News
The Hacker News
added 2026/07/20 1:32 p.m.14 views

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More

A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs...

9.8CVSS9.5AI score0.05985EPSS
SaveExploits1
RedHat Linux
RedHat Linux
added 2026/07/20 1:23 p.m.16 views

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

3.3CVSS6.3AI score0.00185EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/20 12:4 p.m.35 views

CVE-2026-63735 SurrealDB before 3.2.0 Authentication Bypass via Custom API

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by...

8.6CVSS0.00263EPSS
SaveExploits0References2
GithubExploit
GithubExploit
added 2026/07/20 10:41 a.m.68 views

Exploit for CVE-2026-60137

/ / / / / / | |/ / \ / /...

9.8CVSS6AI score0.98417EPSS
SaveExploits70
Veracode
Veracode
added 2026/07/20 10:33 a.m.7 views

Information Disclosure

phpMyFAQ is vulnerable to Information Disclosure. The vulnerability is due to inconsistent access control on public FAQ API endpoints, where inactive or unpublished FAQ entries are returned without proper status validation, allowing unauthenticated attackers to access non-public FAQ content...

6.9CVSS5.2AI score0.00214EPSS
SaveExploits0References1Affected Software2
NVD
NVD
added 2026/07/20 7:16 a.m.13 views

CVE-2026-10081

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

8.8CVSS0.00292EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/20 6:0 a.m.35 views

CVE-2026-8825 Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, privat...

0.00234EPSS
SaveExploits0References1
Rows per page
Query Builder