Lucene search
+L

59689 matches found

CVE
CVE
added 2026/07/20 3:2 p.m.38 views

CVE-2026-48824

Mailpit versions before 1.30.1 expose a pre-auth memory-exhaustion DoS via unbounded JSON bodies on four endpoints: PUT /api/v1/messages, DELETE /api/v1/messages, PUT /api/v1/tags, and POST /api/v1/message/{id}/release. The root cause is json.NewDecoder(r.Body) used without a body-size cap, unlik...

5.3CVSS5.4AI score0.00421EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2026/07/20 3:1 p.m.4 views

CVE-2026-45713 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

7.5CVSS5.4AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/20 3:1 p.m.37 views

CVE-2026-45713 Mailpit: Unauthenticated remote memory-exhaustion DoS via unlimited SMTP DATA and /api/v1/send body sizes

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...

7.5CVSS0.00388EPSS
SaveExploits1References2
The Hacker News
The Hacker News
added 2026/07/20 1:32 p.m.14 views

⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More

A single request should not be able to do this much. But this week, small inputs led to code execution, memory loss, stolen keys, and disabled security tools. The paths were often simple: exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery. Some bugs...

9.8CVSS9.5AI score0.05985EPSS
SaveExploits1
RedHat Linux
RedHat Linux
added 2026/07/20 1:23 p.m.16 views

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

3.3CVSS6.3AI score0.00185EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/20 12:4 p.m.35 views

CVE-2026-63735 SurrealDB before 3.2.0 Authentication Bypass via Custom API

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by...

8.6CVSS0.00263EPSS
SaveExploits0References2
GithubExploit
GithubExploit
added 2026/07/20 10:41 a.m.68 views

Exploit for CVE-2026-60137

/ / / / / / | |/ / \ / /...

9.8CVSS6AI score0.98417EPSS
SaveExploits70
Veracode
Veracode
added 2026/07/20 10:33 a.m.7 views

Information Disclosure

phpMyFAQ is vulnerable to Information Disclosure. The vulnerability is due to inconsistent access control on public FAQ API endpoints, where inactive or unpublished FAQ entries are returned without proper status validation, allowing unauthenticated attackers to access non-public FAQ content...

6.9CVSS5.2AI score0.00214EPSS
SaveExploits0References1Affected Software2
NVD
NVD
added 2026/07/20 7:16 a.m.13 views

CVE-2026-10081

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

8.8CVSS0.00292EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/20 6:0 a.m.35 views

CVE-2026-8825 Elementor < 4.1.4 - Contributor+ Sensitive Information Disclosure via REST API

The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing authenticated users with Contributor-level access and above to retrieve the title, body and metadata of private posts, privat...

0.00234EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/20 6:0 a.m.35 views

CVE-2026-10755 All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration

The All in One SEO WordPress plugin before 4.9.9 does not correctly restrict access to some of its AI integration REST API endpoints, allowing users with low-level privileges such as Contributors to overwrite or reset the site-wide AI integration state...

0.00168EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/20 6:0 a.m.7 views

CVE-2026-10081

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

5.2AI score0.00292EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/20 6:0 a.m.36 views

CVE-2026-10081 Unlimited Elements for Elementor < 2.0.11 - Unauthenticated Stored XSS via Google Reviews Widget

The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Goog...

0.00292EPSS
SaveExploits0References1
Packet Storm News
Packet Storm News
added 2026/07/20 12:0 a.m.9 views

WordPress 5.6+ SkelerSecurity Core Security Plugin REST Batch API Mitigation

This WordPress plugin provides a temporary mitigation for the REST Batch API vulnerability chain commonly referred to as "wp2shell." It requires authentication before requests to the /wp-json/batch/v1 and ?restroute=/batch/v1 endpoints are processed, preventing unauthenticated exploitation of the...

9.8CVSS5.6AI score0.98417EPSS
SaveExploits68
Tenable Nessus
Tenable Nessus
added 2026/07/20 12:0 a.m.4 views

Fedora 43 : c-ares (2026-d70d93fcd7)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-d70d93fcd7 advisory. 1.34.7 accidentally broke the API compatibility, this is fixed in 1.34.8. ---- - update to 1.34.7 - fixes CVE-2026-33630 GHSA-6wfj-rwm7-3542 and...

5.5AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/20 12:0 a.m.16 views

PT-2026-61551

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0 Description Custom API routes fail to validate namespace and database scope, which allows authenticated users to invoke endpoints across different namespaces or databases. An attacker with valid credentials fo...

8.6CVSS5.9AI score0.00263EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/20 12:0 a.m.10 views

PT-2026-61734

Name of the Vulnerable Software and Affected Versions FlareSolverr versions prior to 3.4.7 Description A server-side request forgery SSRF issue exists in the '/v1' API endpoint. This flaw allows a remote attacker to induce the server to make requests to an unintended location, potentially enablin...

5.4AI score0.00288EPSS
SaveExploits0References3
GithubExploit
GithubExploit
added 2026/07/19 7:0 p.m.69 views

Exploit for CVE-2026-63030

wp2shell-check Non-intrusive exposure checker for the WordPre...

9.8CVSS5.9AI score0.98417EPSS
SaveExploits70
GithubExploit
GithubExploit
added 2026/07/19 5:32 p.m.67 views

Exploit for CVE-2026-63030

wp2Shell Scanner – with PoC CVE-2026-63030 and CVE-2026-601...

9.8CVSS5.8AI score0.98417EPSS
SaveExploits70
GithubExploit
GithubExploit
added 2026/07/19 8:52 a.m.84 views

Exploit for CVE-2026-60137

wp2shell-scanner by @bahartanirhttps://github.com/baha...

9.8CVSS6.4AI score0.98417EPSS
SaveExploits70
Rows per page
Query Builder