Lucene search
+L

59693 matches found

Github Security Blog
Github Security Blog
added 2026/07/16 7:19 p.m.16 views

Envoy Gateway: Nil-dereference when SecurityPolicy targets TCPRoute without spec.authorization

Vulnerability report without repro case. Repro case may be added later after harness is complete. Preconditions 4: - Tenant has SecurityPolicy + TCPRoute RBAC baseline - Tenant namespace permitted to attach TCPRoute to a Gateway listener - spec.authorization omitted the trigger - No admission...

6.1AI score0.00121EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2026/07/16 7:16 p.m.13 views

CVE-2026-46513

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hexrandombytes32 strings in ocapitokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stor...

7.4CVSS0.00261EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/07/16 7:12 p.m.11 views

kumactl connects to control plane without verifying TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...

6.1AI score
SaveExploits0References4Affected Software2
OSV
OSV
added 2026/07/16 7:12 p.m.6 views

GHSA-V95X-XHQ5-4929 kumactl connects to control plane without verifying TLS certificate when no CA is configured

When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...

5.5CVSS6.1AI score
SaveExploits0References4
OSV
OSV
added 2026/07/16 6:47 p.m.10 views

MAL-2026-10729 Malicious code in channel-worker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb42c8663e71b69abd887afe5b53f3c9d57bb405dd9e8ec4954eb1bf9bb0c033 The package's runtime code implements a remote command-and-control agent rather than a normal library. bin/cli.js hardcodes the endpoint...

6.2AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:42 p.m.29 views

Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99621af0900df34246c87811ea5c2a643f2b3805601136dcc0a6768e48af925f The PyPI package captcha-solve-api contains no captcha functionality and is instead a binary dropper disguised as an analytics SDK. A custom setuptoo...

6.7AI score
SaveExploits0References9
OSV
OSV
added 2026/07/16 6:42 p.m.9 views

MAL-2026-10755 Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99621af0900df34246c87811ea5c2a643f2b3805601136dcc0a6768e48af925f The PyPI package captcha-solve-api contains no captcha functionality and is instead a binary dropper disguised as an analytics SDK. A custom setuptoo...

6.7AI score
SaveExploits0References9
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:41 p.m.27 views

Malicious code in hehehe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 588dd776720f805d7d84a58c93ffcd21ed860e3fc21a48787d732eb6180b974d Package is published as an 'enterprise Windows Diagnostic Utility' but is an anti-proctoring cheating tool that also steals the installer's browser...

6.1AI score
SaveExploits0References3
NVD
NVD
added 2026/07/16 6:16 p.m.13 views

CVE-2026-15945

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

4.3CVSS0.00193EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/16 6:14 p.m.13 views

CVE-2026-46513 Frogman: API tokens stored in plaintext

Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.2, Frogman stored API tokens generated by Tools/CreateApiToken.php:33-36 as raw bin2hexrandombytes32 strings in ocapitokens, and Frogman.class.php:78 authenticated the X-Frogman-Token header by comparing it with the stor...

7.4CVSS6.1AI score
SaveExploits0References6
CVE
CVE
added 2026/07/16 6:6 p.m.18 views

CVE-2026-46353

BigBlueButton vulnerability CVE-2026-46353 affects the bbb-web component. Before version 3.0.21, checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send vali...

8.1CVSS6.1AI score0.00266EPSS
SaveExploits0References3
GithubExploit
GithubExploit
added 2026/07/16 5:49 p.m.81 views

Exploit for Path Traversal in Gogs

Gogs Arbitrary File Write to RCE CVE-2025-8110 - Exploit de...

8.8CVSS7.1AI score0.82482EPSS
SaveExploits21
NVD
NVD
added 2026/07/16 5:16 p.m.29 views

CVE-2026-63087

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

9.8CVSS0.00427EPSS
SaveExploits0References2
GithubExploit
GithubExploit
added 2026/07/16 5:13 p.m.75 views

Exploit for Eval Injection in Langflow

CVE-2026-33017 - Langflow RCE Vulnerability xpl0ited by infr...

9.8CVSS7.4AI score0.99836EPSS
SaveExploits24
OSV
OSV
added 2026/07/16 5:1 p.m.8 views

CVE-2026-46687 Emlog Local File Inclusion (LFI)

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from apicontroller.php without validation, and logcontroller.php later checks fileexists and calls include View::getView$template, allowing an...

7.7CVSS6.2AI score
SaveExploits0References3
Snyk
Snyk
added 2026/07/16 4:36 p.m.7 views

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via CodeMethodWriter in CodeMethodWriter.cs and RubyConventionService in RubyConventionService.cs. An attacker can inject arbitrary Ruby code into generated client classes by supplying an OpenAPI specification...

9.2CVSS6AI score0.01471EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/16 4:36 p.m.7 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the LanguageInformation handling in Kiota.Builder.Models.LanguageInformation and GenerationConfiguration when it reads x-ms-kiota-info clientClassName and clientNamespaceName values. An attacker can overwrite...

9.8CVSS6.4AI score0.01355EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/16 4:19 p.m.16 views

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...

9.3CVSS0.01275EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/16 4:19 p.m.18 views

CVE-2026-59865

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota info read x-ms-kiota-info.languagesInformation..dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command,...

9.3CVSS0.0319EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/16 4:6 p.m.10 views

CVE-2026-46562

Yamcs is a mission control framework. Prior to 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text in yamcs-core/src/main/java/org/yamcs/algorithms/ScriptAlgorithmExecutorFactory.java was constructed without a ClassFilter, so a user with the...

9.8CVSS6.3AI score0.0078EPSS
SaveExploits1References6Affected Software1
Rows per page
Query Builder