Lucene search
+L

103732 matches found

Cvelist
Cvelist
added 2026/07/21 8:28 p.m.28 views

CVE-2026-65054 MediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API...

8.2CVSS0.00202EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/21 8:24 p.m.7 views

GHSA-683J-3FF6-HH2X Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea's API endpoint for creating Personal Access Tokens POST /users/username/tokens is protected by a middleware reqBasicOrRevProxyAuth that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in t...

8.7CVSS5.6AI score
SaveExploits0References7
OSV
OSV
added 2026/07/21 8:12 p.m.5 views

CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

8.3CVSS5.5AI score
SaveExploits0References5
CVE
CVE
added 2026/07/21 8:12 p.m.40 views

CVE-2026-16317

The flaw affects s2n-tls (TLS 1.3) where the outer content_type byte is not covered by the AEAD tag because it is hardcoded in AAD instead of using the wire byte. This allows an active MITM to silently discard individual application_data records without detection, enabling selective suppression o...

8.3CVSS5.3AI score0.00186EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/21 11:39 a.m.6 views

CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

6.9CVSS5.4AI score
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.7 views

PT-2026-62644

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2 Description An issue in the Common Application Objects component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

9.1CVSS7.1AI score0.00377EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.5 views

PT-2026-62999

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description A flaw in the Core component of the Oracle Application Object Library allows a low-privileged attacker with access to the execution infrastructure to compromise the...

6.5CVSS7.4AI score0.00148EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.5 views

PT-2026-62568

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u491 and 8u491-perf Description An issue exists in the Installation component that allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Successful...

6.7CVSS7.1AI score0.0014EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.12 views

PT-2026-63016

Name of the Vulnerable Software and Affected Versions Oracle Commerce Platform version 11.4.0 Description A flaw in the Dynamo Application Framework component allows an unauthenticated attacker with network access via HTTP to compromise the system. This can lead to unauthorized access to critical...

9.1CVSS7.1AI score0.00354EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.9 views

PT-2026-63099

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: Core. Supported versions that are affected are 8.2 and 8.3. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP/IP to compromise Oracle...

8.1CVSS7.2AI score0.00348EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.9 views

PT-2026-63001

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Obje...

7.4CVSS7.1AI score0.00317EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.8 views

PT-2026-62770

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description A flaw in the Core component of the Oracle Application Object Library allows a low privileged attacker with network access via HTTPS to compromise the system. This...

9.6CVSS7.2AI score0.00335EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.9 views

PT-2026-62774

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Application Object Library versions 12.2.3 through 12.2.15 Description A flaw in the Core component of the Oracle Application Object Library allows a low privileged attacker with network access via HTTP to...

6.3CVSS7.1AI score0.00251EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/21 12:0 a.m.6 views

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

9.8CVSS5.1AI score0.00345EPSS
SaveExploits1References3
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.10 views

PT-2026-63261

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user with limited feature privileges to access workflow execution outputs within their Kibana space. This occurs because the documented API does not properly...

4.3CVSS6AI score0.002EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.10 views

PT-2026-63004

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue in the Core component of the Oracle Application Object Library allows an unauthenticated attacker with network access via HTTP to...

7.5CVSS7.2AI score0.00324EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.4 views

PT-2026-63002

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue exists within the DB Privileges component of the Oracle Application Object Library. A low privileged attacker with network access via HTTP can compromise th...

7.5CVSS7.1AI score0.00311EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.7 views

PT-2026-62773

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue exists in the AOL Generic Loader component of the Oracle Application Object Library product of Oracle E-Business Suite. A high privileged attacker with acce...

6.7CVSS7.1AI score0.00181EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.6 views

PT-2026-62777

Name of the Vulnerable Software and Affected Versions Oracle iReceivables versions 12.2.3 through 12.2.15 Description A flaw in the AR Web Utilities component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a complete...

8.8CVSS7.1AI score0.00402EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/21 12:0 a.m.7 views

PT-2026-63098

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: Security. The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with network access via TLS to compromise Oracle...

8CVSS7.2AI score0.00333EPSS
SaveExploits0References2
Rows per page
Query Builder