Lucene search
+L

103767 matches found

Snyk
Snyk
added 2026/07/14 8:28 p.m.9 views

Operation on a Resource after Expiration or Release

Overview Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release due to the lack of enforcement of certificate revocation in the mesh network. An attacker can maintain unauthorized access to internal services and peers by continuing to use a revoked...

8.6CVSS5.4AI score
SaveExploits0References3
OSV
OSV
added 2026/07/14 7:17 p.m.7 views

DEBIAN-CVE-2026-47767

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...

9.8CVSS6.1AI score0.00389EPSS
SaveExploits0References1
Debian CVE
Debian CVE
added 2026/07/14 6:38 p.m.9 views

CVE-2026-47767

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 5.4.46 until 5.4.52, 6.4.40, 7.4.12, and 8.0.12, the CVE-2024-50340 fix gated runtime argv parsing on empty$GET, but parsestr and the web SAPI can disagree, allowing a crafted query string to...

9.8CVSS5.4AI score0.00389EPSS
SaveExploits0
NVD
NVD
added 2026/07/14 6:17 p.m.8 views

CVE-2026-50331

Use after free in Windows Application Model allows an authorized attacker to elevate privileges locally...

7.8CVSS0.0024EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/14 5:7 p.m.31 views

CVE-2026-15747 Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle

Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. csrftoken generates and caches one token per session and returns the same value on every call, and csrffield places that value in a hidden csrftoken input...

0.00255EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/07/14 5:6 p.m.9 views

CVE-2026-50331 Windows Application Model Core API Elevation of Privilege Vulnerability

...

7.8CVSS6.1AI score0.0024EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/14 5:6 p.m.19 views

CVE-2026-50331

CVE-2026-50331 is a Windows Application Model Core API elevation-of-privilege vulnerability caused by a use-after-free issue. It affects the Windows Application Model Core API component and allows an authorized attacker with local access to elevate privileges. Microsoft has issued updates to addr...

7.8CVSS6AI score0.0024EPSS
SaveExploits0References1Affected Software11
Cvelist
Cvelist
added 2026/07/14 5:6 p.m.37 views

CVE-2026-50331 Windows Application Model Core API Elevation of Privilege Vulnerability

...

7.8CVSS0.0024EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/14 3:8 p.m.11 views

EEF-CVE-2026-55954 Missing ID token claim validation in ueberauth_apple allows account takeover

Summary Authentication Bypass by Spoofing vulnerability in ueberauth ueberauth\apple allows account takeover via unvalidated ID token claims. The Ueberauth.Strategy.Apple.Token.payload/2 function verifies the JWT signature of the callback id\token against Apple's JWKS but does not validate any...

9.1CVSS6.1AI score0.00411EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/14 3:8 p.m.33 views

CVE-2026-55954

CVE-2026-55954 affects ueberauth_apple (v0.1.0 up to but not including v0.6.2). The root cause is lack of validation for registered ID token claims (iss, aud, exp, iat) in Ueberauth.Strategy.Apple.Token.payload/2; the code uses the unvalidated sub to derive the user uid and email. An attacker who...

9.1CVSS6.1AI score0.00411EPSS
SaveExploits0References4
Microsoft CVE
Microsoft CVE
added 2026/07/14 2:0 p.m.14 views

Windows Application Model Core API Elevation of Privilege Vulnerability

Use after free in Windows Application Model allows an authorized attacker to elevate privileges locally...

7.8CVSS6.1AI score0.0024EPSS
SaveExploits0
CVE
CVE
added 2026/07/14 10:10 a.m.42 views

CVE-2026-15389

Sesame Time web app and its REST v3 API expose an access-control weakness in session management: USID is used as the sole validator without verifying ownership, enabling session impersonation when a valid USID is obtained. The flaw is worsened by poor session lifecycle management, as new logins g...

8.7CVSS6AI score0.00275EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/14 9:45 a.m.22 views

CVE-2026-3014

CVE-2026-3014 concerns Milestone XProtect. A vulnerability in the Management Server API could allow users with edit permissions on the Management Server to execute arbitrary code in the context of the Management Server Service. Milestone has released a new version of XProtect with cumulative patc...

9.1CVSS6.2AI score0.00476EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
added 2026/07/14 9:16 a.m.16 views

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

5.3CVSS6.1AI score0.00228EPSS
SaveExploits1References2
OSV
OSV
added 2026/07/14 8:56 a.m.8 views

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

5.3CVSS6.1AI score
SaveExploits0References4
Debian CVE
Debian CVE
added 2026/07/14 8:56 a.m.8 views

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker only...

5.3CVSS5.2AI score0.00228EPSS
SaveExploits1
Nuclei
Nuclei
added 2026/07/14 7:7 a.m.85 views

Apache OFBiz - Remote Code Execution

Apache OFBiz below 18.12.16 is vulnerable to unauthenticated remote code execution on Linux and Windows. An attacker with no valid credentials can exploit missing view authorization checks in the web application to execute arbitrary code on the server id: CVE-2024-45195 info: name: Apache OFBiz -...

9.8CVSS7.7AI score0.99983EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/14 1:16 a.m.9 views

CVE-2026-44752

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data...

8.2CVSS0.00264EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/14 12:21 a.m.10 views

EUVD-2026-43593

SAP S/4HANA application Project Management PPM-PRO allows an attacker with high privileges to execute crafted database queries, exposing the backend database. This results in low impact on confidentiality, with no impact on integrity and availability of the application...

5.5CVSS6.2AI score0.00197EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/14 12:19 a.m.20 views

CVE-2026-44753

CVE-2026-44753 affects SAP HANA Database (User Self Service) / Extended Application Services classic model. An unauthenticated attacker can send specially crafted requests to obtain distinguishable responses that enumerate valid user accounts and email addresses. Impact is described as low confid...

3.7CVSS6.1AI score0.0022EPSS
SaveExploits0References2
Rows per page
Query Builder