Lucene search
+L

1023 matches found

CVE
CVE
added 2026/08/24 1:12 p.m.13 views

CVE-2026-76847

act (nektos/act) versions 0.2.81 through 0.2.89 are affected by a missing authorization flaw in the Artifacts V4 backend , which is started whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. Three compounding issues enable unauthenticated artifact access: (1) val...

8.8CVSS5.3AI score
SaveExploits0References4
EUVD
EUVD
added 2026/08/24 1:12 p.m.11 views

EUVD-2026-64852

act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArtifact and DeleteArtifact, accept a caller-supplied...

8.8CVSS5.5AI score
SaveExploits0References4
OSV
OSV
added 2026/08/24 3:22 a.m.6 views

CVE-2026-19200 Velociraptor Analyst overwrites live built-in artifacts through verify()

The Velociraptor verify VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker...

8.9CVSS5.6AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/21 5:36 p.m.23 views

CVE-2026-41451 UAC < 3.3.0 Command Injection via User Substitution in parse_artifact.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the user substitution logic within parseartifact.sh where usernames and home directories from /etc/passwd are substituted directly into command strings without escaping before execution via eval...

8.5CVSS0.00719EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/21 5:35 p.m.11 views

CVE-2026-41450 UAC < 3.3.0 Command Injection via command_collector.sh

UAC Unix-like Artifacts Collector versions prior to 3.3.0 contain a command injection vulnerability in the commandcollector function where foreach command output lines are substituted directly into command strings via sed without proper escaping before being evaluated with eval. Attackers can...

8.5CVSS6.1AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/08/12 3:51 p.m.6 views

CVE-2026-69107

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...

5.9CVSS5.2AI score0.00281EPSS
SaveExploits0References3Affected Software1
EUVD
EUVD
added 2026/08/12 3:51 p.m.14 views

EUVD-2026-57319

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...

5.9CVSS5.2AI score0.00281EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/12 3:51 p.m.42 views

CVE-2026-69107

CVE-2026-69107 affects JFrog Artifactory. An unauthenticated user may access restricted artifacts under specific conditions. The CVSS v3.1 base score is 5.9 (MEDIUM), with Network attack vector, high attack complexity, no privileges required, and no user interaction. Impact is confidentiality los...

5.9CVSS5.2AI score0.00281EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/12 12:00 a.m.3 views

PT-2026-71142

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions...

5.9CVSS5.2AI score0.00281EPSS
SaveExploits0References3
AstraLinux
AstraLinux
added 2026/08/10 7:11 a.m.9 views

Astra Linux – Vulnerability in docker.io-app

Docker Compose relies on the path information embedded in remote OCI Compose artifacts. When a layer includes the annotations com.dockercompose.extends or com.dockercompose.envfile, Compose incorporates the value provided by the attacker from com.dockercompose.file/com.dockercompose.envfile into...

8.9CVSS8.6AI score0.13653EPSS
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/06 4:15 p.m.20 views

Malicious code in merchantweb-lang-cookie-reset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be package.json declares the sole dependency packet-table-thread-stream as a direct tarball URL to a non-npm host...

5.3AI score
SaveExploits0References10
OSV
OSV
added 2026/08/05 3:22 p.m.15 views

MAL-2026-13320 Malicious code in dolyame-boxy-independent-bnpl-main-banner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e31cd37951ea782d9a4a5cd23ad0524d154dccddbf0aef0d96cfdcaa29d03698 index.js unconditionally requires./bridge on load. bridge.js selects a per-platform payload linux x64/arm64, darwin, win32, fetches a native binary...

5.5AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/05 1:54 p.m.11 views

Malicious code in delivery-ci-sage (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b54c7175e494e683cdbc63814267aa5544f88d0373b929b9f0fe3fcb8202bd3 On require of the package, index.js loads loader.js which selects a platform-specific asset path and fetches a binary from one of four...

5.7AI score
SaveExploits0References2
OSV
OSV
added 2026/08/05 12:36 p.m.16 views

MAL-2026-12351 Malicious code in checkout-common-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0e9681cb5e7a197ca8d77ba29e20a4709fa0ff476f2ffb02f935785c6633e0 On require, index.js loads ext.js which selects a platform-specific payload URL from a rotating list of Cloudflare Workers subdomains hosts assembled...

5.6AI score
SaveExploits0References2
GithubExploit
GithubExploit
added 2026/08/04 5:05 p.m.31 views

Root-My-Galaxy-Payloads

Root My Galaxy Payloads This repository contains the device-s...

7.8CVSS7AI score0.00768EPSS
SaveExploits72
Snyk
Snyk
added 2026/08/03 9:00 p.m.15 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/03 5:02 p.m.15 views

Important: Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - thrift

AIPCC Security Alerts identified CVEs in the 3.5 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

9.8CVSS5.5AI score0.00551EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/03 5:01 p.m.9 views

Important: Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - thrift

AIPCC Security Alerts identified CVEs in the 3.4 release of base-images. The CVEs are listed with a severity level of "Important" or higher. RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...

9.8CVSS5.5AI score0.00551EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/07/28 1:33 p.m.13 views

CVE-2026-64643

A flaw was found in Next.js. Unauthenticated users can exploit this vulnerability by accessing publicly served client artifacts, which may disclose Server Action IDs. This bypasses authentication on pages where these endpoints are used, leading to information disclosure. While primarily an...

6.3CVSS5.8AI score0.00516EPSS
SaveExploits0References8
Malwarebytes
Malwarebytes
added 2026/07/28 12:33 p.m.23 views

Shared Claude chats were searchable on Google

Reddit users found that by using a specific Google search query, it was possible to find Claude conversations that users had shared. This exposed sensitive material, including crypto wallet keys, names, addresses, work notes, and even erotic or otherwise policy-violating chats. Fortune says...

5.6AI score
SaveExploits0
Rows per page
Query Builder