Lucene search
+L

195286 matches found

Positive Technologies
Positive Technologies
added 2026/07/18 12:0 a.m.14 views

PT-2026-60980

A weakness has been identified in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /prescriptionrecord.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to...

6.5CVSS5.4AI score0.002EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/18 12:0 a.m.16 views

PT-2026-60975

A security flaw has been discovered in zevorn rt-claw up to 0.2.0. This impacts the function receiver thread of the file claw/services/swarm/swarm.c of the component http request. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The...

7.5CVSS5.1AI score0.00288EPSS
SaveExploits0References7
Tenable Nessus
Tenable Nessus
added 2026/07/18 12:0 a.m.7 views

Linux Distros Unpatched Vulnerability : CVE-2026-48487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in...

5.3CVSS5.3AI score0.00203EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/07/18 12:0 a.m.6 views

Oracle Linux 10 : mod_http2 (ELSA-2026-22528)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-22528 advisory. - Resolves: RHEL-188008 - address CVE-2026-43951, CVE-2026-48913 - Resolves: RHEL-182410 - modhttp2: HTTP/2: Remote Denial of Service via compression bomb and...

7.5CVSS5.5AI score0.27984EPSS
SaveExploits9References2
EUVD
EUVD
added 2026/07/17 8:44 p.m.13 views

EUVD-2026-45331

IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files by specifying absolute paths pointing to victim storage locations. In append mode, the attacker's workflow reads victim file contents,...

8.1CVSS5.5AI score0.00205EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/17 8:42 p.m.6 views

CVE-2026-50271

Datadog dd-trace-py is the Datadog Python APM client. Prior to 4.8.2, Datadog tracing libraries that implement W3C baggage propagation parse incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES limits on the extract path. A remote, unauthenticated...

7.5CVSS5.4AI score0.00441EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/07/17 8:28 p.m.5 views

CVE-2026-50272 dd-trace: Improper parsing of W3C baggage headers may lead to DoS

dd-trace is the Datadog APM client for Node.js. Prior to 5.100.0, W3C baggage propagation in packages/dd-trace/src/baggage.js and packages/dd-trace/src/opentracing/propagation/textmap.js parsed incoming baggage HTTP headers without enforcing DDTRACEBAGGAGEMAXITEMS or DDTRACEBAGGAGEMAXBYTES on...

7.5CVSS5.5AI score
SaveExploits0References6
EUVD
EUVD
added 2026/07/17 7:49 p.m.12 views

EUVD-2026-45302

IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions...

3.9CVSS5.2AI score0.00097EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/17 7:49 p.m.40 views

CVE-2026-14971 This PowerVM Novalink update is being released to address

IBM PowerVM Novalink 2.2.02.2.12.2.1.1, and 2.3.02.3.0.12.3.12.3.2 IBM NovaLink APIs misconfiguration may increase attack surface and enable unintended or unauthorized operations under non-default conditions...

3.9CVSS0.00097EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/17 7:38 p.m.9 views

EUVD-2026-45261

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation...

9.3CVSS5.3AI score0.00321EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/07/17 7:34 p.m.6 views

CVE-2026-48978 oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as...

2.1CVSS5.2AI score0.00211EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/17 7:32 p.m.12 views

EUVD-2026-45292

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message and downgrade the Transport Layer Security TLS protocol to a version disabled in the server configuration...

5.9CVSS5.4AI score0.00253EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/17 7:32 p.m.37 views

CVE-2026-4942 IBM i is Affected by Algorithm Downgrade in Transport Layer Security []

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to send a specifically crafted message and downgrade the Transport Layer Security TLS protocol to a version disabled in the server configuration...

5.9CVSS0.00253EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/17 7:17 p.m.5 views

DEBIAN-CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in src/zeroconf/protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self.datalen, allowing unauthenticated hosts on th...

5.3CVSS5.3AI score0.00203EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/17 6:26 p.m.8 views

CVE-2026-9171

IBM WebSphere Application Server and WebSphere Application Server Liberty are vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources...

7.5CVSS5.9AI score0.00314EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/17 6:22 p.m.7 views

CVE-2026-47183 Zeroconf: Unbounded exception-dedup state retains packet buffers via traceback frame locals, enabling LAN-local memory exhaustion

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming.logexceptiondebug and the four QuietLogger exception-dedup methods stored an unbounded seenlogs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.excinfo...

6.5CVSS5.2AI score
SaveExploits0References7
CVE
CVE
added 2026/07/17 6:21 p.m.59 views

CVE-2026-47180

CVE-2026-47180 affects the Zeroconf Python library. The vulnerability stems from DNSIncoming._decode_labels_at_offset recursing for each DNS-name compression pointer; a crafted mDNS packet with ~1500 chained pointers can cause unbounded recursion, escaping DNSIncoming.init and triggering sustaine...

6.5CVSS5.2AI score0.0023EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/17 6:19 p.m.11 views

CVE-2026-53712

SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. Prior to 3.3, a flaw in com.ongres.scram:scram-client and com.ongres.scram:scram-common allows an attacker capable of a TLS...

8.2CVSS5.3AI score0.00167EPSS
SaveExploits0References3Affected Software1
Vulnrichment
Vulnrichment
added 2026/07/17 6:16 p.m.10 views

CVE-2026-49835 Sigstore Timestamp Authority: OOM due to unbounded metric label cardinality

Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an...

5.9CVSS5.3AI score0.00447EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/17 5:17 p.m.11 views

CVE-2026-49212

Symfony UX is a JavaScript ecosystem for Symfony. From 2.8.0 until 2.36.0 and 3.1.0, the HMAC computed by Symfony\UX\LiveComponent\LiveComponentHydrator covered only sorted prop key/value pairs and did not include the component name, the slot identifier props vs propsFromParent, or request contex...

7.5CVSS0.00161EPSS
SaveExploits0References4
Rows per page
Query Builder