Lucene search
+L

196711 matches found

ATTACKERKB
ATTACKERKB
added 2026/07/09 6:32 p.m.12 views

CVE-2026-58198

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

5.5CVSS5.9AI score0.00095EPSS
SaveExploits0References5Affected Software1
CVE
CVE
added 2026/07/09 6:32 p.m.38 views

CVE-2026-58198

ChatterBot (Python) vulnerability CVE-2026-58198: UbuntuCorpusTrainer.extract() uses a predictable home path (~/.ubuntu_data/ubuntu_dialogs) with a check-then-create pattern, then tar.extractall(path=self.data_path). An attacker who pre-places a symlink at that path can cause archived contents to...

5.5CVSS5.9AI score0.00095EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/09 6:32 p.m.9 views

CVE-2026-58198 ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

5.5CVSS6.1AI score
SaveExploits0References6
EUVD
EUVD
added 2026/07/09 6:32 p.m.14 views

EUVD-2026-42685

ChatterBot is a machine learning, conversational dialog engine for creating chat bots. Prior to 1.2.14, UbuntuCorpusTrainer.extract uses a predictable home-rooted output directory /ubuntudata/ubuntudialogs with a check-then-create pattern followed by tar.extractallpath=self.datapath, allowing a...

5.5CVSS5.9AI score0.00095EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/09 6:31 p.m.18 views

EUVD-2026-42640

MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without...

6AI score0.00372EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/09 5:45 p.m.28 views

CVE-2026-15204

TOTOLINK X5000R is affected by CVE-2026-15204. The OpenVPN Export feature (file /web/cgi-bin/cstecgi.cgi, function exportOvpn) is vulnerable to path traversal. The vulnerability can be exploited remotely. Details in connected records identify the affected product/version (9.1.0cu.2415_B20250515/9...

6.9CVSS6AI score0.00488EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/09 5:16 p.m.14 views

CVE-2026-51597

MERCURY MIPC252W IP camera v1.0.5 Build 230306 Rel.79931n does not implement nonce expiration in RTSP Digest authentication. An adjacent network attacker can capture a legitimate authentication exchange and replay the nonce and response values in a new connection to bypass authentication without...

9.1CVSS0.00372EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/09 5:15 p.m.8 views

CVE-2026-15195 apidevtools json-schema-ref-parser pointer.ts Pointer.set prototype pollution

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...

5.3CVSS5.9AI score
SaveExploits0References10
ATTACKERKB
ATTACKERKB
added 2026/07/09 5:15 p.m.11 views

CVE-2026-15195

A weakness has been identified in apidevtools json-schema-ref-parser up to 15.3.5. This impacts the function Refs.set/Pointer.set in the library lib/pointer.ts. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched...

6.5CVSS6.3AI score0.00262EPSS
SaveExploits0References9Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/09 5:10 p.m.12 views

CVE-2026-13462

PayRange Android app, version 7.0.7 and below, contains an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote and unauthenticated attacker can steal information that the user sends...

7.5CVSS6AI score0.00282EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/07/09 4:49 p.m.13 views

PYSEC-2026-2964 Plone unauthorized member addition vulnerability

Plone 3.3.0 through 3.3.6, 4.0.0 through 4.0.10, 4.1.0 through 4.1.6, 4.2.0 through 4.2.7, 4.3.0 through 4.3.6, and 5.0rc1 allows remote attackers to add a new member to a Plone site with registration enabled, without acknowledgment of site administrator...

8.2CVSS6.6AI score0.0202EPSS
SaveExploits0References12
OSV
OSV
added 2026/07/09 4:49 p.m.5 views

PYSEC-2026-2885 Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

8.8CVSS7AI score0.01423EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/09 4:49 p.m.6 views

PYSEC-2026-2882 Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata therefore, only available to the Manager role...

8.8CVSS7AI score0.01423EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/09 4:49 p.m.6 views

PYSEC-2026-2880 Improper Restriction of XML External Entity Reference in Plone

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role...

8.8CVSS7AI score0.01423EPSS
SaveExploits0References7
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/09 4:19 p.m.34 views

Malicious code in cookie-parser-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c6c2bd7c1b5b363e72753401f6edebf816965a625227e6523210e4620ce9bb8a cookie-parser-js impersonates the widely used cookie-parser package: it copies TJ Holowaychuk / Doug Wilson author metadata, the description, the...

6.6AI score
SaveExploits0References7
NVD
NVD
added 2026/07/09 4:16 p.m.24 views

CVE-2026-59208

n8n is an open source workflow automation platform. Prior to 2.27.4 and from 2.28.0 prior to 2.28.1, n8n instances configured with more than one trusted token-exchange issuer resolved external identities to local accounts using only the JWT sub claim and ignored the iss claim, allowing an attacke...

7.6CVSS0.00314EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/09 3:54 p.m.8 views

MAL-2026-10061 Malicious code in cursed-ecto-d3ab00 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49348969de68b56d680a46f67f817053621fa41a5220d8cd0bc1da720e77a5a1 The package has no legitimate functionality index.js is an empty module and exists solely to run an install-time attack payload. All four lifecycle...

6.2AI score
SaveExploits0References5
OSV
OSV
added 2026/07/09 3:45 p.m.10 views

MAL-2026-10081 Malicious code in webrix-docs1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20cdefe1415c5b5245f36b10ea0de9033433b479768c2cc785ad2742b9433fce The package declares a preinstall hook node index.js that fires automatically on npm install. The script requires childprocess, os, https, and http,...

6.1AI score
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/07/09 3:24 p.m.10 views

CVE-2026-58203

A flaw was found in the pydantic-settings component. When configured to handle nested secrets, this vulnerability allows an attacker to read sensitive files from outside the designated secrets directory. By placing a specially crafted symbolic link within the secrets directory, an attacker can...

5.3CVSS5.9AI score0.00179EPSS
SaveExploits1References4
RedHat Linux
RedHat Linux
added 2026/07/09 2:40 p.m.10 views

openssh: OpenSSH: Brute-force attacks facilitated due to insufficient authentication delay

A flaw was found in OpenSSH's SSH daemon sshd. A remote attacker could exploit this vulnerability by repeatedly attempting authentication. The flaw allows the attacker to bypass the intended minimum authentication delay, which can facilitate brute-force attacks. This makes it easier for an attack...

6.5CVSS6.1AI score0.00291EPSS
SaveExploits0References7
Rows per page
Query Builder