Lucene search
+L

197512 matches found

Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.10 views

PT-2026-58201

Name of the Vulnerable Software and Affected Versions Windows Kernel affected versions not specified Description A use after free issue in the Windows Kernel allows an authorized attacker to elevate privileges locally. Use after free is a memory corruption flaw that occurs when an application...

7.1CVSS6.3AI score0.0024EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.15 views

PT-2026-58656

Name of the Vulnerable Software and Affected Versions Windows USB Print Driver affected versions not specified Description A race condition occurs in the Windows USB Print Driver due to improper synchronization when using a shared resource. This allows an authorized attacker with physical access ...

6.3CVSS6.1AI score0.00171EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.19 views

PT-2026-58377

Name of the Vulnerable Software and Affected Versions Windows 11 affected versions not specified Windows Server 2025 affected versions not specified Description A race condition exists in Windows Media, where concurrent execution using a shared resource with improper synchronization allows an...

8.8CVSS6.2AI score0.00393EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.13 views

PT-2026-58647

Name of the Vulnerable Software and Affected Versions Microsoft Input Method Editor IME affected versions not specified Description A heap-based buffer overflow occurs in the Microsoft Input Method Editor IME, which is a system component that allows users to input characters for languages that do...

8.8CVSS6.1AI score0.00317EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/14 12:0 a.m.14 views

PT-2026-58401

Name of the Vulnerable Software and Affected Versions Windows NTFS affected versions not specified Description An out-of-bounds read in the Windows NTFS file system allows an authorized local attacker to elevate their privileges. An out-of-bounds read occurs when a program reads data past the end...

7.8CVSS6.1AI score0.00311EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/14 12:0 a.m.7 views

CVE-2025-56361

A reachable assertion vulnerability exists in the Matter SDK connectedhomeip 1.3 thru 1.4, specifically within the Level Control cluster's server tick logic emberAfLevelControlClusterServerTickCallback. When a MoveToLevel command is executed and followed by a conflicting write to the OperationMod...

7.5CVSS5.4AI score
SaveExploits0References4
OSV
OSV
added 2026/07/13 11:49 p.m.22 views

GHSA-8F6J-263M-G72X Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks

Summary SignedDataVerifier attempts to perform online revocation checking when enableonlinechecks=True, but its OCSP validation logic accepts stale GOOD responses as valid indefinitely. In appstoreserverlibrary/signeddataverifier.py, ChainVerifier.checkocspstatus verifies the OCSP response...

6.9CVSS6.1AI score
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/13 11:45 p.m.11 views

CVE-2026-15618

A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. The affected element is the function guardExecCommand of the file tools/toolexec.go of the component exec Safety Guard. The manipulation results in protection mechanism failure. It is possible to launch the attack remotely. The...

7.5CVSS6.3AI score0.0024EPSS
SaveExploits0References6Affected Software1
NVD
NVD
added 2026/07/13 11:16 p.m.12 views

CVE-2026-15605

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A hig...

3.1CVSS0.00151EPSS
SaveExploits0References7
CVE
CVE
added 2026/07/13 10:45 p.m.25 views

CVE-2026-15605

The vulnerability CVE-2026-15605 affects wandb 0.25.2.dev1, specifically the ArtifactManifestEntry.download path in wandb/sdk/lib/hashutil.py under Artifact Integrity Validation. The issue is described as the use of a weak hash due to manipulating the ArtifactManifestEntry.download, with the atta...

3.1CVSS5.5AI score0.00151EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/07/13 10:45 p.m.43 views

CVE-2026-15605 wandb Artifact Integrity Validation hashutil.py ArtifactManifestEntry.download weak hash

A security vulnerability has been detected in wandb 0.25.2.dev1. Affected is the function ArtifactManifestEntry.download in the library wandb/sdk/lib/hashutil.py of the component Artifact Integrity Validation. The manipulation leads to use of weak hash. The attack may be initiated remotely. A hig...

3.1CVSS0.00151EPSS
SaveExploits0References7
NVD
NVD
added 2026/07/13 10:16 p.m.18 views

CVE-2026-62239

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the downloadandcopy function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the...

6.6CVSS0.00129EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/13 10:16 p.m.14 views

CVE-2026-62184

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP...

8.7CVSS0.00445EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/13 10:16 p.m.15 views

CVE-2026-15598

A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the library lib/util/object.js. Executing a manipulation of the argument path can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. The...

6.5CVSS0.00313EPSS
SaveExploits1References5
NVD
NVD
added 2026/07/13 10:16 p.m.10 views

CVE-2026-15681

AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in order t...

5.5CVSS0.00104EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/13 9:31 p.m.9 views

CVE-2026-15682

AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allows local attackers to create a denial-of-service condition on affected installations of AnyDesk. An attacker must first obtain the ability to execute low-privileged code on the target system in orde...

4.7CVSS6.3AI score0.00131EPSS
SaveExploits1References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/13 9:30 p.m.8 views

CVE-2026-62184

luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IPv4 address from log lines regardless of field position, allowing attackers to inject arbitrary IPs via attacker-controlled fields like usernames. An unauthenticated remote attacker can inject an IP...

8.7CVSS6.2AI score0.00445EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/07/13 9:30 p.m.9 views

CVE-2026-61458 PasswordPusher < 2.9.2 Passphrase Brute-Force via Unthrottled Endpoint

PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoint that lacks route-specific rate limiting and per-push lockout mechanisms. Attackers who know a push token can systematically guess passphrases at 120 attempts per minute without triggering any...

8.7CVSS6.1AI score0.00304EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/13 9:3 p.m.8 views

CVE-2026-62239 FlashAttention Symlink Attack via tarfile.extractall in hopper/setup.py

FlashAttention through 2.8.3.post1, fixed in commit 0816ef1, contains a symlink attack vulnerability in the downloadandcopy function within hopper/setup.py that extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can pre-plant a symlink in the...

5.3CVSS6.2AI score
SaveExploits0References7
CVE
CVE
added 2026/07/13 9:3 p.m.28 views

CVE-2026-62239

FlashAttention (up to 2.8.3.post1) contains a symlink attack in hopper/setup.py: download_and_copy() extracts NVIDIA toolchain archives without validating symlinks or filtering tar members. A local attacker can plant a predictable symlink in the cache to redirect extracted binaries to a chosen lo...

6.6CVSS6.2AI score0.00129EPSS
SaveExploits0References4
Rows per page
Query Builder