Lucene search
+L

21041 matches found

NVD
NVD
added 2026/07/17 5:17 p.m.11 views

CVE-2026-54496

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2gadgets 0.5.0, orchard 0.14.0, zcashprimitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2gadgets/src/ecc/chip/mul/incomplete.rs used assignadvice for the base point without a copy...

9.3CVSS0.0021EPSS
SaveExploits0References7
CVE
CVE
added 2026/07/17 4:59 p.m.29 views

CVE-2026-54496

CVE-2026-54496 affects Zebrad and related crates (halo2_gadgets, orchard, zcash_primitives, zcashd) prior to fixed versions. Root cause: the variable-base scalar multiplication gadget uses assign_advice() to feed the base point in halo2_gadgets—without a copy constraint tying it to the real base—...

9.3CVSS5.3AI score0.0021EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/17 4:59 p.m.8 views

CVE-2026-54496 Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2gadgets 0.5.0, orchard 0.14.0, zcashprimitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2gadgets/src/ecc/chip/mul/incomplete.rs used assignadvice for the base point without a copy...

9.3CVSS5.3AI score
SaveExploits0References9
ATTACKERKB
ATTACKERKB
added 2026/07/17 4:59 p.m.11 views

CVE-2026-54496

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2gadgets 0.5.0, orchard 0.14.0, zcashprimitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2gadgets/src/ecc/chip/mul/incomplete.rs used assignadvice for the base point without a copy...

9.3CVSS5.4AI score0.0021EPSS
SaveExploits0References8Affected Software5
Cvelist
Cvelist
added 2026/07/17 4:59 p.m.39 views

CVE-2026-54496 Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2gadgets 0.5.0, orchard 0.14.0, zcashprimitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2gadgets/src/ecc/chip/mul/incomplete.rs used assignadvice for the base point without a copy...

9.3CVSS0.0021EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/17 10:9 a.m.9 views

RHSA-2026:40895 Red Hat Security Advisory: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

Bulletin has no description...

8.1CVSS4.8AI score0.00779EPSS
SaveExploits1References20
Tenable Nessus
Tenable Nessus
added 2026/07/17 12:0 a.m.5 views

Linux Distros Unpatched Vulnerability : CVE-2026-46338

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containmen...

4.3CVSS5.5AI score0.0031EPSS
SaveExploits1References3
Tenable Nessus
Tenable Nessus
added 2026/07/17 12:0 a.m.8 views

RockyLinux 9 : jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base (RLSA-2026:40895)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:40895 advisory. jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution CVE-2026-54513 jackson-databind: jackson-databind: Arbitrary code...

8.1CVSS6.4AI score0.00779EPSS
SaveExploits1References5
NVD
NVD
added 2026/07/16 7:16 p.m.12 views

CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

4.3CVSS0.0031EPSS
SaveExploits1References3
OSV
OSV
added 2026/07/16 7:16 p.m.5 views

UBUNTU-CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

4.3CVSS5.3AI score0.0031EPSS
SaveExploits1References5
OSV
OSV
added 2026/07/16 6:45 p.m.9 views

MAL-2026-10706 Malicious code in @agentvox/host (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a0482819726a3b7e7f36315f58ee95e3017bc649c2ea89958776c4985fe32ab The host daemon opens an outbound WebSocket connection to a hardcoded default proxy https://proxy.agentvox.bot and, on receipt of a session.open...

6.1AI score
SaveExploits0References1
EUVD
EUVD
added 2026/07/16 6:24 p.m.15 views

EUVD-2026-45003

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

4.3CVSS6.1AI score0.01658EPSS
SaveExploits2References3
OSV
OSV
added 2026/07/16 6:24 p.m.9 views

CVE-2026-46338 PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

4.3CVSS6.1AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/16 6:24 p.m.42 views

CVE-2026-46338 PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

4.3CVSS0.0031EPSS
SaveExploits1References3
CVE
CVE
added 2026/07/16 6:24 p.m.29 views

CVE-2026-46338

PyMdown Extensions (pymdownx.snippets) contains a regression that reintroduces a sibling-prefix path traversal when restrict_base_path is True. From 10.0.1 through 10.21.2, get_snippet_path uses a string-prefix check (filename.startswith(base)) that can read files from sibling paths sharing the s...

4.3CVSS6.1AI score0.0031EPSS
SaveExploits1References3Affected Software1
Debian CVE
Debian CVE
added 2026/07/16 6:24 p.m.6 views

CVE-2026-46338

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

4.3CVSS5.3AI score0.0031EPSS
SaveExploits1
OSV
OSV
added 2026/07/16 3:59 p.m.7 views

CVE-2026-47751 Claude Code Action: Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration

Claude Code Action is a general-purpose GitHub action that runs Claude Code on GitHub pull requests and issues. Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via default setting sources, and unconditionall...

5.3CVSS6.5AI score
SaveExploits0References6
Microsoft KB
Microsoft KB
added 2026/07/16 2:0 p.m.21 views

July 14, 2026—KB5101649 (OS Build 28000.2525)

None None...

9.8CVSS6.1AI score0.03303EPSS
SaveExploits1
Microsoft KB
Microsoft KB
added 2026/07/16 2:0 p.m.60 views

July 14, 2026—KB5099539 (OS Builds 19045.7548 and 19044.7548)

None None...

9.8CVSS6.1AI score0.035EPSS
SaveExploits1
OSV
OSV
added 2026/07/16 12:0 a.m.6 views

ALSA-2026:40895 Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

The general-purpose data-binding functionality and tree-model for Jackson Data Processor. It builds on core streaming parser/generator package, and uses Jackson Annotations for configuration. Security Fixes: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution...

8.1CVSS6.3AI score0.00779EPSS
SaveExploits1References6
Rows per page
Query Builder