Lucene search
+L

14417 matches found

NVD
NVD
added 2026/07/01 7:16 a.m.18 views

CVE-2026-11568

The Product Configurator for WooCommerce WordPress plugin before 1.7.3 does not perform any authorisation or post-status check before returning WooCommerce product data through a public AJAX action, allowing unauthenticated users to retrieve the data title, price, weight, stock status, and...

7.5CVSS0.00284EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/01 5:16 a.m.17 views

CVE-2026-12923

The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emddeletefile AJAX handler in includes/common-functions.php. The user-supplied value is passed through...

7.5CVSS0.0031EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/01 3:43 a.m.27 views

CVE-2026-12923

The Youtube Showcase plugin for WordPress (up to version 4.0.3) is vulnerable to an Arbitrary Function Call via the 'path' parameter in the emd_delete_file() AJAX handler (includes/common-functions.php). A user-supplied value is sanitized, has its trailing '_PLUGIN_DIR' stripped, and is then invo...

7.5CVSS5.9AI score0.0031EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/01 3:43 a.m.46 views

CVE-2026-12923 Video Gallery <= 4.0.3 - Authenticated (Subscriber+) Arbitrary Function Call via 'path' Parameter

The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emddeletefile AJAX handler in includes/common-functions.php. The user-supplied value is passed through...

7.5CVSS0.0031EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/01 3:43 a.m.20 views

EUVD-2026-40897

The Youtube Showcase plugin for WordPress is vulnerable to Arbitrary Function Call in versions up to and including 4.0.3. This is due to insufficient validation of the 'path' parameter in the emddeletefile AJAX handler in includes/common-functions.php. The user-supplied value is passed through...

7.5CVSS5.9AI score0.0031EPSS
SaveExploits0References5
GithubExploit
GithubExploit
added 2026/06/30 6:15 p.m.85 views

Exploit for Write-what-where Condition in Linux Linux_Kernel

CVE-KERNEL · Linux Kernel LPE Chain Multi-C...

8.8CVSS7.1AI score0.93235EPSS
SaveExploits46
NVD
NVD
added 2026/06/29 7:16 p.m.20 views

CVE-2026-13757

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...

6.2CVSS0.00148EPSS
SaveExploits0References10
OSV
OSV
added 2026/06/29 7:16 p.m.10 views

UBUNTU-CVE-2026-13757

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...

6.2CVSS5.8AI score0.00148EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/06/29 6:44 p.m.13 views

CVE-2026-13757

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...

6.2CVSS5.8AI score0.00148EPSS
SaveExploits0References11
Vulnrichment
Vulnrichment
added 2026/06/29 6:44 p.m.11 views

CVE-2026-13757 P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...

6.2CVSS5.8AI score0.00148EPSS
SaveExploits0References10
EUVD
EUVD
added 2026/06/29 6:44 p.m.26 views

EUVD-2026-40173

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes...

6.2CVSS5.8AI score0.00148EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/29 11:50 a.m.15 views

PYSEC-2026-472 PraisonAI MCP `tools/call` path-traversal => RCE via Python `.pth` injection

Summary PraisonAI's MCP Model Context Protocol server praisonai mcp serve registers four file-handling tools by default — praisonai.rules.create, praisonai.rules.show, praisonai.rules.delete, and praisonai.workflow.show. Each accepts a path or filename string from MCP tools/call arguments and joi...

9.6CVSS6.4AI score0.0062EPSS
SaveExploits1References5
OSV
OSV
added 2026/06/29 11:50 a.m.12 views

PYSEC-2026-466 PraisonAI call server exposes unauthenticated agent listing, invocation, and deletion when CALL_SERVER_TOKEN is unset

Summary PraisonAI's call server exposes a network-facing agent control API without authentication when CALLSERVERTOKEN is not configured. The affected component is the praisonai.api.agentinvoke router as mounted by praisonai.api.call. The authentication helper verifytoken fails open when...

9.8CVSS5.8AI score0.00346EPSS
SaveExploits0References5
OSV
OSV
added 2026/06/29 11:50 a.m.17 views

PYSEC-2026-256 Agno is vulnerable to Eval Injection

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the fieldtype parameter passed to eval. Attackers can influence the fieldtype value in a FunctionCall to achieve...

9.3CVSS6.7AI score0.00842EPSS
SaveExploits0References7
OSV
OSV
added 2026/06/29 11:50 a.m.11 views

PYSEC-2026-395 LlamaIndex includes an exec call for `import {cls_name}`

An issue was discovered in llamaindex before 0.10.38. download/integration.py includes an exec call for import clsname...

9.8CVSS7.3AI score0.00528EPSS
SaveExploits0References8
OSV
OSV
added 2026/06/29 11:50 a.m.14 views

PYSEC-2026-308 CraftBeerPi 4 allows arbitrary code execution

URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/httpendpoints/httpsystem.py" is subsequently passed to the "os.system" function in "cbpi/controller/systemcontroller.py" without prior validation allowing arbitrary code execution. This issue affects CraftBeerPi 4:...

9.8CVSS6.1AI score0.01139EPSS
SaveExploits0References7
OSV
OSV
added 2026/06/29 11:50 a.m.14 views

PYSEC-2026-315 Cobbler Improper Validation of Security Tokens

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...

9.8CVSS7.2AI score0.12484EPSS
SaveExploits0References6
OSV
OSV
added 2026/06/29 5:40 a.m.10 views

BIT-ENVOY-2026-47207 Envoy crashes if multiple unexpected ext_proc responses are packed into one gRPC message

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.34.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, Envoy crashes if an extproc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This can occur when the...

6.5CVSS5.7AI score0.00293EPSS
SaveExploits1References2
OSV
OSV
added 2026/06/29 5:32 a.m.16 views

MAL-2026-6579 Malicious code in lessload (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9a5401aaa39f6562549f4fa8298e5bcee579987b837d2440565c37a8f5182dc6 [email protected] impersonates the popular debug package replicating its API surface, contributor list, and description as a 'Lightweight debugging...

6.4AI score
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/29 12:0 a.m.25 views

PT-2026-53679

Name of the Vulnerable Software and Affected Versions p11-kit affected versions not specified Description A flaw exists in the RPC message attribute parsing process. The functions p11 rpc message get attribute and p11 rpc message get attribute array value create a mutually-recursive call chain th...

6.2CVSS6.1AI score0.00148EPSS
SaveExploits0References33
Rows per page
Query Builder