Lucene search
+L

35318 matches found

EUVD
EUVD
added 5 days ago11 views

EUVD-2026-54793

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

7.7CVSS5.5AI score0.00426EPSS
SaveExploits1References3
Imperva Blog
Imperva Blog
added 6 days ago8 views

Imperva Customers Protected Against Novel HTTP Desync Attacks

TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently...

5.8AI score
SaveExploits0
The Hacker News
The Hacker News
added 6 days ago14 views

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

A recent wave of cyber attacks targeting financial services, private equity, and professional services has been attributed to a data extortion group known as UNC6671. "UNC6671 continues to rely on voice phishing vishing to target enterprise employees, posing as IT help desk staff facilitating...

5.5AI score
SaveExploits0
IBM Security Bulletins
IBM Security Bulletins
added 6 days ago21 views

Security Bulletin: Due to the use of IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Vulnerabilities found in IBM Db2 LUW that affect Foundation and IBM Tivoli Monitoring ITM pattern Types pTypes shipped with IBM Cloud Pak System. Vulnerabilities were addressed in IBM Cloud Pak System v2.3.5.1. IBM Cloud Pak System provides IBM Db2 with BLU Acceleration Pattern 1.2.26.0...

7.5CVSS7.1AI score0.02015EPSS
SaveExploits2Affected Software1
NVD
NVD
added 6 days ago11 views

CVE-2026-15359

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

6.5CVSS0.00203EPSS
SaveExploits0References1
Cvelist
Cvelist
added 6 days ago38 views

CVE-2026-15359 Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

0.00203EPSS
SaveExploits0References1
CVE
CVE
added 6 days ago40 views

CVE-2026-15359

Templately WordPress plugin

6.5CVSS5.6AI score0.00203EPSS
SaveExploits0References1
EUVD
EUVD
added 6 days ago13 views

EUVD-2026-54382

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

6.5CVSS5.6AI score0.00203EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 6 days ago15 views

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (July 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-27903 DESCRIPTION: minimatch is a minimal matching utility for converti...

7.5CVSS7.2AI score0.01414EPSS
SaveExploits3Affected Software1
EUVD
EUVD
added 6 days ago8 views

EUVD-2026-54279

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

9.2CVSS5.5AI score0.00325EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added last week10 views

CVE-2026-68823 Azure Confidential Ledger Remote Code Execution Vulnerability

...

9.1CVSS5.2AI score0.005EPSS
SaveExploits0References1
CVE
CVE
added last week47 views

CVE-2026-62857

Fedify: Server-Side Request Forgery via getNodeInfo() is caused by following attacker-controlled links[].href from /.well-known/nodeinfo without scheme/redirect/private-address validation. Affected: Fedify versions 1.2.0 through 1.9, 1.10, 2.0, 2.1, 2.2, 2.3 maintenance lines. Impact: may access ...

8.8CVSS5.5AI score0.00249EPSS
SaveExploits0References2
Cvelist
Cvelist
added last week28 views

CVE-2026-62857 Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo follows an attacker-controlled links.href value from /.well-known/nodeinfo without scheme, redirect, o...

8.8CVSS0.00249EPSS
SaveExploits0References2
Fedora
Fedora
added last week11 views

[SECURITY] Fedora 44 Update: trafficserver-10.1.4-1.fc44

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

10CVSS5.5AI score0.00652EPSS
SaveExploits1
Fedora
Fedora
added last week13 views

[SECURITY] Fedora 43 Update: trafficserver-10.1.4-1.fc43

Traffic Server is a high-performance building block for cloud services. It's more than just a caching proxy server; it also has support for plugins to build large scale web applications. Key features: Caching - Improve your response time, while reducing server load and bandwidth needs by caching...

10CVSS5.5AI score0.00652EPSS
SaveExploits1
Cvelist
Cvelist
added last week29 views

CVE-2026-11976 MonsterInsights Pro 10.2.0/10.2.2 - Backdoored via AWS S3 bucket compromise

The official MonsterInsights Pro update distribution bucket monster-insights.s3.amazonaws.com was compromised. Both the current release 10.2.2 and the version MonsterInsights rolled back to 10.2.0 contain a malicious file, class-system-check.php. Three distinct variants were observed on 2026-06-1...

10CVSS0.00486EPSS
SaveExploits0References1
NVD
NVD
added last week8 views

CVE-2026-18359

Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the metsuri or iiifuri parameter o...

8.5CVSS0.0022EPSS
SaveExploits0References1
OSV
OSV
added last week10 views

CVE-2026-53983 Ground Station prior to 0.6.0 Unauthenticated Persistent Blind Server-Side Request Forgery via Orbital Data Source URL

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

9.2CVSS5.5AI score0.00381EPSS
SaveExploits0References5
Microsoft CVE
Microsoft CVE
added last week9 views

Azure SQL Managed Instance Elevation of Privilege Vulnerability

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...

10CVSS5.7AI score0.00359EPSS
SaveExploits0
OSV
OSV
added last week7 views

CVE-2026-19019 poco-ai poco-agent Claude File workspace.py WorkspaceManager._setup_session_persistence cleanup

A security flaw has been discovered in poco-ai poco-agent up to 0.5.4. Affected is the function WorkspaceManager.setupsessionpersistence of the file executor/app/core/workspace.py of the component Claude File Handler. The manipulation results in incomplete cleanup. The attack may be performed fro...

6.3CVSS4.7AI score
SaveExploits0References8
Rows per page
Query Builder