Lucene search
+L

35326 matches found

Tenable Nessus
Tenable Nessus
added 3 days ago7 views

Alibaba Cloud Linux 3 : 0245: dovecot (ALINUX3-SA-2026:0245)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2026:0245 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-42006: An attacker can cause uncontrolled...

7.5CVSS7.2AI score0.00667EPSS
SaveExploits1References2
Nuclei
Nuclei
added 4 days ago191 views

Ivanti EPM Cloud Services Appliance Code Injection

Ivanti EPM Cloud Services Appliance CSA before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions nobody. id: CVE-2021-44529 info: name: Ivanti EPM Cloud Services Appliance Code Injection...

9.8CVSS9.2AI score0.99105EPSS
SaveExploits9References5
Nuclei
Nuclei
added 4 days ago108 views

Spring Cloud Gateway Code Injection

Applications using Spring Cloud Gateway prior to 3.1.1+ and 3.0.7+ are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote...

10CVSS8.5AI score0.98253EPSS
SaveExploits54References5
Imperva Blog
Imperva Blog
added 4 days ago8 views

What SecureIQLab Cloud WAAP 5.0 means for your application security

You cannot verify a vendor’s security claims from their own datasheet, including ours. That is why independent validation matters. In our recent guide to the best WAAP solutions Best WAAP Solutions 2026: Enterprise Buyer Guide, we argued that every serious shortlist should include independent...

5.5AI score
SaveExploits0
CVE
CVE
added 4 days ago36 views

CVE-2026-19339

CVE-2026-19339 affects the Alibaba Cloud/DataWorks MCP server (aliyun alibabacloud-dataworks-mcp-server) up to version 1.0.43. The vulnerability is in ReadResourceRequestSchema (src/resources/initResources.ts): manipulating the argument request.params.uri enables server-side request forgery (SSRF...

6.5CVSS6.3AI score0.00209EPSS
SaveExploits0References6
NVD
NVD
added 5 days ago11 views

CVE-2026-67620

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

7.7CVSS0.00426EPSS
SaveExploits1References3
CVE
CVE
added 5 days ago63 views

CVE-2026-67620

CVE-2026-67620 affects Flowise up to version 3.1.4, where the SSRF guard in httpSecurity.ts uses a faulty DEFAULT_DENY_LIST. The list blocks the AWS/GCP/Azure/DO metadata IPs 169.254.169.254 but omits OCI 192.0.0.192 and Alibaba Cloud 100.100.100.200 (and the 100.64.0.0/10 CGNAT range). An authen...

7.7CVSS5.5AI score0.00426EPSS
SaveExploits1References3
Cvelist
Cvelist
added 5 days ago40 views

CVE-2026-67620 Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

7.7CVSS0.00426EPSS
SaveExploits1References3
EUVD
EUVD
added 5 days ago11 views

EUVD-2026-54793

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULTDENYLIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticate...

7.7CVSS5.5AI score0.00426EPSS
SaveExploits1References3
Imperva Blog
Imperva Blog
added 6 days ago8 views

Imperva Customers Protected Against Novel HTTP Desync Attacks

TL;DR: Recent Portswigger research introduced novel HTTP desync techniques discovered through an AI-assisted research system called the HTTP Terminator. The findings expand the range of unusual HTTP behaviors that can cause front-end and back-end systems to interpret the same traffic differently...

5.8AI score
SaveExploits0
The Hacker News
The Hacker News
added 6 days ago14 views

UNC6671 Vishing Attacks Target Personal Phones to Steal SaaS Data

A recent wave of cyber attacks targeting financial services, private equity, and professional services has been attributed to a data extortion group known as UNC6671. "UNC6671 continues to rely on voice phishing vishing to target enterprise employees, posing as IT help desk staff facilitating...

5.5AI score
SaveExploits0
IBM Security Bulletins
IBM Security Bulletins
added 6 days ago21 views

Security Bulletin: Due to the use of IBM Db2, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Vulnerabilities found in IBM Db2 LUW that affect Foundation and IBM Tivoli Monitoring ITM pattern Types pTypes shipped with IBM Cloud Pak System. Vulnerabilities were addressed in IBM Cloud Pak System v2.3.5.1. IBM Cloud Pak System provides IBM Db2 with BLU Acceleration Pattern 1.2.26.0...

7.5CVSS7.1AI score0.02015EPSS
SaveExploits2Affected Software1
NVD
NVD
added 6 days ago11 views

CVE-2026-15359

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

6.5CVSS0.00203EPSS
SaveExploits0References1
Cvelist
Cvelist
added 6 days ago38 views

CVE-2026-15359 Templately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

0.00203EPSS
SaveExploits0References1
CVE
CVE
added 6 days ago40 views

CVE-2026-15359

Templately WordPress plugin

6.5CVSS5.6AI score0.00203EPSS
SaveExploits0References1
EUVD
EUVD
added 6 days ago14 views

EUVD-2026-54382

The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under their control, disconnecting the legitimate administrator and...

6.5CVSS5.6AI score0.00203EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 6 days ago15 views

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (July 2026 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-27903 DESCRIPTION: minimatch is a minimal matching utility for converti...

7.5CVSS7.2AI score0.01414EPSS
SaveExploits3Affected Software1
EUVD
EUVD
added 6 days ago8 views

EUVD-2026-54279

Ground Station prior to 0.6.0 contains an unauthenticated blind server-side request forgery vulnerability in the orbital-source configuration path that allows any unauthenticated Socket.IO client to cause the ground-station process to issue outbound HTTP requests to attacker-chosen destinations...

9.2CVSS5.5AI score0.00325EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added last week10 views

CVE-2026-68823 Azure Confidential Ledger Remote Code Execution Vulnerability

...

9.1CVSS5.2AI score0.005EPSS
SaveExploits0References1
CVE
CVE
added last week47 views

CVE-2026-62857

Fedify: Server-Side Request Forgery via getNodeInfo() is caused by following attacker-controlled links[].href from /.well-known/nodeinfo without scheme/redirect/private-address validation. Affected: Fedify versions 1.2.0 through 1.9, 1.10, 2.0, 2.1, 2.2, 2.3 maintenance lines. Impact: may access ...

8.8CVSS5.5AI score0.00249EPSS
SaveExploits0References2
Rows per page
Query Builder