Lucene search
+L

44390 matches found

OSV
OSV
added 2026/07/19 3:47 a.m.4 views

OESA-2026-3005 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

5.9CVSS7.1AI score0.00996EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/19 3:47 a.m.5 views

OESA-2026-3004 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

5.9CVSS7.1AI score0.00996EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/19 3:47 a.m.4 views

OESA-2026-3002 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: A specially crafted password-encrypted CMS message can trigger a NULL pointer dereference during CMS decryption. Impact summary: This NULL pointer...

5.9CVSS7.2AI score0.00996EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/19 3:16 a.m.12 views

CVE-2026-16205

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialcharsdecode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible ...

4.8CVSS0.00202EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/19 2:0 a.m.45 views

CVE-2026-16205 Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialcharsdecode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible ...

4.8CVSS0.00202EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/19 2:0 a.m.7 views

CVE-2026-16205 Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialcharsdecode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible ...

4.8CVSS3.1AI score
SaveExploits0References7
CVE
CVE
added 2026/07/19 2:0 a.m.20 views

CVE-2026-16205

In Pluck CMS up to version 4.7.21, the vulnerability affects the Albums Module (data/modules/albums/albums.admin.php) via the function htmlspecialchars_decode. Manipulating the Info argument can trigger cross-site scripting, with remote exploitation possible. Public exploit exists. The project wa...

4.8CVSS3.2AI score0.00202EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/19 12:0 a.m.15 views

PT-2026-61039

A weakness has been identified in Pluck CMS up to 4.7.21. This vulnerability affects the function htmlspecialchars decode of the file data/modules/albums/albums.admin.php of the component Albums Module. Executing a manipulation of the argument Info can lead to cross site scripting. It is possible...

4.8CVSS3.2AI score0.00202EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/17 7:5 p.m.8 views

GHSA-CVPC-HCCG-WMW4 Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited Formie access could directly access Formie settings pages and modify global plugin configuration. In affected versions, Formie...

6.3CVSS5.4AI score
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/07/17 7:5 p.m.19 views

Formie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration

Formie contains a missing authorization vulnerability in administrative settings routes. An authenticated, non-admin Craft CMS control panel user with limited Formie access could directly access Formie settings pages and modify global plugin configuration. In affected versions, Formie...

5.3AI score
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/07/17 9:54 a.m.4 views

SUSE-SU-2026:3094-1 Security update for openssl-3

This update for openssl-3 fixes the following issues - CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages bsc1266344. - CVE-2026-42767: NULL Pointer Dereference in CRMF EncryptedValue Decryption bsc1266350...

9.1CVSS5.2AI score0.00557EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/17 12:7 a.m.19 views

CVE-2026-62237

CVE-2026-62237 affects Grav before 2.0.4. The vulnerability is a ReDoS in the regex_replace filter and function that are allowlisted in the Twig content sandbox. When Twig processing of page content is enabled (security.twig_content.process_enabled: true), an authenticated page editor can supply ...

6.5CVSS6.1AI score0.00249EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/17 12:7 a.m.42 views

CVE-2026-62237 Grav < 2.0.4 ReDoS via regex_replace in Sandbox

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

6.5CVSS0.00249EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/17 12:7 a.m.11 views

CVE-2026-62237 Grav < 2.0.4 ReDoS via regex_replace in Sandbox

Grav before 2.0.4 contains a regular expression denial of service ReDoS vulnerability in the regexreplace filter and function, which are allowlisted in the Twig content sandbox. When Twig processing in page content is enabled security.twigcontent.processenabled: true, disabled by default, an...

6CVSS5.3AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/17 12:7 a.m.40 views

CVE-2026-62234 Grav < 2.0.4 SSRF via Unrestricted cURL Protocols

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to...

8.4CVSS0.00297EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/17 12:7 a.m.17 views

CVE-2026-62234

Grav 2.x prior to 2.0.4 contains an SSRF vulnerability in webhook dispatch where authenticated users with api.webhooks.write can create webhooks using file://, dict://, or gopher:// protocols. This unrestricted protocol handling can be leveraged to read local files, access process information, or...

8.4CVSS6.1AI score0.00297EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/17 12:7 a.m.9 views

CVE-2026-62232

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF...

9.1CVSS6.1AI score0.0028EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/17 12:7 a.m.7 views

CVE-2026-62232 Grav < 2.0.4 2FA Bypass via Secret Regeneration

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence, not authorization, during the pending TOTP challenge window. Attackers who know the victim's password can call this task without a CSRF...

9.1CVSS5.3AI score
SaveExploits0References5
NVD
NVD
added 2026/07/16 10:17 p.m.13 views

CVE-2026-44177

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user object...

8.8CVSS0.00454EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/16 10:17 p.m.7 views

CVE-2026-44176

Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the pages.access permission during page draft rendering. Permissions are defined for each user role in the user blueprint site/blueprints/users/.... It is also possible to customize the permissions f...

6CVSS0.00215EPSS
SaveExploits0References2
Rows per page
Query Builder