Lucene search
+L

1119458 matches found

OSV
OSV
added yesterday4 views

BIT-POSTGRESQL-2026-6471 PostgreSQL logical decoding can dlopen arbitrary file

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before...

7.2CVSS5.7AI score0.00513EPSS
SaveExploits0References2
OSV
OSV
added yesterday5 views

BIT-POSTGRESQL-2026-19385 PostgreSQL pg_dump heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

8.8CVSS6.3AI score0.00596EPSS
SaveExploits0References2
OSV
OSV
added yesterday5 views

BIT-JUPYTERLAB-2026-73417 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

8.6CVSS5.6AI score0.00552EPSS
SaveExploits0References11
Circl
Circl
added yesterday5 views

GHSA-F3QQ-49M6-RW8F

creationtimestamp| type| source ---|---|--- 2026-08-19 08:31:37+00:00| seen| https://gist.github.com/alon710/db3f4019c2372dbb6dfede560d6093f7...

4.9AI score
SaveExploits0References1
RedhatCVE
RedhatCVE
added yesterday6 views

CVE-2026-76043

A flaw was found in the V8 component of Google Chrome. A remote attacker could exploit an incorrect calculation vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to arbitrary code execution within the browser's sandbox environment...

8.8CVSS6.2AI score0.00388EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added yesterday6 views

CVE-2026-76040

A flaw was found in chromium-browser. This use-after-free vulnerability allows a remote attacker, through social engineering, to execute arbitrary code outside of the sandbox by enticing a user to visit a specially crafted HTML page. This could lead to a complete compromise of the affected system...

8.8CVSS6.1AI score0.00431EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added yesterday6 views

CVE-2026-76036

A flaw was found in Dawn in Google Chrome on Android. This buffer overflow vulnerability allows a remote attacker to execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page...

9.6CVSS6.4AI score0.00414EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added yesterday7 views

CVE-2026-76044

A flaw was found in Google Chrome's USB component. A remote attacker, after compromising the renderer process, could exploit a race condition by using a specially crafted HTML page. This could potentially lead to the execution of arbitrary code outside of the browser's security sandbox, allowing...

9CVSS5.9AI score0.00332EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added yesterday3 views

CVE-2026-45135

A flaw was found in Caddy. This vulnerability stems from unsafe handling of Unicode characters within the FastCGI component, specifically when processing request paths containing non-ASCII bytes. An attacker capable of placing content into files served via FastCGI can exploit this by crafting a...

8.1CVSS5.9AI score0.00501EPSS
SaveExploits1References4
RedhatCVE
RedhatCVE
added yesterday3 views

CVE-2026-72492

A flaw was found in ksmbd, the in-kernel SMB3 server for Linux. This memory corruption vulnerability, known as a use-after-free, occurs when the system attempts to use memory after it has been released. A remote attacker could trigger this by performing a concurrent close operation during lease...

8.8CVSS5.9AI score0.00477EPSS
SaveExploits0References4
NVD
NVD
added yesterday4 views

CVE-2026-49420

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...

8.8CVSS0.00209EPSS
SaveExploits0References1
NVD
NVD
added yesterday5 views

CVE-2026-18937

The Broken Link Checker WordPress plugin before 2.4.12 does not limit which query variables it accepts from user input on sites using plain permalinks, allowing unauthenticated users to overwrite arbitrary PHP global variables, and to execute arbitrary code on the server when a classic non-block ...

9CVSS0.00224EPSS
SaveExploits0References1
The Hacker News
The Hacker News
added yesterday5 views

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A JavaServer Pages JSP web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management PLM software, according to new findings from ReliaQuest. The cybersecurity company...

7.2AI score
SaveExploits0
EUVD
EUVD
added yesterday5 views

EUVD-2026-62242

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...

8.8CVSS9.6AI score0.00209EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added yesterday3 views

CVE-2026-49420 Buffer overflow in libalias RTSP handler

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...

9.6AI score0.00209EPSS
SaveExploits0References1
CVE
CVE
added yesterday36 views

CVE-2026-49420

The RTSP handler in FreeBSD's libalias library writes rewritten packets into a fixed-length stack buffer without bounds checks, enabling a stack buffer overflow triggered by crafted RTSP traffic on NAT ports 554/7070, leading to RCE in the kernel (ipfw(4) NAT) or root-owned natd(8) process. Worka...

8.8CVSS9.6AI score0.00209EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday23 views

CVE-2026-49420 Buffer overflow in libalias RTSP handler

The RTSP handler in libalias rewrote outgoing packets into a fixed-length stack buffer without checking whether the rewritten data fit in the buffer, or whether the result fit back in the original packet. A host sending crafted RTSP traffic from inside a NAT gateway using libalias can overflow a...

0.00209EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added yesterday3 views

CVE-2026-72314

A flaw was found in the Linux kernel's regulator core. The regulatorlocktwo function, responsible for acquiring two regulators, incorrectly checks for an error code EDEADLOCK instead of the correct one EDEADLK. On certain architectures, such as MIPS, SPARC, and PowerPC, this discrepancy means tha...

7.8CVSS5.5AI score0.00176EPSS
SaveExploits0References4
OSSF Malicious Packages
OSSF Malicious Packages
added yesterday3 views

Malicious code in modsync (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04b786780800de5689c4ae50377166b26050fd688ec5d75cfb14fda990b92494 The package presents itself as a pino-like logger/middleware README, docs/, and index.d.ts copied from pinojs/pino; keywords fast/logger/stream/json...

5.5AI score
SaveExploits0References1
OSSF Malicious Packages
OSSF Malicious Packages
added yesterday5 views

Malicious code in api-rs-tuils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e65df9ad10889610f658c482041bdcf8c06d3c147da5cec709f246a1fa363c4 [email protected] runs a malicious postinstall hook node test.js that executes obfuscated code in index.js against the installer's machine. The code...

5.7AI score
SaveExploits0References1
Rows per page
Query Builder