Lucene search
+L

37026 matches found

CVE
CVE
added 2026/06/25 4:34 a.m.143 views

CVE-2026-1606

CVE-2026-1606 affects GitLab CE/EE (versions 14.8–before 18.11.6, 19.0–before 19.0.3, 19.1–before 19.1.1). The issue stems from improper input validation and could allow an authenticated user to conceal content within a Snippet. The CVSSv3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N ...

4.3CVSS5.9AI score0.00224EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2026/06/25 4:34 a.m.43 views

CVE-2026-1606 Improper Control of Generation of Code ('Code Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.8 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user to conceal content within a Snippet due to improper input validation...

4.3CVSS0.00224EPSS
SaveExploits0References3
The Hacker News
The Hacker News
added 2026/06/24 5:19 p.m.21 views

CISA Warns Critical Lantronix EDS5000 Flaw Is Being Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday warned of active exploitation of a critical security flaw impacting Lantronix EDS5000 Series devices, urging Federal Civilian Executive Branch FCEB agencies to apply the fixes by June 26, 2026. The vulnerability in question...

9.8CVSS7.5AI score0.1432EPSS
SaveExploits1
OSV
OSV
added 2026/06/24 1:12 p.m.10 views

OESA-2026-2725 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies...

8.8CVSS6.5AI score0.01107EPSS
SaveExploits2References7
OSV
OSV
added 2026/06/24 1:12 p.m.7 views

OESA-2026-2724 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies...

8.8CVSS6.5AI score0.01107EPSS
SaveExploits2References7
OSV
OSV
added 2026/06/24 1:12 p.m.9 views

OESA-2026-2723 activemq security update

The most popular and powerful open source messaging and Integration Patterns server. Security Fixes: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. The MessageServlet in the ActiveMQ web console API copies...

8.8CVSS6.5AI score0.01107EPSS
SaveExploits2References7
CVE
CVE
added 2026/06/24 12:33 p.m.43 views

CVE-2026-12242

CVE-2026-12242 affects the WordPress AdRotate Banner Manager plugin up to version 5.17.7. The vulnerability is PHP Code Injection via the banner attribute of the adrotate shortcode, caused by insufficient validation and sanitization before concatenation into a PHP code string wrapped in W3 Total ...

8.8CVSS6.2AI score0.00469EPSS
SaveExploits0References11
Patchstack
Patchstack
added 2026/06/24 12:29 p.m.16 views

WordPress AdRotate Banner Manager plugin <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection vulnerability

Authenticated Contributor+ PHP Code Injection vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin AdRotate Banner Manager versions = 5.17.7...

8.8CVSS5.9AI score0.00469EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.25 views

PT-2026-51786

The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 5.17.7 via the 'banner' attribute of the adrotate shortcode. This is due to insufficient input validation and sanitization of the banner shortcode attribute before...

8.8CVSS6.2AI score0.00469EPSS
SaveExploits0References12
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/06/23 8:1 p.m.15 views

Malicious code in thurdweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 775ff15f4a1314978d4cfed1e97c6c9ac8621d8ddeed93160c25aa3681f73cc7 Package name thurdweb is a one-character substitution of the popular web3 SDK thirdweb, but the shipped source is a copy of MikeMcl/big.js...

5.9AI score
SaveExploits0References2
NVD
NVD
added 2026/06/23 5:16 p.m.11 views

CVE-2026-34916

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Inpu...

8.8CVSS0.00754EPSS
SaveExploits2References1
Cvelist
Cvelist
added 2026/06/23 4:14 p.m.43 views

CVE-2026-44959

A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery...

8.8CVSS0.00466EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/06/23 4:14 p.m.14 views

EUVD-2026-38507

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Inpu...

8.8CVSS6.7AI score0.00754EPSS
SaveExploits2References1
EUVD
EUVD
added 2026/06/23 4:14 p.m.15 views

EUVD-2026-38500

A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery...

8.8CVSS6.6AI score0.00466EPSS
SaveExploits1References1
CVE
CVE
added 2026/06/23 4:14 p.m.21 views

CVE-2026-34916

CVE-2026-34916 affects Revive Adserver 6.0.6 and earlier. A missing validation of user input when saving delivery limitations could allow a low‑privileged user to use the logical parameter to inject PHP code into the compiledlimitations field, which could be executed during banner delivery. The a...

8.8CVSS6.6AI score0.00754EPSS
SaveExploits2References1
Cvelist
Cvelist
added 2026/06/23 4:14 p.m.38 views

CVE-2026-34916

A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Inpu...

8.8CVSS0.00754EPSS
SaveExploits2References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/06/23 4:8 p.m.9 views

Security Bulletin: Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows

Summary Langflow OSS contains unauthenticated server-side RCE via PythonCodeStructuredTool executing attacker-controlled Python through exec at flow-build time. Sink in execself.toolcode, globals, localnamespace where toolcode is attacker-controlled template field. Two paths: A Authenticated POST...

10CVSS6AI score0.00357EPSS
SaveExploits0Affected Software1
CISA KEV Catalog
CISA KEV Catalog
added 2026/06/23 12:0 a.m.12 views

Lantronix EDS5000 Code Injection Vulnerability

Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges...

9.8CVSS6.3AI score0.1432EPSS
SaveIn wildExploits1
Positive Technologies
Positive Technologies
added 2026/06/23 12:0 a.m.14 views

PT-2026-51554

Name of the Vulnerable Software and Affected Versions Revive Adserver versions prior to 6.0.7 Description Insufficient validation of user input during the process of saving delivery limitations allows a low-privileged user to inject malicious PHP code into the compiledlimitations database field v...

8.8CVSS6.8AI score0.00754EPSS
SaveExploits2References10
CVE
CVE
added 2026/06/22 5:15 p.m.54 views

CVE-2026-10789

Summary: CVE-2026-10789 is a code-injection vulnerability in the MCP extension for Autodesk Fusion Desktop. A malicious webpage visited by a user with Fusion Desktop running and MCP enabled can trigger arbitrary code execution with the current user’s privileges. The CVSS 3.1 score is 9.6 (CRITICA...

9.6CVSS6.2AI score0.00701EPSS
SaveExploits0References3Affected Software1
Rows per page
Query Builder