CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

17649 matches found

Positive Technologies•added 2026/04/23 12:00 a.m.•61 views

PT-2026-34763

OpenClaw before 2026.3.28 contains an environment variable sanitization vulnerability where GIT TEMPLATE DIR and AWS CONFIG FILE are not blocked in the host-env blocklist. Attackers can exploit approved exec requests to redirect git or AWS CLI behavior through attacker-controlled configuration...

5.8CVSS6.2AI score0.00139EPSS

SaveExploits0References4

CNNVD•added 2026/04/23 12:00 a.m.•30 views

Flowise information leakage vulnerability

Flowise is an open-source tool developed by FlowiseAI, designed for easily building LLM applications. Prior versions of Flowise, up to 3.1.0, contained a vulnerability related to information leakage. This vulnerability stemmed from the /api/v1/public-chatbotConfig/ endpoint, which exposed sensiti...

7.7CVSS5.7AI score0.00501EPSS

SaveExploits1References2

Positive Technologies•added 2026/04/23 12:00 a.m.•38 views

PT-2026-34592

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.4.3, the upload PATCH flow under /files/:uploadId validates the mounted request path using the still-encoded req.path, but the downstream tus handler later writes using the decoded req.params.uploadId. In...

7.5CVSS5.8AI score0.00459EPSS

SaveExploits0References4

CNNVD•added 2026/04/23 12:00 a.m.•25 views

OpenClaw security vulnerabilities

OpenClaw is an open-source intelligent artificial assistant developed by OpenClaw. Versions of OpenClaw prior to 2026.4.2 contained security vulnerabilities. These vulnerabilities stemmed from exposing configPath and stateDir metadata to non-administrator authenticated clients during the Gateway...

5.3CVSS5.9AI score0.00373EPSS

SaveExploits0References1

CNNVD•added 2026/04/23 12:00 a.m.•28 views

TP-Link TL-WR841N security vulnerabilities

The TP-Link TL-WR841N is a router produced by the TP-Link company. The TP-Link TL-WR841N v13 version has a security vulnerability. This vulnerability stems from the use of DES-CBC encryption in the TDDPv2 debugging protocol, where the key is predictable. This could allow unauthorized attackers to...

8.8CVSS5.9AI score0.00205EPSS

SaveExploits0References2

Snyk•added 2026/04/23 12:00 a.m.•12 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization causing web security to be ineffective and allowing unauthorized access to all endpoints. Note: This is only exploitable if the following conditions are met: - the application is servlet-based; - the application ha...

9.3CVSS7AI score0.00538EPSS

SaveExploits1References2

Snyk•added 2026/04/22 10:22 p.m.•20 views

Relative Path Traversal

Overview Affected versions of this package are vulnerable to Relative Path Traversal via the ToolConfigModel tool and config name handling in the Ruby and Python models. An attacker can write or delete arbitrary files within the shared /plugins directory by supplying tool or config names containi...

5.3CVSS5.9AI score0.00411EPSS

SaveExploits1References2

osv_ghsa•added 2026/04/22 10:03 p.m.•32 views

GHSA-2HP7-65R3-WV54 NornicDB has Improper Network Binding in its Bolt Server, allowing unauthorized remote access

Summary The --address CLI flag and NORNICDBADDRESS / server.host config key is plumbed through to the HTTP server correctly but never reaches the Bolt server config. The Bolt listener therefore always binds to the wildcard address all interfaces, regardless of what the user configures. On a LAN,...

9.8CVSS8.3AI score0.00601EPSS

SaveExploits0References6

Github Security Blog•added 2026/04/22 8:34 p.m.•33 views

Flarum: Path traversal in LESS parser via theme color settings (incomplete fix for CVE-2023-27577)

Summary Flarum's patch for CVE-2023-27577 restricted the @import and data-uri LESS features in the customless setting, but the same restriction was never applied to other settings registered as LESS config variables for example themeprimarycolor and themesecondarycolor, as well as any key...

6.6CVSS6AI score0.00851EPSS

SaveExploits0References8Affected Software1

vulnersOsv•added 2026/04/22 2:35 p.m.•3 views

bblib (>=0.1.1, <=3.1.0), beambusters (>=1.1.0, <=3.1.0) +3 more potentially affected by CVE-2026-41140 via poetry (1.8.0)

poetry PYPI version 1.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - bblib =0.1.1, =1.1.0, =0.15.0, =0.3.2, =0.3.5 - unified-config 0.1.2 Source cves: CVE-2026-41140 Source advisory: OSV:GHSA-73H3-MF4W-8647...

2.3CVSS5.8AI score0.00472EPSS

SaveExploits0

vulnersOsv•added 2026/04/22 12:26 p.m.•1 views

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +865 more potentially affected by CVE-2026-22753 via org.springframework.security:spring-security-config (>=7.0.0-m1, <=7.0.4)

org.springframework.security:spring-security-config MAVEN version =7.0.0-m1, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

7.5CVSS7.2AI score0.00248EPSS

SaveExploits0

vulnersOsv•added 2026/04/22 12:24 p.m.•1 views

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +865 more potentially affected by CVE-2026-22754 via org.springframework.security:spring-security-config (>=7.0.0-m1, <=7.0.4)

7.5CVSS7.2AI score0.00266EPSS

SaveExploits0

Snyk•added 2026/04/22 12:24 p.m.•12 views

Access Control Bypass

Overview org.springframework.security:spring-security-config is a security configuration package for Spring Framework. Affected versions of this package are vulnerable to Access Control Bypass in the XML authorization rules processing when the servlet-path attribute is used. An attacker can gain...

8.7CVSS7.1AI score0.00266EPSS

SaveExploits0References2

RedHat Linux•added 2026/04/22 7:54 a.m.•21 views

freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface

A heap buffer use after free has been discovered in FreeRDP. urbselectinterface can free the device's MS config on error but later code still dereferences it, leading to a use after free in libusbudevselectinterface...

8.7CVSS7.6AI score0.0053EPSS

SaveExploits0References6

vulnersOsv•added 2026/04/22 6:30 a.m.•2 views

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +864 more potentially affected by CVE-2026-22753 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

org.springframework.security:spring-security-config MAVEN version =7.0.0, =0.2.0, =7.0.0-alpha-springboot4, =2.0.0-alpha-springboot4, =5.0.0-alpha-springboot4, =9.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4, =22.0.0-alpha-springboot4,...

7.5CVSS7.2AI score0.00248EPSS

SaveExploits0

vulnersOsv•added 2026/04/22 6:30 a.m.•3 views

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +864 more potentially affected by CVE-2026-22754 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

7.5CVSS7.2AI score0.00266EPSS

SaveExploits0

vulnersOsv•added 2026/04/22 6:30 a.m.•3 views

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +864 more potentially affected by CVE-2026-22753 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

7.5CVSS7.2AI score0.00248EPSS

SaveExploits0

vulnersOsv•added 2026/04/22 6:30 a.m.•1 views

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +864 more potentially affected by CVE-2026-22754 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

7.5CVSS7.2AI score0.00266EPSS

SaveExploits0

vulnersOsv•added 2026/04/22 5:32 a.m.•3 views

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +864 more potentially affected by CVE-2026-22754 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

7.5CVSS7.2AI score0.00266EPSS

SaveExploits0

vulnersOsv•added 2026/04/22 5:20 a.m.•4 views

be.appify.prefab:prefab-security (>=0.2.0, <=0.7.5), ch.admin.bit.jeap:jeap-audit-command-builder (>=7.0.0-alpha-springboot4, <=7.1.0-alpha-springboot4) +864 more potentially affected by CVE-2026-22753 via org.springframework.security:spring-security-config (>=7.0.0, <=7.0.4)

7.5CVSS7.2AI score0.00248EPSS

SaveExploits0

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by