Lucene search
+L

18063 matches found

Positive Technologies
Positive Technologies
added 2026/07/31 12:0 a.m.20 views

PT-2026-66876

Name of the Vulnerable Software and Affected Versions Premiere Pro affected versions not specified Description An out-of-bounds write issue exists that could allow arbitrary code execution within the context of the current user. This occurs when a user opens a specially crafted malicious file,...

7.8CVSS6.2AI score0.00139EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/30 10:54 p.m.8 views

ECHO-D150-B1E6-CA68

Bulletin has no description...

9.6CVSS5.8AI score0.00316EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/30 10:42 p.m.8 views

ECHO-4692-8A3C-9D29

Bulletin has no description...

4CVSS5.8AI score0.00083EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/30 6:3 p.m.10 views

RLSA-2026:47040 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: xfrm: Duplicate SPI Handling CVE-2025-39797 kernel: lib/buildid: use kernelread for sleepable context CVE-2026-23002 kernel: futex: Drop CLONETHREAD requirement for private default hash...

7CVSS6.6AI score0.00157EPSS
SaveExploits1References6
NVD
NVD
added 2026/07/30 5:16 p.m.12 views

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

9.8CVSS0.00524EPSS
SaveExploits1References1
OSV
OSV
added 2026/07/30 5:16 p.m.8 views

CVE-2026-12940

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

9.8CVSS6.3AI score
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/30 4:41 p.m.42 views

CVE-2026-12940 Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

9.8CVSS0.00524EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/07/30 4:41 p.m.12 views

EUVD-2026-51240

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUSENVVARS blocklist fails to include...

9.8CVSS6.5AI score0.00524EPSS
SaveExploits1References1
SUSE CVE
SUSE CVE
added 2026/07/30 4:30 p.m.7 views

SUSE CVE-2026-64556

In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during removeonexec perfeventremoveonexec removes events by calling perfeventexitevent. For top-level events, this removes the event from the context with DETACHEXIT only. This can leave inconsisten...

7.8CVSS5.4AI score0.0012EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/07/30 3:11 p.m.10 views

CVE-2026-58222 Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search ...

8.8CVSS5.8AI score0.00839EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/30 2:44 p.m.16 views

EUVD-2026-50501

MCP Ruby SDK: Ruby SSE Session Poisoning...

8.3CVSS5.8AI score0.00276EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/30 2:44 p.m.16 views

EUVD-2026-50502

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport...

7.5CVSS5.8AI score0.00436EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/30 2:43 p.m.11 views

EUVD-2026-50498

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood...

5.3CVSS5.8AI score0.00291EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/30 2:2 p.m.4 views

MINI-4Q33-8H83-5J39

Bulletin has no description...

6.9CVSS5.8AI score0.00232EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/07/30 1:57 p.m.18 views

CVE-2026-67351

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain...

8.8CVSS5.9AI score0.0037EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/30 1:57 p.m.37 views

CVE-2026-67351 Serendipity < 2.6.1 Authentication Bypass via Username Collision

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain...

8.8CVSS0.0037EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/30 1:57 p.m.7 views

CVE-2026-67351 Serendipity < 2.6.1 Authentication Bypass via Username Collision

Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain...

8.7CVSS5.9AI score
SaveExploits0References4
The Hacker News
The Hacker News
added 2026/07/30 11:54 a.m.70 views

Microsoft Copilot for Word Can Copy Hidden Prompts Into New Documents

Hidden instructions in a Word document can make Microsoft 365 Copilot rewrite figures in a report, then copy the same instructions into the finished file. Håkon Måløy disclosed the technique on July 28, 144 days after reporting it to Microsoft. In his proof of concept, the internally generated fi...

5.9AI score
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/07/30 9:47 a.m.10 views

CVE-2026-64465

A flaw was found in the Linux kernel's USB xHCI eXtensible Host Controller Interface driver. When a USB device with active stream endpoints is disconnected, the system attempts to free stream resources while holding a lock with interrupts disabled. This can lead to a situation where a function th...

5.5CVSS5.9AI score0.00184EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/30 6:0 a.m.10 views

EUVD-2026-50986

The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in...

6.1CVSS5.9AI score0.00209EPSS
SaveExploits0References1
Rows per page
Query Builder