Lucene search
+L

17871 matches found

OSV
OSV
added 2026/06/29 11:50 a.m.10 views

PYSEC-2026-276 Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context

Edge3 Worker RPC RCE on Airflow 2. This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if projects installed and configured it on Airflow 2. The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if projects installed a...

9.8CVSS5.9AI score0.00837EPSS
SaveExploits0References8
OSV
OSV
added 2026/06/29 5:48 a.m.12 views

BIT-NODE-2026-48928

A inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26...

5.4CVSS6.1AI score0.00216EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/06/28 12:0 a.m.15 views

Linux Distros Unpatched Vulnerability : CVE-2026-53095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix abuse of kprobewritectx via freplace uprobe programs are allowed to modify struct...

5.5CVSS5.3AI score0.00121EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/06/28 12:0 a.m.15 views

Linux Distros Unpatched Vulnerability : CVE-2026-53263

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 6lowpan: fix off-by-one in multicast context address compression The second memcpy in lowpaniphcmcastctxaddrcompress uses &data1 as destination and...

5.5CVSS5.9AI score0.00115EPSS
SaveExploits0References3
Mageia
Mageia
added 2026/06/27 5:16 p.m.23 views

Updated krb5 packages fix security vulnerabilities

CVE-2025-3576, A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity...

7.5CVSS5.8AI score0.00611EPSS
SaveExploits2References6
OSV
OSV
added 2026/06/27 1:20 p.m.5 views

MINI-22WJ-H34M-WV9F

Bulletin has no description...

9.1CVSS5.7AI score0.00525EPSS
SaveExploits0
OSV
OSV
added 2026/06/27 1:20 p.m.10 views

MINI-GCWF-6X44-QVX3

Bulletin has no description...

6.1CVSS5.7AI score0.00223EPSS
SaveExploits0
Microsoft CVE
Microsoft CVE
added 2026/06/27 8:19 a.m.13 views

6lowpan: fix off-by-one in multicast context address compression

...

5.5CVSS5.8AI score0.00115EPSS
SaveExploits0
Microsoft CVE
Microsoft CVE
added 2026/06/27 8:16 a.m.15 views

Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

...

6.3CVSS5.8AI score0.00321EPSS
SaveExploits0
Microsoft CVE
Microsoft CVE
added 2026/06/27 8:8 a.m.12 views

misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context

...

7.8CVSS5.8AI score0.00126EPSS
SaveExploits0
Microsoft CVE
Microsoft CVE
added 2026/06/27 8:4 a.m.16 views

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

...

7.8CVSS5.8AI score0.00126EPSS
SaveExploits0
OSV
OSV
added 2026/06/27 6:11 a.m.5 views

BELL-CVE-2026-53149

Bulletin has no description...

7.1CVSS5.7AI score0.00126EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/26 11:2 p.m.12 views

GHSA-39G2-8X68-PMX8 Nezha Monitoring: Stored future DDNS profile ID allows unauthorized use of another user's DDNS profile context

Summary PATCH /server/id accepts and persists nonexistent ddnsprofiles IDs for a member-owned server. If another user later creates a DDNS profile with one of those IDs, the DDNS worker resolves the stored ID and dispatches an update using the other user's DDNS profile configuration in the contex...

6.4CVSS5.8AI score0.00228EPSS
SaveExploits0References3
Circl
Circl
added 2026/06/26 10:11 p.m.12 views

CVE-2026-53576

creationtimestamp| type| source ---|---|--- 2026-06-26 22:11:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp7xlajhsm2c 2026-06-27 20:00:45+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mpcar4z6g52m 2026-06-29 19:25:26+00:00| seen|...

10CVSS5.3AI score0.00592EPSS
SaveExploits3References7
EUVD
EUVD
added 2026/06/26 9:5 p.m.18 views

EUVD-2026-37951

mcp-pinot: Unauthenticated tool invocation via default oauthenabled=False + host 0.0.0.0 bind...

10CVSS5.8AI score0.0093EPSS
SaveExploits0References5
OSV
OSV
added 2026/06/26 9:0 p.m.7 views

GHSA-Q683-8468-R6H6 WebauthnAuthenticator leaks sensitive HTTP headers through INFO-level logs

Impact Webauthn\Bundle\Security\Http\Authenticator\WebauthnAuthenticator logs the full Symfony\Component\HttpFoundation\Request object inside the log context of both onAuthenticationSuccess and onAuthenticationFailure at INFO level: php $this-logger-info'User has been authenticated successfully...

8.7CVSS5.8AI score
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/06/26 8:41 p.m.14 views

CVE-2026-50137

Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id app... and an S3-source datasource id ds... can call this endpoint with no auth and obtain a 15-minute pre-signed PUT URL minted on the victim's IAM identity. The endpoin...

9.4CVSS5.8AI score0.00301EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2026/06/26 8:24 p.m.8 views

JLSEC-2026-647 It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation...

It is possible to cause an use-after-free write in SANM decoding with a carefully crafted animation using subversion storedframe. Stored frames can later be referenced by FTCH chunks. For files using subversion storedframe. Leaving ctx-hasdimensions set to false. A subsequent chunk with type...

8.7CVSS6.8AI score0.00169EPSS
SaveExploits0References4
OSV
OSV
added 2026/06/26 8:17 p.m.5 views

DEBIAN-CVE-2026-53297

In the Linux kernel, the following vulnerability has been resolved: net: mana: Guard manaremove against double invocation If PM resume fails e.g., manaattach returns an error, manaprobe calls manaremove, which tears down the device and sets gd-gdmacontext = NULL and gd-driverdata = NULL. However,...

5.5CVSS5.7AI score0.00121EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/26 8:17 p.m.14 views

CVE-2026-52779

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, a cross-project IDOR / authorization context confusion in the Calendar and Team Planner modules allows a user with management permissions in one project to delete public Calendar or Team Planner Queries...

5.4CVSS0.00185EPSS
SaveExploits0References1
Rows per page
Query Builder