Lucene search
+L

61717 matches found

CVE
CVE
added 2026/08/13 9:44 a.m.45 views

CVE-2026-59507

Technical details about CVE-2026-59507 are not publicly available in the provided documents. Monitor for updates.

9.3CVSS5.2AI score0.00244EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/13 12:31 a.m.13 views

EUVD-2026-57638

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

9.8CVSS5.9AI score0.00786EPSS
SaveExploits1References4
Positive Technologies
Positive Technologies
added 2026/08/13 12:00 a.m.5 views

PT-2026-71914

Budibase is an open-source low-code platform. Prior to 3.39.25, GET /api/users/metadata and GET /api/users/metadata/:id returned user objects processed by packages/server/src/utilities/global.ts without removing oauth2.accessToken or oauth2.refreshToken. A user with the POWER role could retrieve...

4.9CVSS5.3AI score0.00356EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/12 10:17 p.m.16 views

CVE-2026-73519

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

9.8CVSS0.00786EPSS
SaveExploits1References3
NVD
NVD
added 2026/08/12 9:17 p.m.10 views

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

6.8CVSS0.00113EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/12 9:17 p.m.65 views

CVE-2026-73498

The MCP Atlassian MCP server (Confluence/Jira) is affected by an arbitrary file read in confluence_upload_attachment prior to version 0.22.0. The function passes a client-supplied file_path directly to open(file_path, "rb") via _upload_attachment_direct() without validating the path, allowing an ...

7.7CVSS5.3AI score0.00327EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/12 9:17 p.m.25 views

CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...

7.7CVSS0.00327EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/08/12 9:17 p.m.6 views

CVE-2026-73498 MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_attachment

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment passes its client-supplied filepath directly to openfilepath, "rb" in src/mcpatlassian/confluence/attachments.py through uploadattachmentdirect without...

7.7CVSS5.3AI score0.00327EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/12 9:15 p.m.30 views

CVE-2026-73519 WolfStack < 25.9.2 Hard-coded Secret Authentication Bypass via X-WolfStack-Secret

WolfStack before 25.9.2 contains a hard-coded cluster-authentication secret compiled into every build and published as a constant in src/auth/mod.rs, allowing remote unauthenticated attackers to bypass authentication by supplying this value in the X-WolfStack-Secret header to the requireauth gate...

9.3CVSS6AI score
SaveExploits0References6
Chainguard
Chainguard
added 2026/08/12 8:24 p.m.11 views

GHSA-QVW7-JM5C-6HQW vulnerabilities

Vulnerabilities for packages: dotnet-bootstrap...

5.2AI score
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/08/12 8:14 p.m.7 views

CVE-2026-19502

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

6.8CVSS5.7AI score0.00113EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/08/12 8:14 p.m.42 views

CVE-2026-19502

CVE-2026-19502 affects MongoDB SQL Schema Builder CLI. The issue is insufficient redaction of sensitive startup/connection configuration in diagnostic output (stdout and log files), allowing a local user with access to terminals or logs to view authentication material. The documentation provided ...

6.8CVSS5.7AI score0.00113EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/12 8:14 p.m.32 views

CVE-2026-19502 Insufficient redaction of sensitive configuration values in diagnostic output of MongoDB SQL Schema Builder CLI

MongoDB SQL Schema Builder CLI records its startup configuration to standard output and, when file logging is enabled, to a log file on disk. Certain connection settings were written without redaction, so authentication material supplied by the operator could appear in plaintext in that diagnosti...

6.8CVSS0.00113EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/12 4:59 p.m.34 views

CVE-2026-16694 IBM i is Affected By Stored Cross-site Scripting for i

IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

6.4CVSS0.00165EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/12 4:17 p.m.16 views

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

6.5CVSS0.00388EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/08/12 3:50 p.m.9 views

CVE-2026-68448

A flaw was found in the Linux kernel's overlayfs component. When copying files across different overlay filesystems, the system incorrectly checked read permissions using the destination filesystem's credentials instead of the source's. This oversight could allow an unauthorized user to read file...

7CVSS5.3AI score0.00155EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/12 3:31 p.m.7 views

CVE-2026-65017

Apache Airflow's Config API did not mask team-scoped sensitive configuration values in multi-team deployments. When an administrator has enabled multi-team mode and exposed the Config API, an authenticated Viewer holding only configuration-read access — with no prior access to the secret — could...

6.5CVSS5.3AI score0.00664EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/08/12 3:23 p.m.16 views

EUVD-2026-57265

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

5.4CVSS5.4AI score0.00342EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/12 10:29 a.m.9 views

MAL-2026-13806 Malicious code in egypt0811 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77d31e1b5baa802662cbb61387f5c3b759d159e74e8776d9515198db5c168074 The package contains only index.html declared as main with no JavaScript modules, no lifecycle scripts preinstall/install/postinstall, and no bin...

5.5AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/12 10:29 a.m.23 views

Malicious code in hcfguyfrmblp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f806fc6db71a1b888ba1f86d790b7a2866b4911e7f77ade2d375237e8c0a6ea2 The tarball contains only package.json and index.html, with no lifecycle scripts and main set to index.html. The HTML page mimics a Cloudflare...

5.5AI score
SaveExploits0References2
Rows per page
Query Builder