Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
Assessment
Vulnerability Intelligence
Exploits
Alerts
Datasets
MCP
White Label
Security Automation SDK
MCP for AI Agents
Plans & Pricing
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

1252697 matches found

Rockylinux
Rockylinux•added 2026/09/04 12:09 p.m.•16 views

grafana security update

An update is available for grafana. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Grafana is an open source, feature rich metrics dashboard and graph editor f...

7.5CVSS7AI score0.00798EPSS
SaveExploits0
OSV
OSV•added 2026/09/04 12:05 p.m.•15 views

RLSA-2026:63136 Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive...

8.1CVSS5.5AI score0.00568EPSS
SaveExploits0References6
Rockylinux
Rockylinux•added 2026/09/04 12:05 p.m.•16 views

grafana-pcp security update

An update is available for grafana-pcp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The Grafana plugin for Performance Co-Pilot includes datasources for...

7.5CVSS5.9AI score0.00568EPSS
SaveExploits0
EUVD
EUVD•added 2026/09/04 11:44 a.m.•13 views

EUVD-2026-71037

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Menulux Software Inc. Menulux Portal allows Stored XSS. This issue affects Menulux Portal: before 20260903211448...

5.4CVSS5.3AI score0.00162EPSS
SaveExploits0References1
EUVD
EUVD•added 2026/09/04 11:30 a.m.•19 views

EUVD-2026-71034

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

6.4CVSS6AI score0.00239EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2026/09/04 11:30 a.m.•16 views

CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

6.4CVSS6AI score0.00239EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2026/09/04 11:30 a.m.•47 views

CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

6.4CVSS0.00239EPSS
SaveExploits0References2
OSV
OSV•added 2026/09/04 11:30 a.m.•9 views

CVE-2026-85615 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId. Authenticated attackers can supply an arbitrary victim dashboardId with their own projectId ...

5.3CVSS6.1AI score
SaveExploits0References4
CVE
CVE•added 2026/09/04 11:30 a.m.•21 views

CVE-2026-85615

Openpanel before 2.3.0 is affected by an insecure direct object reference (IDOR) vulnerability in the report.getLayouts and report.resetLayout tRPC procedures. The root cause is a failure to bind dashboardId to the authorized projectId , allowing an authenticated attacker to supply an arbitrary v...

6.4CVSS6AI score0.00239EPSS
SaveExploits0References2
CVE
CVE•added 2026/09/04 11:30 a.m.•25 views

CVE-2026-85616

Snipe-IT versions before 8.6.2 contain an authorization bypass in checkout-acceptance report actions when Full Multiple Company Support is enabled. An authenticated user with the reports.view permission can exploit a null check on the legacy users.company_id column to enumerate sequential accepta...

8.5CVSS5.7AI score0.00376EPSS
SaveExploits1References2Affected Software1
CVE
CVE•added 2026/09/04 11:30 a.m.•25 views

CVE-2026-85613

OpenPanel before 2.3.0 is vulnerable to an unauthenticated cross-site scripting (XSS) flaw in the favicon proxy endpoint GET /misc/favicon . An attacker can supply a URL pointing to a malicious SVG file with embedded scripts; when a victim's browser loads the proxy, the script executes on the API...

8.4CVSS6AI score0.00395EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2026/09/04 11:30 a.m.•53 views

CVE-2026-85613 OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

8.4CVSS0.00395EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2026/09/04 11:30 a.m.•10 views

CVE-2026-85613 OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the...

8.4CVSS6AI score0.00395EPSS
SaveExploits0References2
EUVD
EUVD•added 2026/09/04 11:30 a.m.•13 views

EUVD-2026-71030

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

6.4CVSS5.4AI score0.00239EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2026/09/04 11:30 a.m.•47 views

CVE-2026-85611 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

6.4CVSS0.00239EPSS
SaveExploits0References2
CVE
CVE•added 2026/09/04 11:30 a.m.•16 views

CVE-2026-85611

OpenPanel versions before 2.3.0 are affected by a cross-tenant Broken Object Level Authorization (BOLA) vulnerability in the report.getLayouts and report.resetLayout tRPC procedures. The root cause is that these procedures fail to scope dashboard queries to the caller's own project, allowing an a...

6.4CVSS5.9AI score0.00239EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment•added 2026/09/04 11:30 a.m.•17 views

CVE-2026-85611 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project. Authenticated attackers can supply their own projectId with a victim...

6.4CVSS5.9AI score0.00239EPSS
SaveExploits0References2
Cvelist
Cvelist•added 2026/09/04 11:30 a.m.•43 views

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

5.4CVSS0.0028EPSS
SaveExploits0References2
OSV
OSV•added 2026/09/04 11:30 a.m.•17 views

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

5.1CVSS6.1AI score
SaveExploits0References4
Vulnrichment
Vulnrichment•added 2026/09/04 11:30 a.m.•15 views

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

5.4CVSS6.4AI score0.0028EPSS
SaveExploits0References2
Rows per page
Query Builder