Lucene search
+L

19921 matches found

OSV
OSV
added 2026/08/20 6:16 p.m.8 views

DEBIAN-CVE-2026-73259

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...

5.4CVSS5.4AI score0.0023EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/20 5:39 p.m.39 views

CVE-2026-73259

CVE-2026-73259 is a reflected cross-site scripting (XSS) vulnerability in Mongoose , an embedded web server and network library, affecting versions prior to 7.22 . The flaw resides in the mg_http_serve_dir() and listdir() functions in src/http.c, which insert a percent-decoded request URI into th...

5.4CVSS5AI score0.0023EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/20 5:29 p.m.10 views

GHSA-533J-2V4Q-MW5H LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

Executive Summary A NoSQL injection issue exists in the langgraph-checkpoint-mongodb and langgraph-store-mongodb libraries. MongoDBSaver.list and MongoDBStore.search methods accept a filter parameter that is incorporated into MongoDB queries without sufficient validation. Because MongoDB query...

7.7CVSS5.8AI score
SaveExploits0References4
Circl
Circl
added 2026/08/20 2:09 p.m.21 views

CVE-2026-74014

creationtimestamp| type| source ---|---|--- 2026-08-20 14:09:31+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtjgct3uyj2b 2026-08-20 14:10:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtjgds3hhj2b 2026-08-31 14:00:05+00:00| seen|...

9.9CVSS5.8AI score0.00447EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/20 1:48 p.m.24 views

CVE-2026-76634

WeGIA before 3.9.2 is affected by an Insecure Direct Object Reference (IDOR) vulnerability in the employee profile page (profile_funcionario.php). The root cause is a request extraction function that allows an attacker-supplied id_pessoa parameter to overwrite the session-derived identifier, enab...

7.1CVSS5.6AI score0.00294EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/20 1:48 p.m.12 views

EUVD-2026-63359

WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an idpessoa parameter through a request extraction function that overwrites the session-derived...

7.1CVSS5.5AI score0.00294EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/20 1:47 p.m.8 views

MINI-8Q57-963C-RXMQ

Bulletin has no description...

8.7CVSS4.8AI score0.00396EPSS
SaveExploits0
OSV
OSV
added 2026/08/20 1:47 p.m.9 views

MINI-3Q8X-FF5G-M6M3

Bulletin has no description...

5.3CVSS6.3AI score0.00521EPSS
SaveExploits0
Patchstack
Patchstack
added 2026/08/20 12:48 p.m.8 views

WordPress WP Cafe Pro plugin < 3.0.15 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Cafe Pro versions 3.0.15...

7.5CVSS5.3AI score0.00245EPSS
SaveExploits0Affected Software1
The Hacker News
The Hacker News
added 2026/08/20 11:45 a.m.48 views

Why "Shady AI" is Security's Next Big Governance Problem

In March 2026, an internal AI agent at Meta triggered a “Sev 1” incident after sensitive company and user data was exposed to employees who weren’t authorized to access it. The incident began when a Meta employee posted a technical question on an internal forum. An engineer used an approved AI...

5.8AI score
SaveExploits0
Cvelist
Cvelist
added 2026/08/20 8:19 a.m.43 views

CVE-2026-14952 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is offering files with sensitive information for download without requiring authentication

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

8.7CVSS0.00496EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/08/20 6:24 a.m.12 views

CVE-2026-74250

A flaw was found in OpenStack Ironic. The autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface. This can lead to operational issues where necessary cleaning procedures are not executed. Mitigation Use an explicit...

6.3CVSS5.3AI score0.00254EPSS
SaveExploits0References4
Circl
Circl
added 2026/08/20 4:45 a.m.19 views

CVE-2026-76313

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:43+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820 2026-08-21 22:07:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mtmrhqaepp2y...

8.8CVSS4.7AI score0.00499EPSS
SaveExploits0References2
Circl
Circl
added 2026/08/20 4:45 a.m.21 views

CVE-2026-76260

creationtimestamp| type| source ---|---|--- 2026-08-20 04:45:24+00:00| seen| https://www.hkcert.org/security-bulletin/splunk-products-multiple-vulnerabilities20260820...

6.5CVSS4.8AI score0.00259EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/20 12:35 a.m.23 views

EUVD-2026-63137

In OpenStack Aodh before 22.0.1, the alarm list API bypasses project scoping when the allprojects query parameter is set to false. The API checks for the presence of the allprojects key rather than its value; a true value enforces the administrator-only policy, but a false value removes the key a...

8.4CVSS5.4AI score0.00476EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/08/20 12:35 a.m.20 views

EUVD-2026-62941

In versions below 2.1.9 of the AWS IAM app for Splunk SOAR, a user who holds a role with permission to run actions could expose sensitive AWS credentials by invoking an action that accepts the credentials parameter, because the parameter is not masked and is shown in cleartext in the user...

4.3CVSS5.3AI score0.00139EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/20 12:35 a.m.16 views

EUVD-2026-62944

In versions below 2.2.1 of the Cisco Webex app for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive meeting password by invoking the schedule meeting action, because the action's password parameter is not masked and is shown in cleartext in the user...

4.3CVSS5.3AI score0.00145EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/20 12:35 a.m.18 views

EUVD-2026-62939

In versions below 2.3.8 of the AD LDAP app for Splunk SOAR, a user who holds a role with permission to run actions could cause sensitive Active Directory response data to be written to a persistent debug log file by triggering write operations through the app. For more information see Run an acti...

4.3CVSS5.3AI score0.00215EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/20 12:35 a.m.17 views

EUVD-2026-62949

In versions below 2.2.1 of the Splunk Attack Analyzer Connector for Splunk SOAR, a user who holds a role with permission to run actions could expose a sensitive archive password by invoking either the detonate file or detonate url action, because the action's archivepassword parameter is not mask...

4.3CVSS5.3AI score0.00139EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/20 12:35 a.m.12 views

EUVD-2026-62914

In Splunk Enterprise versions below 10.2.6, 10.0.9, and 9.4.14, an unauthenticated user could trick an authenticated user into running arbitrary Search Processing Language SPL commands using the permissions of the authenticated user through a crafted Splunk Web link. The SPL commands could access...

6.4CVSS5.5AI score0.00211EPSS
SaveExploits0References2
Rows per page
Query Builder