Lucene search
+L

315769 matches found

OSV
OSV
added yesterday3 views

MAL-2026-12028 Malicious code in sextant-cli-darwin-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9d2e5ab6503eb2b9c12bf64e34cb2fe12227c07b179231ebe23f13b8866181f1 The tarball contains a single 13.4 MB Mach-O darwin/amd64 Go binary at bin/sxt and a package.json with no source, no main, no bin mapping, and no...

5.5AI score
SaveExploits0References33
OSV
OSV
added yesterday3 views

MAL-2026-12029 Malicious code in sextant-cli-linux-amd64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef2c5b4e1a7b46248be73f0ae010359845d3f51ea19241e17625021d91c2ec9c The npm package ships a Go binary sxt that on execution registers with the hardcoded C2 host relay.sextant.top, establishes WebRTC pion DataChannels...

5.8AI score
SaveExploits0References24
Cvelist
Cvelist
added yesterday24 views

CVE-2026-18854 Shandong Hoteam PDM Product Data Management System DataService GetStoredClassByFilter sql injection

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation ...

7.5CVSS0.00254EPSS
SaveExploits0References5
CVE
CVE
added yesterday16 views

CVE-2026-18854

The CVE-2026-18854 affects Shandong Hoteam PDM Product Data Management System up to version 8.3.10. The vulnerability is in the GetStoredClassByFilter function of /Base/BaseService.asmx/DataService, where manipulating the FilterString argument enables SQL injection. Remote exploitation is possibl...

7.5CVSS5.3AI score0.00254EPSS
SaveExploits0References5
EUVD
EUVD
added yesterday5 views

EUVD-2026-53011

A vulnerability has been found in Shandong Hoteam PDM Product Data Management System up to 8.3.10. The impacted element is the function GetStoredClassByFilter of the file /Base/BaseService.asmx/DataService. The manipulation of the argument FilterString leads to sql injection. Remote exploitation ...

7.5CVSS6.8AI score0.00254EPSS
SaveExploits0References5
CISA KEV Catalog
CISA KEV Catalog
added yesterday7 views

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol...

9.8CVSS6.7AI score0.00649EPSS
SaveIn wildExploits1
CVE
CVE
added yesterday10 views

CVE-2025-63822

SirenGPS Android Application 2.19.44 is affected by an Incorrect Access Control vulnerability. An authenticated attacker can manipulate user identifier parameters to bypass authorization checks and gain unauthorized READ and WRITE access to other users’ personal information. The API does not vali...

5.5AI score
SaveExploits0References2
Cvelist
Cvelist
added yesterday14 views

CVE-2025-63822

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the...

SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2 days ago5 views

Malicious code in approval-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87 The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan walks the...

5.5AI score
SaveExploits0References5
OSV
OSV
added 2 days ago3 views

MAL-2026-11995 Malicious code in approval-guardian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71875c984aab2d8335b3efdd1b107d7adbd4c3cbd6309278b6804c8162bdca87 The package presents itself as an on-chain approval scanner but on CLI invocation runs a silent credential harvester. src/index.js scan walks the...

5.5AI score
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2 days ago4 views

openjdk: OpenJDK: Improve certification checking (Oracle CPU 2026-07)

A flaw was found in OpenJDK where it incorrectly interprets wildcard dNSName Subject Alternative Names SANs in certificates. This discrepancy between certificate policy enforcement and hostname verification could allow a remote attacker to bypass certificate validation. As a result, an attacker...

6.5CVSS7.2AI score0.00268EPSS
SaveExploits0References4
NVD
NVD
added 2 days ago9 views

CVE-2026-67861

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the UAClientgetRemoteDataTypes component...

7.5CVSS0.00417EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2 days ago4 views

CVE-2026-45084

A flaw was found in OpenSIPS. A remote attacker can exploit this vulnerability to cause a denial of service DoS. This occurs in the presence module when processing a Session Initiation Protocol SIP PUBLISH request with specific headers and a message body. The system attempts to access uninitializ...

8.7CVSS5.6AI score0.00464EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2 days ago3 views

CVE-2026-15920

A flaw was found in Django. The django.contrib.admin.utils.displayforfield function renders URLField values as clickable links in the administrative interface without proper validation. If an application persists URLField data containing an unsafe scheme without running model validation, a remote...

6.1CVSS5.6AI score0.00304EPSS
SaveExploits0References10
CVE
CVE
added 2 days ago16 views

CVE-2026-70619

Odysseus has a missing authorization flaw in embedding endpoint management routes (pre-commit bf325f6) that lets authenticated non-admin users overwrite server-wide embedding backend configuration via management routes that only verify session authentication. The attacker-controlled URL can cause...

8.8CVSS5.5AI score0.00364EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2 days ago36 views

CVE-2026-70619 Odysseus Missing Admin Authorization via Embedding Endpoint Routes

Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend configuration by invoking endpoint management routes that verify session authentication but omit the admin authorization guard. Attackers...

8.8CVSS0.00364EPSS
SaveExploits0References5
NVD
NVD
added 2 days ago9 views

CVE-2026-66901

Google::Auth versions before 0.09 for Perl allow server side request forgery and credential exfiltration via unvalidated URLs taken from the credentials JSON. The URLs the library requests are read from the credentials JSON, and their hosts were not checked against the universe domain before the...

7.5CVSS0.00183EPSS
SaveExploits0References6
NVD
NVD
added 2 days ago6 views

CVE-2026-70479

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, with WEBLOADERENGINE=playwright, the Playwright web loader validates only the top-level page request and lets sub-resource requests pass unvalidated. A page supplied by an authenticated...

7.7CVSS0.0026EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2 days ago8 views

Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering

Summary Open WebUI renders vega and vega-lite fenced code blocks in chat content by building a Vega view in the viewer's browser without a restricted resource loader. Any user who can place such a block where another user will see it can make that user's browser issue attacker-chosen outbound GET...

4.1CVSS5.5AI score0.00192EPSS
SaveExploits0References5Affected Software1
NVD
NVD
added 2 days ago7 views

CVE-2026-69704

Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized...

7CVSS0.00276EPSS
SaveExploits0References3
Rows per page
Query Builder