Lucene search
+L

37380 matches found

OSV
OSV
added 2026/06/20 4:8 p.m.7 views

MINI-WW84-RX2J-4QMP

Bulletin has no description...

9.6CVSS5.7AI score0.00347EPSS
SaveExploits0
OSV
OSV
added 2026/06/19 8:46 p.m.18 views

GHSA-JC6X-RJ79-W4MX CoreWCF: WS-Security signature substitution via document-wide Signature lookup

Impact An unauthenticated remote attacker who can place a SOAP header lexically before wsse:Security can embed a ds:Signature of their choosing inside that header and cause the server to verify the attacker-supplied signature instead of the one carried in the security header. Preconditions...

5.9CVSS5.9AI score0.00238EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/19 8:16 p.m.18 views

CVE-2026-49342

YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joine...

5.3CVSS0.00403EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/19 7:13 p.m.8 views

CVE-2026-49342 YARD static cache reads raw traversal paths before router sanitization

YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joine...

5.3CVSS5.9AI score
SaveExploits0References4
CVE
CVE
added 2026/06/19 7:13 p.m.33 views

CVE-2026-49342

YARD (Ruby) prior to 0.9.44 is affected: its static cache lookup reads the request path before router path cleanup, allowing a traversal like /../yard-cache-secret.html to be joined with a document root and retrieve a sibling .html outside the intended static tree. The issue is addressed in versi...

5.3CVSS5.8AI score0.00403EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/06/19 7:13 p.m.10 views

CVE-2026-49342

YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joine...

5.3CVSS5.8AI score0.00403EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/06/19 7:13 p.m.8 views

CVE-2026-49342

YARD is a documentation generation tool for the Ruby programming language. Prior to version 0.9.44, YARD's static cache lookup reads a request path before the router's path cleanup runs. When a server is configured with a document root, a traversal path such as /../yard-cache-secret.html is joine...

5.3CVSS5.8AI score0.00403EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/06/19 4:39 p.m.7 views

MINI-5472-H394-32FH

Bulletin has no description...

6.9CVSS5.7AI score0.00223EPSS
SaveExploits0
OSV
OSV
added 2026/06/19 4:37 p.m.12 views

GHSA-P67V-3W7G-WJG7 Nokogiri: Possible Use-After-Free when directly using `NokogirI::XML::XPathContext` beyond document lifetime

Summary Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collected, evaluating an XPath expression could read invalid memory and potentially segfault. This is only reachable when application co...

6.3CVSS5.9AI score0.00321EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/06/19 4:36 p.m.16 views

Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

Summary Nokogiri::XML::Documentroot= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. Nokogiri...

5.9AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/06/19 4:36 p.m.9 views

GHSA-WJV4-X9W8-WM3H Nokogiri: Possible Use-After-Free when setting `Document#root=` to an invalid node type

Summary Nokogiri::XML::Documentroot= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a heap use-after-free during garbage collection or finalization, leading to an invalid memory read or potentially a segfault. Nokogiri...

6.3CVSS5.9AI score0.00321EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/19 4:35 p.m.14 views

GHSA-5V8H-3H3Q-446P Nokogiri: Possible Use-After-Free when `Nokogiri::XML::Document#encoding=` raises an exception

Summary Calling Documentencoding= with an invalid encoding e.g., a non-string, or a string containing a null byte raises an exception, but only after freeing the document's current encoding string without replacing it. The document is left referencing freed memory, so the next call to...

6.3CVSS5.9AI score0.00341EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/19 4:19 p.m.10 views

MINI-PVQV-W7RC-6V25

Bulletin has no description...

5.3CVSS5.7AI score0.00412EPSS
SaveExploits0
OSV
OSV
added 2026/06/19 10:42 a.m.8 views

CGA-7FW9-HCV3-XF28

Bulletin has no description...

5.8AI score
SaveExploits0
OSV
OSV
added 2026/06/19 10:40 a.m.10 views

CGA-P442-6P7W-3GGG

Bulletin has no description...

8.3CVSS5.8AI score0.00505EPSS
SaveExploits0
OSV
OSV
added 2026/06/19 10:36 a.m.8 views

CGA-CXWC-VVV2-GXJW

Bulletin has no description...

5CVSS6AI score0.00414EPSS
SaveExploits0
GithubExploit
GithubExploit
added 2026/06/19 5:29 a.m.127 views

imagemagick-gs-delegate-hijack-poc

ImageMagick Ghostscript Delegate Search Path PoC This reposit...

5.8AI score
SaveExploits0
SUSE CVE
SUSE CVE
added 2026/06/19 1:58 a.m.14 views

SUSE CVE-2026-6040

A heap use-after-free existed when importing the blank-width characters of an ODF number format. A position value read from the document was not checked against the length of the format-code string, so a malformed number format could be processed against memory outside that string. In fixed...

6.6CVSS5.3AI score0.00114EPSS
SaveExploits0References4
SUSE CVE
SUSE CVE
added 2026/06/19 1:57 a.m.10 views

SUSE CVE-2026-12316

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...

9.1CVSS5.8AI score0.00245EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/06/19 1:57 a.m.10 views

SUSE CVE-2026-12323

Spoofing issue in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 152 and Thunderbird 152...

5.4CVSS5.8AI score0.00168EPSS
SaveExploits0References3
Rows per page
Query Builder