Lucene search
+L

77298 matches found

Tenable Nessus
Tenable Nessus
added 2026/07/14 12:00 a.m.10 views

EulerOS 2.0 SP10 : curl (EulerOS-SA-2026-2684)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : libcurl might in some circumstances reuse the wrong connection for SMBS transfers. libcurl features a pool of recent connections so that subsequent...

7.5CVSS6.2AI score0.00618EPSS
SaveExploits4References6
Redos
Redos
added 2026/07/14 12:00 a.m.9 views

ROS-20260714-73-0004

The vulnerability of the iLBC packet analyzer in Wireshark relates to a memory reclamation error. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

7.5CVSS7AI score0.00206EPSS
SaveExploits1
OSV
OSV
added 2026/07/13 9:50 p.m.19 views

MAL-2026-10505 Malicious code in express-ini (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 901c68ddbe24451843ae250e4fa71b40b1d4f86d1c81a62bc8f313a55701b7d3 package.json declares postinstall=node index.js. index.js is heavily obfuscated obfuscator.io rotated string-array with RC4-based decoders hiding all...

6.5AI score
SaveExploits0References2
NVD
NVD
added 2026/07/13 6:16 p.m.14 views

CVE-2026-61501

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs ar...

6.1CVSS0.00308EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/13 5:22 p.m.14 views

CVE-2026-61501 Rejetto HFS < 3.2.1 Stored XSS in Admin Log Viewer

Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs ar...

5.3CVSS6.3AI score
SaveExploits0References5
OSV
OSV
added 2026/07/13 3:46 p.m.15 views

PYSEC-2026-3408 vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via Anthropic router

vLLM: incomplete CVE-2026-22778 fix leaks PIL repr addresses via the Anthropic API router Researcher: Kai Aizen — SnailSploit @SnailSploit, Adversarial & Offensive Security Research Severity: CVSS 3.1 5.3 Medium AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Target: https://github.com/vllm-project/vllm ---...

5.3CVSS6.2AI score0.00823EPSS
SaveExploits1References7
OSV
OSV
added 2026/07/13 3:19 p.m.9 views

PYSEC-2026-2680 NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

Summary Two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log...

5.3CVSS6.2AI score0.00343EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/13 3:15 p.m.12 views

PYSEC-2026-2993 PyLoad vulnerable to unauthenticated traceback disclosure via global exception handler in WebUI

Summary pyload-ng WebUI returns full Python traceback details to clients on unhandled exceptions. Because /web/ is reachable without authentication and renders attacker-controlled template names, an unauthenticated user can reliably trigger a server exception for example by requesting a...

5.3CVSS6.1AI score0.00336EPSS
SaveExploits1References5
OSV
OSV
added 2026/07/13 2:36 p.m.9 views

PYSEC-2026-2467 python-ecdsa: Denial of Service via improper DER length validation in crafted private keys

Summary An issue in the low-level DER parsing functions can cause unexpected exceptions to be raised from the public API functions. 1. ecdsa.der.removeoctetstring accepts truncated DER where the encoded length exceeds the available buffer. For example, an OCTET STRING that declares a length of 40...

5.3CVSS6.1AI score0.00476EPSS
SaveExploits1References7
OSV
OSV
added 2026/07/13 2:36 p.m.9 views

PYSEC-2026-2764 Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`

Summary An unsanitised filename field in the speech-to-text transcription endpoint allows any authenticated non-admin user to trigger a FileNotFoundError whose message — including the server's absolute DATADIR path — is returned verbatim in the HTTP 400 response body, confirming information...

4.3CVSS6.2AI score0.00427EPSS
SaveExploits1References6
OSV
OSV
added 2026/07/13 2:36 p.m.8 views

PYSEC-2026-2507 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

Summary The ha-mcp OAuth consent form beta feature accepts a user-supplied haurl and makes a server-side HTTP request to haurl/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional co...

5.3CVSS6.3AI score0.00278EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/13 2:36 p.m.8 views

PYSEC-2026-2374 Apache Superset allows privileged users to conduct error-based SQL Injection

Improper Neutralization of Special Elements used in a SQL Command 'SQL Injection' vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users...

5.3CVSS6.1AI score0.00503EPSS
SaveExploits2References6
PyPA
PyPA
added 2026/07/13 2:36 p.m.16 views

Rucio WebUI has Username Enumeration via Login Error Message

SummaryThe WebUI login endpoint returns distinct error messages depending on whether a supplied username exists, allowing unauthenticated attackers to enumerate valid usernames. DetailsWhen submitting invalid credentials to /ui/login, the WebUI responds with different error messages based on the...

5.3CVSS6.1AI score0.00327EPSS
SaveExploits1References9Affected Software1
OSV
OSV
added 2026/07/13 2:36 p.m.9 views

PYSEC-2026-3056 Rucio WebUI has a Reflected Cross-site Scripting Vulnerability

Summary A reflected Cross-site Scripting vulnerability was located in the rendering of the ExceptionMessage of the WebUI 500 error which could allow attackers to steal login session tokens of users who navigate to a specially crafted URL. Details The WebUI error message renders ExceptionMessage...

8.1CVSS6.3AI score0.00263EPSS
SaveExploits1References9
OSV
OSV
added 2026/07/13 2:36 p.m.7 views

PYSEC-2026-2348 Apache Airflow error reporting may expose full kwargs

When a DAG failed during parsing, Airflow’s error-reporting in the UI could include the full kwargs passed to the operators. If those kwargs contained sensitive values such as secrets, they might be exposed in the UI tracebacks to authenticated users who had permission to view that DAG. The issue...

6.5CVSS6AI score0.00801EPSS
SaveExploits0References8
OSV
OSV
added 2026/07/13 2:36 p.m.8 views

PYSEC-2026-2469 Emmett-Core: Unhandled CookieError Exception Causing Denial of Service

Summary The cookies property in emmettcore.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. Details Location: emmettcore/http/wrappers/init.py line 64...

7.5CVSS6.1AI score0.00271EPSS
SaveExploits0References7
RedHat Linux
RedHat Linux
added 2026/07/13 2:29 p.m.11 views

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

5.3CVSS6AI score0.0037EPSS
SaveExploits0References8
OSV
OSV
added 2026/07/13 2:19 p.m.8 views

PYSEC-2026-3317 TensorFlow has Floating Point Exception in AudioSpectrogram

Impact version:2.11.0 //core/ops/audioops.cc:70 Status SpectrogramShapeFnInferenceContext c ShapeHandle input; TFRETURNIFERRORc-WithRankc-input0, 2, &input; int32t windowsize; TFRETURNIFERRORc-GetAttr"windowsize", &windowsize; int32t stride; TFRETURNIFERRORc-GetAttr"stride", &stride; .....1...

7.5CVSS6.6AI score0.00383EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/13 2:19 p.m.10 views

PYSEC-2026-3106 TensorFlow has Null Pointer Error in SparseSparseMaximum

Impact When SparseSparseMaximum is given invalid sparse tensors as inputs, it can give an NPE. python import tensorflow as tf tf.rawops.SparseSparseMaximum aindices=1, avalues = 0.1 , ashape = 2, bindices=, bvalues =2 , bshape = 2, Patches We have patched the issue in GitHub commit...

7.5CVSS6.6AI score0.00439EPSS
SaveExploits1References6
OSV
OSV
added 2026/07/13 2:19 p.m.11 views

PYSEC-2026-3098 TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantize

Impact NPE in QuantizedMatMulWithBiasAndDequantize with MKL enable python import tensorflow as tf func = tf.rawops.QuantizedMatMulWithBiasAndDequantize para='a': tf.constant138, dtype=tf.quint8, 'b': tf.constant4, dtype=tf.qint8, 'bias': 31.81644630432129, 47.21876525878906, 109.95201110839844,...

7.5CVSS6.6AI score0.00391EPSS
SaveExploits0References6
Rows per page
Query Builder