Lucene search
+L

14028 matches found

Nuclei
Nuclei
added 7 hours ago134 views

LearnDash LMS < 4.10.2 - Sensitive Information Exposure via assignments

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.1 via direct file access due to insufficient protection of uploaded assignments. This makes it possible for unauthenticated attackers to obtain those uploads. id:...

5.3CVSS6.7AI score0.02419EPSS
SaveExploits1References5
Nuclei
Nuclei
added 7 hours ago42 views

Java-springboot-codebase 1.1 - Arbitrary File Read

OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77e0816f250af01ad2, insufficient path traversal mechanisms make absolute path traversal possible. This vulnerability allows unauthorized...

8.7CVSS7.7AI score0.04035EPSS
SaveExploits24References5
Nuclei
Nuclei
added 7 hours ago76 views

WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access

WordPress Welcart e-Commerce plugin before 2.8.5 is susceptible to arbitrary file access. The plugin does not validate user input before using it to output the content of a file, which can allow an attacker to read arbitrary files on the server, obtain sensitive information, modify data, and/or...

7.5CVSS7.4AI score0.02941EPSS
SaveExploits2References3
Nuclei
Nuclei
added 7 hours ago108 views

Gradio < 2.5.0 - Arbitrary File Read

Files on the host computer can be accessed from the Gradio interface id: CVE-2021-43831 info: name: Gradio 2.5.0 - Arbitrary File Read author: isacaya severity: high description: | Files on the host computer can be accessed from the Gradio interface impact: | An attacker would be able to view the...

7.7CVSS7.2AI score0.03794EPSS
SaveExploits1References2
Nuclei
Nuclei
added 7 hours ago14 views

Karel IP Phone IP1211 Web Management Panel - Local File Inclusion

Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. id: CVE-2025-34023 info: name: Karel IP Phone IP1211 Web Management Pane...

8.5CVSS5.7AI score0.01441EPSS
SaveExploits0References3
Nuclei
Nuclei
added 7 hours ago38 views

Frontend File Manager Plugin <= 23.5 - Unauthenticated Arbitrary Email Sending

Frontend File Manager Plugin WordPress plugin through 23.5 contains an open relay and unauthorized file access vulnerability caused by lack of authentication and security checks, letting unauthenticated attackers send emails and access files, exploit requires no authentication. id: CVE-2026-0829...

5.8CVSS5.5AI score0.00682EPSS
SaveExploits0References4
Nuclei
Nuclei
added 7 hours ago27 views

Danswer - Insecure Direct Object Reference

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file. id: CVE-2024-9617 info: name: Danswer - Insecure Direct Object Reference author: s4e-io severity: medium...

6.5CVSS6.6AI score0.01641EPSS
SaveExploits0
RedhatCVE
RedhatCVE
added yesterday5 views

CVE-2026-15788

A flaw was found in BuildKit. An untrusted user, when authoring a build on a Windows Container on Windows WCOW configured BuildKit daemon, can exploit a vulnerability in the cache mount source selector. This flaw allows the user to read arbitrary files from the host system, leading to information...

7.5CVSS5.6AI score0.00145EPSS
SaveExploits0References4
NVD
NVD
added yesterday7 views

CVE-2026-20310

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

9.1CVSS
SaveExploits0References1
CVE
CVE
added yesterday22 views

CVE-2026-20313

CVE-2026-20313 relates to memory corruption vulnerabilities in Cisco Catalyst SD-WAN components stemming from improper link resolution before file access (CWE-1284). The connected CVE records reference Cisco’s internal security hardening releases addressing multiple previously discovered issues. ...

7.7CVSS5.5AI score
SaveExploits0References1
EUVD
EUVD
added yesterday8 views

EUVD-2026-53476

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

7.7CVSS5.5AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday4 views

CVE-2026-20313

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

7.7CVSS5.5AI score
SaveExploits0References2Affected Software2
EUVD
EUVD
added yesterday6 views

EUVD-2026-53471

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

9.1CVSS5.5AI score
SaveExploits0References1
Cvelist
Cvelist
added yesterday21 views

CVE-2026-20310 Cisco SD-WAN Software Security Hardening Release - Improper Link Resolution Before File Access

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

9.1CVSS
SaveExploits0References1
CVE
CVE
added yesterday47 views

CVE-2026-20310

Cisco Catalyst SD-WAN software contains CVE-2026-20310 addressing improper link resolution before file access (CWE-59). Affected component: Cisco Catalyst SD-WAN software; root cause: improper link resolution before file access. Impact per CVSS: Critical (9.1) with high confidentiality, integrity...

9.1CVSS5.5AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday5 views

CVE-2026-20310

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The...

9.1CVSS5.5AI score
SaveExploits0References2Affected Software2
RedhatCVE
RedhatCVE
added yesterday5 views

CVE-2026-71235

A flaw was found in Magistrala's Rules Engine. An authenticated low-privileged user can exploit this vulnerability by creating rules with embedded Go or Lua scripts. These scripts are executed server-side without sufficient validation, allowing for arbitrary file read and write operations, access...

8.8CVSS5.6AI score
SaveExploits0References4
NVD
NVD
added yesterday5 views

CVE-2026-71235

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

8.8CVSS
SaveExploits0References1
EUVD
EUVD
added yesterday4 views

EUVD-2026-53328

In Eclipse Mojarra versions 2.3 and following, URL handing in DefaultFaceletFactory does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target...

7.5CVSS5.6AI score
SaveExploits0References2
Cvelist
Cvelist
added yesterday22 views

CVE-2026-71235 Magistrala IoT Platform: Unrestricted Go/Lua Script Execution in Rules Engine

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Go script engine re/golang.go runs scripts through the Yaegi interpreter with stdlib.Symbols, exposing the full Go standard library including os...

8.8CVSS
SaveExploits0References1
Rows per page
Query Builder