Lucene search
+L

3296 matches found

Vulnrichment
Vulnrichment
added 2026/04/01 12:00 a.m.5 views

CVE-2026-29598

Multiple stored cross-site scripting XSS vulnerabilities in the submitadduser.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the First Name and Last Name parameters...

6AI score0.0016EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/04/01 12:00 a.m.9 views

PT-2026-29476

A regression in the way hashes were calculated caused rules containing the address range syntax x.x.x.x - y.y.y.y that only differ in the address ranges involved to be silently dropped as duplicates. Only the first of such rules is actually loaded into pf. Ranges expressed using the...

5.9AI score0.0025EPSS
SaveExploits0References2
Wired Threat Level
Wired Threat Level
added 2026/03/31 9:25 p.m.13 views

Iran Threatens to Start Attacking Major US Tech Firms on April 1

Tech giants like Apple, Google, and Microsoft are among those on a target list released by Iran’s Islamic Revolutionary Guard Corps...

5.9AI score
SaveExploits0
Wallarm Lab
Wallarm Lab
added 2026/03/30 12:00 p.m.21 views

CISO Spotlight: Dimitris Georgiou on Building Security that Serves People First

Dimitris Georgiou has been a self-professed computer geek since the early 80s. At university, he studied the convergence of educational technology with computer science as part of his psychology MA – finding, to his disbelief, that systems were perilously insecure. Since then, he’s always worked ...

5.8AI score
SaveExploits0
SUSE CVE
SUSE CVE
added 2026/03/28 12:27 a.m.10 views

SUSE CVE-2026-32691

A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit...

5.3CVSS5.9AI score0.00233EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/03/27 6:31 p.m.21 views

EUVD-2026-16698

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform...

8.7CVSS5.9AI score0.00677EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/03/27 6:31 p.m.14 views

Undertow is Vulnerable to HTTP Request/Response Smuggling

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform...

9.1CVSS5.9AI score0.00677EPSS
SaveExploits0References6Affected Software1
NVD
NVD
added 2026/03/27 5:16 p.m.62 views

CVE-2026-28369

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform...

9.1CVSS0.00677EPSS
SaveExploits0References4
UbuntuCve
UbuntuCve
added 2026/03/27 5:16 p.m.9 views

CVE-2026-28369

A flaw was found in Undertow. When Undertow receives an HTTP request where the first header line starts with one or more spaces, it incorrectly processes the request by stripping these leading spaces. This behavior, which violates HTTP standards, can be exploited by a remote attacker to perform...

9.1CVSS5.9AI score0.00677EPSS
SaveExploits0References3
CVE
CVE
added 2026/03/27 4:13 p.m.222 views

CVE-2026-28369

Undertow contains a vulnerability where the first HTTP header line with leading spaces is stripped, violating HTTP standards and enabling request smuggling. Affected component: Undertow HTTP header parsing. Root cause: improper handling that trims leading spaces on the initial header line. Impact...

9.1CVSS5.9AI score0.00677EPSS
SaveExploits0References4Affected Software10
OSV
OSV
added 2026/03/26 8:40 p.m.10 views

CVE-2026-33620 PinchTab: API Bearer Token Exposed in URL Query Parameter via Server Logs and Intermediary Systems

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. PinchTab v0.7.8 through v0.8.3 accepted the API token from a token URL query parameter in addition to the Authorization header. When a valid API credential is sent in the URL, it can be exposed through...

4.3CVSS6.3AI score
SaveExploits0References4
OSV
OSV
added 2026/03/26 5:59 p.m.11 views

GHSA-Q29P-9PFR-J652 libcrux-sha3: Incorrect output from SHAKE squeeze functions

The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE 168 for SHAKE128, 136 for SHAKE256 bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF...

8.7CVSS5.9AI score
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/03/26 5:59 p.m.12 views

libcrux-sha3: Incorrect output from SHAKE squeeze functions

The incremental squeeze functions in the portable SHAKE XOF API, when attempting to squeeze more than RATE 168 for SHAKE128, 136 for SHAKE256 bytes, performed an additional permutation of the state before producing the first output block, thus discarding the first block of RATE bytes of valid XOF...

5.8AI score
SaveExploits0References3Affected Software1
RedhatCVE
RedhatCVE
added 2026/03/26 3:15 p.m.9 views

CVE-2026-4596

A vulnerability was identified in projectworlds Lawyer Management System 1.0. This issue affects some unknown processing of the file /lawyers.php. The manipulation of the argument firstName leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and...

5.1CVSS4.1AI score0.00189EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:15 p.m.11 views

CVE-2026-4471

A weakness has been identified in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /admin/admineditemployee.php. Executing a manipulation of the argument FirstName can lead to sql injection. It is possible to launch the attack remotely. The exploit ha...

9.8CVSS5.8AI score0.00386EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:14 p.m.11 views

CVE-2026-4550

A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulation of the argument Trainerid/fname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the publ...

5.8CVSS5.8AI score0.00263EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/03/26 3:10 p.m.11 views

CVE-2026-32868

OPEXUS eComplaint and eCASE before 10.2.0.0 do not correctly sanitize the contents of first and last name fields in the 'My Information' screen. An authenticated attacker can inject parts of an XSS payload in the first and last name fields. The payload is executed when the full name is rendered...

5.5CVSS5.8AI score0.00141EPSS
SaveExploits0References1
HackRead
HackRead
added 2026/03/26 2:05 p.m.10 views

New PXA Stealer Malware Targets Banks, Uses Telegram to Exfiltrate Data

CyberProof researchers have detected a 10% surge in PXA Stealer attacks targeting financial institutions in Q1 2026. Learn…...

5.8AI score
SaveExploits0
Vulnrichment
Vulnrichment
added 2026/03/26 7:41 a.m.4 views

CVE-2026-4849 code-projects Simple Laundry System Parameter modify.php cross site scripting

A vulnerability was identified in code-projects Simple Laundry System 1.0. This impacts an unknown function of the file /modify.php of the component Parameter Handler. The manipulation of the argument firstName leads to cross site scripting. The attack may be initiated remotely. The exploit is...

5.3CVSS4.2AI score0.0027EPSS
SaveExploits1References5
NVD
NVD
added 2026/03/26 1:16 a.m.9 views

CVE-2026-33287

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the replacefirst filter in LiquidJS uses JavaScript's String.prototype.replace which interprets $& as a back reference to the matched substring. The filter only charges memoryLimit for th...

7.5CVSS0.00471EPSS
SaveExploits1References2
Rows per page
Query Builder