Lucene search
+L

3326 matches found

Circl
Circl
added 2026/04/09 3:03 p.m.8 views

CVE-2026-33266

creationtimestamp| type| source ---|---|--- 2026-04-09 15:03:13+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mj33cf7s6b2p 2026-04-10 21:23:28+00:00| seen| Telegram/OQKBgo-nZL6sXwBX9bmjZlSNqFSsDAVUFOIG0ZNThQ0ug 2026-04-12 11:59:55+00:00| seen|...

7.5CVSS4.8AI score0.00234EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/04/09 11:00 a.m.13 views

golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip

A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A ...

6.5CVSS6.9AI score0.00643EPSS
SaveExploits1References8
EUVD
EUVD
added 2026/04/08 12:12 a.m.10 views

EUVD-2026-19888

RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests...

8.1CVSS5.9AI score0.0021EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/04/07 3:30 p.m.12 views

EUVD-2026-19607

Weaver Fanwei E-cology 10.0 versions prior to 20260312 contain an unauthenticated remote code execution vulnerability in the /papi/esearch/data/devops/dubboApi/debug/method endpoint that allows attackers to execute arbitrary commands by invoking exposed debug functionality. Attackers can craft PO...

9.8CVSS6.7AI score0.2148EPSS
SaveExploits1References5
Positive Technologies
Positive Technologies
added 2026/04/07 12:00 a.m.14 views

PT-2026-30990

RedwoodSDK is a server-first React framework. From 1.0.0-beta.50 to 1.0.5, erver functions exported from "use server" files could be invoked via GET requests, bypassing their intended HTTP method. In cookie-authenticated applications, this allowed cross-site GET navigations to trigger...

8.1CVSS5.8AI score0.0021EPSS
SaveExploits0References3
OSV
OSV
added 2026/04/06 4:47 p.m.11 views

CVE-2026-35030 LiteLLM has an authentication bypass via OIDC userinfo cache key collision

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.0, when JWT authentication is enabled enablejwtauth: true, the OIDC userinfo cache uses token:20 as the cache key. JWT headers produced by the same signing algorithm generate identical first 20...

9.4CVSS6AI score
SaveExploits0References9
EUVD
EUVD
added 2026/04/06 12:32 p.m.6 views

EUVD-2026-19227

A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component Parameter Handler. This manipulation of the argument firstName causes sql injection. Remote exploitation of the attack is possible. The...

7.5CVSS6.8AI score0.00259EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment
added 2026/04/06 11:00 a.m.5 views

CVE-2026-5648 code-projects Simple Laundry System Parameter userfinishregister.php sql injection

A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component Parameter Handler. This manipulation of the argument firstName causes sql injection. Remote exploitation of the attack is possible. The...

7.5CVSS6.8AI score0.00259EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/04/06 11:00 a.m.4 views

CVE-2026-5648

A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component Parameter Handler. This manipulation of the argument firstName causes sql injection. Remote exploitation of the attack is possible. The...

7.5CVSS6.8AI score0.00259EPSS
SaveExploits0References5Affected Software1
CNNVD
CNNVD
added 2026/04/06 12:00 a.m.14 views

LiteLLM 授权问题漏洞

LiteLLM is an open-source application developed by Berri AI. It allows for the invocation of all LLM APIs in the OpenAI format. Prior to version 1.83.0, LiteLLM had an authorization vulnerability. This vulnerability stemmed from the use of token:20 as a cache key when JWT authentication was...

9.4CVSS5.8AI score0.0049EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/04/05 6:32 a.m.11 views

EUVD-2026-19030

A vulnerability has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modifymember.php of the component Parameter Handler. Such manipulation of the argument firstName leads to sql injection. The attack can be launched remotely. The exploit...

7.5CVSS6.9AI score0.00274EPSS
SaveExploits0References6
NVD
NVD
added 2026/04/05 5:16 a.m.12 views

CVE-2026-5540

A vulnerability has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /modifymember.php of the component Parameter Handler. Such manipulation of the argument firstName leads to sql injection. The attack can be launched remotely. The exploit...

7.5CVSS0.00274EPSS
SaveExploits0References5
NVD
NVD
added 2026/04/05 4:16 a.m.10 views

CVE-2026-5539

A flaw has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /modifymember.php of the component Parameter Handler. This manipulation of the argument firstName causes cross site scripting. The attack can be initiated remotely. The exploit has been...

5.3CVSS0.00284EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/04/05 3:30 a.m.48 views

CVE-2026-5539 code-projects Simple Laundry System Parameter modifymember.php cross site scripting

A flaw has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /modifymember.php of the component Parameter Handler. This manipulation of the argument firstName causes cross site scripting. The attack can be initiated remotely. The exploit has been...

5.3CVSS0.00284EPSS
SaveExploits0References5
Veracode
Veracode
added 2026/04/04 5:31 a.m.15 views

Authentication Bypass

litellm is vulnerable to Authentication Bypass. The vulnerability is due to weak cache key generation using only the first 20 characters of JWT tokens, which allows an attacker to craft a token with a matching prefix and gain unauthorized access by inheriting another user’s identity...

9.4CVSS5.8AI score0.0049EPSS
SaveExploits1References8Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/04/03 8:06 p.m.4 views

CVE-2026-25726

Cloudreve is a self-hosted file management and sharing system. Prior to version 4.13.0, the application uses the weak pseudo-random number generator math/rand seeded with time.Now.UnixNano to generate critical security secrets, including the secretkey, and hashidsalt. These secrets are generated...

8.1CVSS5.8AI score0.00376EPSS
SaveExploits0References3Affected Software1
OSV
OSV
added 2026/04/03 1:27 p.m.8 views

JLSEC-2026-30

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption...

5.9CVSS5.9AI score0.01501EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/04/03 12:00 a.m.16 views

PT-2026-35771

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.3.22 Description An issue exists where bootstrap setup codes are not bound to intended device roles and scopes during pairing. This allows attackers to escalate privileges beyond their intended role and scope...

9.8CVSS5.8AI score0.00328EPSS
SaveExploits0References12
RedhatCVE
RedhatCVE
added 2026/04/02 5:04 a.m.14 views

CVE-2026-29598

Multiple stored cross-site scripting XSS vulnerabilities in the submitadduser.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the First Name and Last Name parameters...

5.4CVSS6AI score0.0016EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/04/02 12:00 a.m.20 views

PT-2026-29967

Name of the Vulnerable Software and Affected Versions @usebruno/cli versions installed between 00:21 UTC and 03:30 UTC on March 31, 2026 Description A supply chain attack involving compromised versions of the axios npm package introduced a hidden dependency deploying a cross-platform Remote Acces...

9.8CVSS6AI score0.00231EPSS
SaveExploits0References9
Rows per page
Query Builder