Lucene search
+L

599127 matches found

Nuclei
Nuclei
added 2026/09/16 2:04 p.m.75 views

SolarView Compact 6.00 - Local File Inclusion

SolarView Compact 6.00 is vulnerable to local file inclusion which could allow attackers to access sensitive files. id: CVE-2022-29298 info: name: SolarView Compact 6.00 - Local File Inclusion author: ritikchaddha severity: high description: SolarView Compact 6.00 is vulnerable to local file...

7.5CVSS7.5AI score0.46803EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.69 views

Show all comments < 7.0.1 - Cross-Site Scripting

The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin. id: CVE-2022-4295 info: name: Show all commen...

6.1CVSS6.3AI score0.00897EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.86 views

WordPress Realteo <=1.2.3 - Cross-Site Scripting

WordPress Realteo plugin 1.2.3 and prior contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of keywordsearch, searchradius. bedrooms and bathrooms GET parameters before outputting them in its properties page. id: CVE-2021-24237 info: name:...

6.1CVSS6.2AI score0.06275EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.162 views

MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion

MERCUSYS Mercury X18G 1.0.5 devices are vulnerable to local file inclusion via ../ in conjunction with a loginLess or login.htm URI for authentication bypass to the web server, as demonstrated by the /loginLess/../../etc/passwd URI. id: CVE-2021-23241 info: name: MERCUSYS Mercury X18G 1.0.5 Route...

5.3CVSS6.9AI score0.13329EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.102 views

MKdocs 1.2.2 - Directory Traversal

The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability see references because the dev server must be used in an unsafe way namely public to have this...

7.5CVSS7.5AI score0.15103EPSS
SaveExploits2
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.77 views

PlaceOS 1.2109.1 - Open Redirection

PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessionscontroller.rb open redirect. id: CVE-2021-41826 info: name: PlaceOS 1.2109.1 - Open Redirection author: geeknik severity: medium description: PlaceOS Authentication Service before 1.29.10.0 allows...

6.1CVSS6.3AI score0.12056EPSS
SaveExploits3References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.63 views

WordPress Fancy Product Designer <4.6.9 - Arbitrary File Upload

WordPress Fancy Product Designer plugin before 4.6.9 is susceptible to an arbitrary file upload. An attacker can upload malicious files and execute code on the server, modify data, and/or gain full control over a compromised system without authentication. id: CVE-2021-24370 info: name: WordPress...

9.8CVSS8.4AI score0.47371EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.126 views

CHIYU TCP/IP Converter - Carriage Return Line Feed Injection

CHIYU TCP/IP Converter BF-430, BF-431, and BF-450 are susceptible to carriage return line feed injection. The redirect= parameter, available on multiple CGI components, is not properly validated, thus enabling an attacker to obtain sensitive information, modify data, and/or execute unauthorized...

6.5CVSS6.8AI score0.18003EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.78 views

Advantech R-SeeNet - Cross-Site Scripting

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the graph parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. id: CVE-2021-21801 info: name: Advantech R-SeeNet - Cross-Site Scripting author: gy74...

9.6CVSS8AI score0.63415EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.81 views

Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting

Redwood Report2Web 4.3.4.5 and 4.5.3 contains a cross-site scripting vulnerability in the login panel which allows remote attackers to inject JavaScript via the signIn.do urll parameter. id: CVE-2021-26710 info: name: Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting author: pikpikcu...

6.1CVSS6.2AI score0.075EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.23 views

GitLab CE/EE <=19.1.7/19.2.5/19.3.1 - Arbitrary File Read

GitLab CE/EE contains an unauthenticated arbitrary file read. Workhorse, the reverse proxy in front of Rails, matches upload routes using EscapedPath and path.Clean without decoding percent sequences, while Puma decodes them before routing to Grape. Appending a trailing slash to commits or...

10CVSS8.2AI score0.11957EPSS
SaveExploits10References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.83 views

Oracle Weblogic Server - Remote Command Execution

Oracle WebLogic Server contains an easily exploitable remote command execution vulnerability which allows unauthenticated attackers with network access via HTTP to compromise the server. id: CVE-2020-14882 info: name: Oracle Weblogic Server - Remote Command Execution author: dwisiswant0 severity:...

10CVSS8.5AI score0.99997EPSS
SaveExploits42References6
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.16 views

N-able N-central < 2026.3.1.10 - Authentication Bypass

N-able N-central versions through 2026.3.1 contain an authentication bypass that lets a remote unauthenticated attacker take over an administrator account and gain full control of the N-central server. CVE-2026-18577 is a bypass of the incomplete fix for CVE-2026-18556, so the 2026.3.1 Hotfix 1...

8.2CVSS6.2AI score0.54068EPSS
SaveExploits2References6
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.222 views

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

9.1CVSS8.1AI score0.03177EPSS
SaveExploits13References5
Nuclei
Nuclei
added 2026/09/16 2:04 p.m.65 views

Ligeo Archives Ligeo Basics - Server Side Request Forgery

Ligeo Archives Ligeo Basics as of 0201-2022 is vulnerable to Server Side Request Forgery SSRF which allows an attacker to read any documents via the download features. id: CVE-2021-46107 info: name: Ligeo Archives Ligeo Basics - Server Side Request Forgery author: ritikchaddha severity: high...

7.5CVSS7.2AI score0.06573EPSS
SaveExploits1References5
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/16 2:04 p.m.2 views

Security Bulletin: Manage Component uses protobufjs-8.0.1.tgz and utf8-1.1.0.tgz in map-component app which is vulnerable to CVE-2026-44288, CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44293 and CVE-2026-44294

Summary Manage Component uses protobufjs-8.0.1.tgz and utf8-1.1.0.tgz in map-component app which is vulnerable to CVE-2026-44288, CVE-2026-44289, CVE-2026-44290, CVE-2026-44291, CVE-2026-44292, CVE-2026-44293 and CVE-2026-44294. This security bulletin provides details about the vulnerability and...

8.8CVSS0.0063EPSS
SaveExploits0Affected Software1
Kitploit
Kitploit
added 2026/09/16 2:02 p.m.13 views

pentest-ai

pentest-ai It doesn't flag. It proves. Website · Install · Why verification · Benchmarks · Limits · Discord ⚠️ Offensive tooling, authorized testing only. By installing you accept the AUP and Terms. See Responsible use ↓ Two minutes, no API key, no target of your own root@kitploit: pip install pta...

6AI score
SaveExploits0References12
Kitploit
Kitploit
added 2026/09/16 2:01 p.m.13 views

mcp-shark

mcp-shark AI 代理工具安全扫描器 — 专为在 IDE 中处理 MCP 的安全与平台工程师构建。 对 MCP IDE 配置 以及嵌入的工具元数据运行本地静态 scan:41 条规则 (包括 AAuth 可见性 )、毒流启发式分析,以及 SARIF / HTML / JSON 报告。无托管配置扫描后端。 可选添加一个本地 HTTP 代理 ,并附带浏览器内仪表盘 ,使实时流量、发现结果、AAuth 信号和沙盒检查集中在一处,而无需将配置发送给供应商。 你可以 使用流量 进行实时 JSON-RPC 捕获、过滤、导出,以及 AAuth 状态标签 运行本地分析 ,对捕获的流量执行 OWA...

5.8AI score
SaveExploits0References3
CVE
CVE
added 2026/09/16 2:00 p.m.7 views

CVE-2026-92365

A Denial of Service (DoS) vulnerability exists in vllm-project vllm (up to version 0.29.0). A remote attacker with low privileges can exploit an inefficient algorithmic complexity in the file vllm/v1/sample/thinking_budget_state.py, degrading service availability for legitimate users. The specifi...

5.3CVSS5.1AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/16 2:00 p.m.17 views

CVE-2026-92365 vllm-project vllm thinking_budget_state.py algorithmic complexity

A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample/thinkingbudgetstate.py. The manipulation results in inefficient algorithmic complexity. It is possible to launch the attack remotely. The pull request to fi...

5.3CVSS
SaveExploits0References6
Rows per page
Query Builder