Lucene search
+L

61289 matches found

NVD
NVD
added 2026/07/08 3:16 p.m.12 views

CVE-2026-24700

An OS command injection vulnerability exists in the startlltd function of the "rc" binary in Cisco RV130/RV130W with firmware 1.0.3.55 and RV110W routers with firmware 1.2.2.5 / 1.2.2.8. The machinename configuration parameter is not properly sanitized, which could allow an authenticated remote...

7.2CVSS0.01522EPSS
SaveExploits1References1
NVD
NVD
added 2026/07/08 2:17 p.m.16 views

CVE-2026-58480

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

9.8CVSS0.00605EPSS
SaveExploits4References4
ATTACKERKB
ATTACKERKB
added 2026/07/08 1:48 p.m.10 views

CVE-2026-56226

Capgo Cap-go/capgo before 12.128.2 exposes the Supabase PostgREST RPC function public.getorgsv6userid uuid, which is SECURITY DEFINER and granted to the anon role, allowing unauthenticated access. Because the function accepts a caller-supplied user UUID without verifying it matches the...

8.7CVSS6AI score0.00255EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/08 1:36 p.m.8 views

CVE-2026-60125

MISP’s importModule path used getEnabledModule to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules. As a result, an authenticated user from an organisation that was not allowed to use a module restricted v...

5.3CVSS5.9AI score0.00207EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/07/08 1:5 p.m.12 views

EUVD-2026-42233

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

9.8CVSS6.4AI score0.00605EPSS
SaveExploits4References4
ATTACKERKB
ATTACKERKB
added 2026/07/08 1:5 p.m.11 views

CVE-2026-58480

Blocksy Companion Pro plugin for WordPress before 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the saveattachments function exposed through the Advanced Reviews feature. Attackers can...

9.8CVSS6.4AI score0.00605EPSS
SaveExploits4References5
ATTACKERKB
ATTACKERKB
added 2026/07/08 12:33 p.m.7 views

CVE-2026-5459

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the paymentpage function due to missing validation on the 'userid' user...

5.3CVSS5.9AI score0.00183EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/08 12:33 p.m.13 views

EUVD-2026-42229

The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.1 via the paymentpage function due to missing validation on the 'userid' user...

5.3CVSS5.9AI score0.00183EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/08 9:16 a.m.14 views

CVE-2026-57255

The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that accesses an out-of-bounds region, crashing the application...

6.1CVSS0.00109EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/08 7:36 a.m.29 views

CVE-2026-57255

CVE-2026-57255 affects Foxit PDF Editor/Reader. A PDF with an abnormal color space contains attributes referencing a semantically malformed function; the function’s output isn’t validated, leading to an illegal pointer read that accesses an out-of-bounds region and crashes the application. The de...

6.1CVSS6AI score0.00109EPSS
SaveExploits0References1Affected Software2
EUVD
EUVD
added 2026/07/08 7:36 a.m.14 views

EUVD-2026-42198

The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that accesses an out-of-bounds region, crashing the application...

6.1CVSS6AI score0.00109EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/08 7:36 a.m.14 views

CVE-2026-57255

The application opens a PDF containing an abnormal color space whose attributes reference a valid but semantically malformed function. The function's output is not validated; when subsequently read, it produces an illegal pointer that accesses an out-of-bounds region, crashing the application...

6.1CVSS6AI score0.00109EPSS
SaveExploits0References2Affected Software2
NVD
NVD
added 2026/07/08 6:16 a.m.17 views

CVE-2026-14489

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on...

8.8CVSS0.00545EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/07/08 5:34 a.m.15 views

EUVD-2026-42174

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on...

8.8CVSS6.7AI score0.00545EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/08 5:34 a.m.40 views

CVE-2026-14489 WHMCS Bridge <= 6.9 - Unauthenticated Arbitrary File Upload via 'ccce' Parameter

The WHMCS Bridge plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the connect function in all versions up to, and including, 6.9. This makes it possible for authenticated attackers, with Custom-level access and above, to upload arbitrary files on...

8.8CVSS0.00545EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/07/08 12:37 a.m.16 views

EUVD-2026-42127

String::Util versions before 1.36 for Perl are susceptible to a regular expression denial of service. The trim and rtrim functions stripped trailing whitespace with s/\s$//u. Because \s matches greedily and the $ anchor fails whenever a non-whitespace character follows the whitespace, the regex...

6AI score0.00387EPSS
SaveExploits0References4
Redos
Redos
added 2026/07/08 12:0 a.m.13 views

ROS-20260708-73-0015

The vulnerability of the loexport, loread, lolseek64, and lotell64 functions in the PostgreSQL database management system’s client library is related to the use of a initially dangerous function. Exploiting this vulnerability could allow an attacker to remotely rewrite the pgdump or psql stack...

8.8CVSS7.2AI score0.00454EPSS
SaveExploits0
BDU FSTEC
BDU FSTEC
added 2026/07/08 12:0 a.m.10 views

The vulnerability of the ep_free() function in the eventpoll.c component of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the epfree function in the eventpoll.c component of the Linux kernel relates to the dereferencing of a pointer whose expiration time has passed. Exploiting this vulnerability could allow an attacker to trigger a service failure...

7.8CVSS7.1AI score0.00482EPSS
SaveExploits3References16Affected Software6
BDU FSTEC
BDU FSTEC
added 2026/07/08 12:0 a.m.7 views

The vulnerability of the __qla2x00_abort_all_cmds() function in the drivers/scsi/qla2xxx/qla_os.c driver of the SCSI device drivers for the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the qla2x00abortallcmds function in the drivers/scsi/qla2xxx/qlaos.c driver for Linux SCSI devices is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

5.5CVSS6.3AI score0.00262EPSS
SaveExploits0References12Affected Software4
BDU FSTEC
BDU FSTEC
added 2026/07/08 12:0 a.m.11 views

The vulnerability of the Merge() function in the Gogs automated Git repository creation tool allows a hacker to execute arbitrary code.

The vulnerability of the Merge function in the Gogs automated Git repository creation tool is related to the lack of measures taken at the control level to clean up data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

9.9CVSS6.2AI score0.01464EPSS
SaveExploits2References4Affected Software1
Rows per page
Query Builder