Lucene search
+L

900 matches found

CVE
CVE
•added 2026/09/24 5:07 p.m.•6 views

CVE-2026-95985

Versions of Amazon Kiro IDE prior to 1.0.242 are vulnerable to an issue where the file write tool allows remote unauthenticated actors to inject crafted instructions into the agent's context. By running the agent in a crafted repository designated as an untrusted workspace , an attacker can cause...

8.8CVSS5.8AI score
SaveExploits0References2
EUVD
EUVD
•added 2026/09/24 5:07 p.m.•3 views

EUVD-2026-86308

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to...

8.8CVSS5.8AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
•added 2026/09/23 7:13 p.m.•7 views

Klever-Go: /log controls global node logging

An unauthenticated client can connect to GET /log, send an arbitrary logger profile as the first WebSocket message, and mutate the node's global logging configuration before receiving live logs from the process. I confirmed this against a local validator built from this repository: an...

8.6CVSS6.1AI score0.00397EPSS
SaveExploits0References5Affected Software1
NVD
NVD
•added 2026/09/03 3:17 p.m.•12 views

CVE-2026-56126

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

5.4CVSS0.01052EPSS
SaveExploits0References4
NVD
NVD
•added 2026/09/02 4:17 p.m.•13 views

CVE-2026-84664

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

5.4CVSS0.00136EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/09/02 3:40 p.m.•21 views

EUVD-2026-70130

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

5.4CVSS5.9AI score0.00136EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
•added 2026/09/02 12:00 a.m.•16 views

PT-2026-84787

Jenkins GitLab Plugin 1.9.16 and earlier allows overwriting the global GitLab connection configuration through Stapler data binding, allowing attackers to connect to an attacker-specified URL using GitLab API tokens already configured by administrators...

5.9AI score0.00136EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/08/21 12:33 p.m.•11 views

CVE-2026-59654 Apache CloudStack: DoS caused by database connections leak

Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality. It affects different modules and plugins of the CloudStack management server, including Quota, Host-HA, etc., and may lead to eventual denial of service DoS scenari...

6.8CVSS5.3AI score0.00591EPSS
SaveExploits0References1
EUVD
EUVD
•added 2026/08/09 7:00 a.m.•22 views

EUVD-2026-54910

A security vulnerability has been detected in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/pptpSrvGlobalConfig. Such manipulation of the argument EncryptionMode leads to stack-based buffer overflow. The attack can be executed remotely. The exploit has...

9CVSS8.7AI score0.00598EPSS
SaveExploits0References5
IBM Security Bulletins
IBM Security Bulletins
•added 2026/08/05 6:37 a.m.•15 views

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected affected by a server-side request forgery vulnerability (CVE-2026-11546)

Summary IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability with the adminCenter-1.0 feature enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack, it has been addressed in this bulletin: IBM Engineering Test...

9.8CVSS5.4AI score0.00399EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
•added 2026/08/05 6:37 a.m.•15 views

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty is affected by a denial of service vulnerability (CVE-2026-15057)

Summary IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability due to an out-of-bounds write when servlet-3.1, servlet-4.0, servlet-5.0, servlet-6.0, or servlet-6.1 is enabled. Following IBM Engineering Lifecycle Management products are vulnerable to this attack...

7.5CVSS5.4AI score0.0046EPSS
SaveExploits0Affected Software1
SUSE CVE
SUSE CVE
•added 2026/07/30 4:54 p.m.•10 views

SUSE CVE-2026-40318

SiYuan is an open-source personal knowledge management system. In versions 3.6.3 and prior, the /api/av/removeUnusedAttributeView endpoint constructs a filesystem path using the user-controlled id parameter without validation or path boundary enforcement. An attacker can inject path traversal...

8.5CVSS7.7AI score0.00439EPSS
SaveExploits0References2
PyPA
PyPA
•added 2026/07/13 3:02 p.m.•19 views

wger has Broken Access Control in Global Gym Configuration Update Endpoint

Summarywger exposes a global configuration edit endpoint at /config/gym-config/edit implemented by GymConfigUpdateView. The view declares permissionrequired = 'config.changegymconfig' but does not enforce it because it inherits WgerFormMixin ownership-only checks instead of the project’s...

7.6CVSS6.1AI score0.00397EPSS
SaveExploits1References7Affected Software1
Positive Technologies
Positive Technologies
•added 2026/07/13 12:00 a.m.•19 views

PT-2026-60035

Summary wger exposes a global configuration edit endpoint at /config/gym-config/edit implemented by GymConfigUpdateView. The view declares permission required = 'config.change gymconfig' but does not enforce it because it inherits WgerFormMixin ownership-only checks instead of the project’s...

7.6CVSS6.1AI score0.00397EPSS
SaveExploits1References8
NVD
NVD
•added 2026/07/11 2:16 p.m.•23 views

CVE-2026-61454

The Grav Admin2 plugin getgrav/grav-plugin-admin2 before 2.0.4 embeds a global JavaScript variable window.GRAVCONFIG in the Admin2 SPA bootstrap page at /grav/admin and its subroutes. This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base...

8.7CVSS0.00358EPSS
SaveExploits0References2
attackerkb
attackerkb
•added 2026/07/07 8:34 p.m.•20 views

CVE-2026-58473

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

9.3CVSS6AI score0.00511EPSS
SaveExploits0References5
OSV
OSV
•added 2026/07/07 8:34 p.m.•21 views

CVE-2026-58473 Cognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings

Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all L...

9.3CVSS6AI score
SaveExploits0References7
IBM Security Bulletins
IBM Security Bulletins
•added 2026/06/26 12:10 p.m.•14 views

Security Bulletin: IBM Engineering Lifecycle Management products using WebSphere Application Server Liberty could provide weaker than expected security (CVE-2025-14917)

Summary IBM WebSphere Application Server Liberty could provide weaker than expected security administering security settings when the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0, appSecurity-4.0 or appSecurity-5.0 feature is enabled. Following IBM Engineering Lifecycle Management products a...

9.8CVSS5.8AI score0.00403EPSS
SaveExploits0Affected Software1
OSV
OSV
•added 2026/06/24 2:17 p.m.•16 views

CVE-2026-57285

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration...

4.3CVSS6AI score
SaveExploits0References1
AlpineLinux
AlpineLinux
•added 2026/06/24 1:20 p.m.•28 views

CVE-2026-57285

A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration...

5.8AI score0.00281EPSS
SaveExploits0References1
Rows per page
Query Builder