Lucene search
+L

509809 matches found

NVD
NVD
added 54 minutes ago2 views

CVE-2026-44210

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

6.5CVSS0.00057EPSS
SaveExploits0References2
GithubExploit
GithubExploit
added 1 hour ago6 views

Exploit for Improper Handling of Case Sensitivity in Flowiseai Flowise

Flowise CVE-2026-58057 - Windows Remote Code Execution Exploit...

5CVSS6.9AI score0.00827EPSS
SaveExploits4
OSV
OSV
added 1 hour ago0 views

GO-2026-5989 Unauthenticated OIDC login in nebula-mesh allows unbounded memory allocation in github.com/forgekeep/nebula-mesh

When OIDC is enabled, the login endpoint is reachable without authentication and is registered outside the rate-limited auth routes. Every request creates a fresh random OIDC state value and stores it in an in-memory map. An unauthenticated remote client can grow the state storage, bounded by...

SaveExploits0References3
CVE
CVE
added 1 hour ago45 views

CVE-2026-44210

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

6.5CVSS5.5AI score0.00057EPSS
SaveExploits0References2
Cvelist
Cvelist
added 1 hour ago5 views

CVE-2026-44210 Kata Containers have VM Escape via virtiofsd Argument Injection through Default-Enabled Pod Annotations

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Versions prior to 3.31.0 ship with a default configuration that allows pod creators to inject arbitrary command-line arguments into the virtiofsd proce...

6.5CVSS0.00057EPSS
SaveExploits0References2
OSV
OSV
added 1 hour ago0 views

GO-2026-5675 Unauthenticated admin token disclosure via /debug/vars in github.com/dgraph-io/dgraph

The /debug/vars endpoint in Dgraph Alpha discloses the administrator's authentication token without requiring authentication. This allows an unauthenticated remote attacker to obtain the token and gain full administrative access to the Dgraph cluster...

9.8CVSS0.02187EPSS
SaveExploits1References2
The Hacker News
The Hacker News
added 4 hours ago3 views

ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories

Most of this week's trouble came dressed as something useful. A package stole data. A fake extension opened remote access. A safety app became spyware. An image gave hidden orders to an AI agent. Other threats hid in open systems, weak code, and normal network traffic. The threats change every...

6.7AI score
SaveExploits0
Github Security Blog
Github Security Blog
added 4 hours ago3 views

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

Summary PhpSpreadsheet's OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles or enforcing a maximum chain length. A tiny malformed .xls/OLE file can set the small-block depot sector chain to point back to itself. During normal XLS detection,...

5.4AI score
SaveExploits0References8Affected Software1
Github Security Blog
Github Security Blog
added 4 hours ago2 views

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data large...

5.5AI score
SaveExploits0References8Affected Software1
Microsoft Secure
Microsoft Secure
added 4 hours ago3 views

Email threat landscape: Q2 2026 trends and insights

In this article 1. Tycoon2FA Q2 disruption impact 2. QR code phishing attacks 3. CAPTCHA-gated phishing tactics 4. Malicious payloads 5. Business email compromise 6. Microsoft Teams threats 7. Notable phishing campaigns 8. Mitigation and protection guidance 9. Indicators of compromise IOCs The...

6.3AI score
SaveExploits0
Github Security Blog
Github Security Blog
added 4 hours ago5 views

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

Summary Auth.js stores the OAuth/OIDC anti-CSRF checks state, nonce, and the PKCE verifier in global cookies that are not bound to the provider that created them. On callback, a check value minted during a sign-in started with one provider can satisfy the callback for a different provider, becaus...

5.2AI score
SaveExploits0References8Affected Software2
GithubExploit
GithubExploit
added 4 hours ago11 views

2026-07-tare-nightbox33-cloud

Tare contest details - Join Sherlock Discordhttps://discor...

5.7AI score
SaveExploits0
NVD
NVD
added 4 hours ago4 views

CVE-2026-16733

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local executio...

5.3CVSS
SaveExploits0References6
NVD
NVD
added 4 hours ago4 views

CVE-2026-16735

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

5.3CVSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 5 hours ago3 views

CVE-2026-16735

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

5.3CVSS5.3AI score
SaveExploits0References6Affected Software1
CVE
CVE
added 5 hours ago4 views

CVE-2026-16735

The CVE concerns release-it conventional-changelog up to 11.0.1, where the writeChangelog function in index.js of the Changelog File Handler is vulnerable. Manipulation of the infile argument enables local OS command injection, with the exploit publicly disclosed. The attack is local and requires...

5.3CVSS5.3AI score
SaveExploits0References6
EUVD
EUVD
added 5 hours ago3 views

EUVD-2026-48283

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

5.3CVSS5.3AI score
SaveExploits0References6
Cvelist
Cvelist
added 5 hours ago9 views

CVE-2026-16735 release-it conventional-changelog Changelog File index.js writeChangelog os command injection

A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of the component Changelog File Handler. Such manipulation of the argument infile leads to os command injection. The attack must be carried o...

5.3CVSS
SaveExploits0References6
Vulnrichment
Vulnrichment
added 5 hours ago2 views

CVE-2026-16733 bahmutov find-cypress-specs Branch index.js shell.exec os command injection

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local executio...

5.3CVSS5.5AI score
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 5 hours ago2 views

CVE-2026-16733

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local executio...

5.3CVSS5.5AI score
SaveExploits0References6Affected Software1
Rows per page
Query Builder