Lucene search
+L

5563555 matches found

Packet Storm News
Packet Storm News
added 2026/09/10 12:0 a.m.245 views

IServ Schoolserver User Enumeration

IServ Schoolserver suffers from a user enumeration vulnerability. The vendor does not feel this is an issue...

5.8AI score
SaveExploits0
EUVD
EUVD
added 36 minutes ago1 views

EUVD-2026-63246

A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol LDAP extended operation. By omitting the request value for the JOINOID in the ipa-enrollment extende...

6.5CVSS
SaveExploits0References2
Cvelist
Cvelist
added 36 minutes ago1 views

CVE-2026-73199 Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol LDAP extended operation. By omitting the request value for the JOINOID in the ipa-enrollment extende...

6.5CVSS
SaveExploits0References2
EUVD
EUVD
added 36 minutes ago1 views

EUVD-2026-63245

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

9.6CVSS
SaveExploits0References2
Cvelist
Cvelist
added 36 minutes ago1 views

CVE-2026-11861 Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket...

9.6CVSS
SaveExploits0References2
Cvelist
Cvelist
added 36 minutes ago1 views

CVE-2026-73198 Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial o...

7.5CVSS
SaveExploits0References2
EUVD
EUVD
added 36 minutes ago1 views

EUVD-2026-63244

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18nmessages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial o...

7.5CVSS
SaveExploits0References2
EUVD
EUVD
added 37 minutes ago0 views

EUVD-2026-63243

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...

9.1CVSS
SaveExploits0References2
EUVD
EUVD
added 39 minutes ago1 views

EUVD-2026-63242

Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 5.2.5 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions...

6.9CVSS
SaveExploits0References1
Patchstack
Patchstack
added 40 minutes ago1 views

WordPress SEO Redirection Plugin - 301 Redirect Manager plugin < 9.19 - Subscriber+ Redirect Rule Disclosure vulnerability

WordPress SEO Redirection Plugin - 301 Redirect Manager plugin 9.19 - Subscriber+ Redirect Rule Disclosure vulnerability discovered by J4ck13Ch4n in WordPress Plugin SEO Redirection versions 9.19...

5.4CVSS5.2AI score0.00138EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 42 minutes ago2 views

WordPress Payment Plugins for PayPal WooCommerce plugin < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order vulnerability

Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order vulnerability discovered by Shivamani Vastrala in WordPress Plugin Payment Plugins for PayPal WooCommerce versions 2.0.20...

7.5CVSS5.2AI score0.00283EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 43 minutes ago1 views

WordPress Security Optimizer - The All-In-One Protection Plugin plugin < 1.6.5 - Login Access IP Allowlist Bypass via post_password vulnerability

WordPress Security Optimizer - The All-In-One Protection Plugin plugin 1.6.5 - Login Access IP Allowlist Bypass via postpassword vulnerability discovered by Shivamani Vastrala in WordPress Plugin SiteGround Security versions 1.6.5...

5.3CVSS5.2AI score0.00253EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 43 minutes ago1 views

CVE-2026-73196 Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...

4.3CVSS
SaveExploits0References2
EUVD
EUVD
added 43 minutes ago1 views

EUVD-2026-63241

A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...

4.3CVSS
SaveExploits0References2
Cvelist
Cvelist
added 44 minutes ago1 views

CVE-2026-73197 Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

7.5CVSS
SaveExploits0References2
EUVD
EUVD
added 44 minutes ago1 views

EUVD-2026-63240

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increas...

7.5CVSS
SaveExploits0References2
Patchstack
Patchstack
added 44 minutes ago2 views

WordPress WC Buckaroo BPE Gateway plugin < 4.9.0 - Subscriber+ Unauthorized Order Refund vulnerability

Subscriber+ Unauthorized Order Refund vulnerability discovered by Vaibhav Narkhede in WordPress Plugin Buckaroo Woocommerce Payments Plugin versions 4.9.0...

6.5CVSS5.2AI score0.00174EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 45 minutes ago2 views

WordPress Essential Blocks plugin < 6.4.0 - Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint vulnerability

Unauthenticated Non-Public Custom Post Type Content Disclosure via queries Endpoint vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Essential Blocks for Gutenberg versions 6.4.0...

7.5CVSS5.2AI score0.00256EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 45 minutes ago2 views

WordPress Essential Blocks plugin < 6.4.0 - Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint vulnerability

Unauthenticated WooCommerce Sales Data Disclosure via REST products Endpoint vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin Essential Blocks for Gutenberg versions 6.4.0...

7.5CVSS5.2AI score0.00256EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
added 46 minutes ago1 views

WordPress LearnPress plugin < 4.4.4 - Instructor+ Server-Side Request Forgery via openai_apply_image_feature vulnerability

Instructor+ Server-Side Request Forgery via openaiapplyimagefeature vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin LearnPress versions 4.4.4...

2.2CVSS5.2AI score0.00189EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder