Lucene search
+L

394 matches found

Vulnrichment
Vulnrichment
added 2026/08/20 4:33 p.m.7 views

CVE-2026-40345 deepmerge-ts: Stack exhaustion when merging recursive object graphs

deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. Prior to 8.0.0, the deepmerge, deepmergeCustom, deepmergeInto, and deepmergeIntoCustom APIs do not track visited objects or object pairs when recursively merging records. When two input values...

8.2CVSS5.3AI score0.00467EPSS
SaveExploits1References4
CVE
CVE
added 2026/08/19 7:18 p.m.32 views

CVE-2026-67189

pfSense Plus before 26.07 and CE through 2.8.1 render PTR records as unsanitized HTML in Traffic Graphs AJAX responses. An attacker controlling a PTR record who appears as a top talker can execute arbitrary JavaScript in an admin's browser, enabling session hijacking and OS command execution. Fix...

6.1CVSS5.4AI score0.0053EPSS
SaveExploits0References4
Fedora
Fedora
added 2026/08/05 12:58 a.m.14 views

[SECURITY] Fedora 44 Update: polymake-4.15-11.fc44

Polymake is a tool to study the combinatorics and the geometry of convex polytopes and polyhedra. It is also capable of dealing with simplicial complexes, matroids, polyhedral fans, graphs, tropical objects, and so forth. Polymake can use various computational packages if they are installed. Thos...

9.8CVSS7.6AI score0.00443EPSS
SaveExploits1
CVE
CVE
added 2026/07/13 1:12 p.m.37 views

CVE-2026-61498

CVE-2026-61498 affects Vitec Flamingo 4.12.2. The vulnerability is an unauthenticated OS command injection in the admin/ajax/gen_graphs.php endpoint, where input values from GET parameters (start, end, key, format) are unsafely passed to shell commands via passthru(), enabling remote command exec...

9.8CVSS6.3AI score0.04089EPSS
SaveExploits2References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/13 1:12 p.m.13 views

CVE-2026-61498

Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gengraphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attacke...

9.8CVSS6.3AI score0.04089EPSS
SaveExploits2References4Affected Software1
Positive Technologies
Positive Technologies
added 2026/07/13 12:00 a.m.17 views

PT-2026-57817

Name of the Vulnerable Software and Affected Versions Vitec Flamingo version 4.12.2 Description An unauthenticated OS command injection exists in the 'admin/ajax/gen graphs.php' endpoint. Remote attackers can execute arbitrary commands with root privileges by providing shell metacharacters throug...

9.8CVSS6.3AI score0.04089EPSS
SaveExploits2References10
NVD
NVD
added 2026/06/25 11:17 p.m.16 views

CVE-2026-40083

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selecteditems by calling...

7.2CVSS0.00502EPSS
SaveExploits1References2
UbuntuCve
UbuntuCve
added 2026/06/25 11:17 p.m.12 views

CVE-2026-40083

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selecteditems by calling...

7.2CVSS7AI score0.00502EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2026/06/25 10:39 p.m.12 views

CVE-2026-40083

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selecteditems by calling...

7.2CVSS6AI score0.00502EPSS
SaveExploits1References3Affected Software1
Cvelist
Cvelist
added 2026/06/25 10:39 p.m.55 views

CVE-2026-40083 Cacti: SQL Injection in managers.php

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selecteditems by calling...

7.2CVSS0.00502EPSS
SaveExploits1References2
Debian CVE
Debian CVE
added 2026/06/25 10:39 p.m.29 views

CVE-2026-40083

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have SQL Injection through unsanitized unserialize+implode in managers.php. At line 756 of managers.php, the application assigns $selecteditems by calling...

7.2CVSS5.9AI score0.00502EPSS
SaveExploits1
OSV
OSV
added 2026/06/24 7:40 p.m.28 views

CVE-2026-46349 Mastodon: LD-Signature Bypass via JSON-LD Named-Graph Restructuring

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.5.10, 4.4.17, and 4.3.23, Mastodon's normalization of incoming activities signed with Linked-Data Signatures does not sufficiently protect the activities from a certain class of spoofing, allowing attackers to...

5.3CVSS6AI score
SaveExploits0References3
Packet Storm News
Packet Storm News
added 2026/06/05 12:00 a.m.32 views

MOLOT System Card: Malicious Operational Logic Observation Transformer

MOLOT Malicious Operational Logic Observation Transformer is a static malicious-code detection system designed for SAST setup where package metadata, maintainer history, and dynamic execution traces may be unavailable or unreliable. The system represents source code as behavior sequences derived...

5.8AI score
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/01 12:00 a.m.22 views

PT-2026-45365

Name of the Vulnerable Software and Affected Versions apache-airflow versions prior to 3.2.2 Description The 'structure data' endpoint in the Airflow UI fails to verify if the caller has read permissions for linked DAGs Directed Acyclic Graphs, which are collections of all the tasks you want to...

3.1CVSS5.5AI score0.00477EPSS
SaveExploits0References14
Positive Technologies
Positive Technologies
added 2026/06/01 12:00 a.m.17 views

PT-2026-45977

Apache Airflow's scheduler-side deadline-reference decoder SerializedCustomReference.deserialize reference imported and dispatched arbitrary class paths drawn from DAG-author-controlled serialized state without an allowlist or plugin-registry gate. A DAG author whose code reaches the scheduler —...

7.3CVSS6AI score
SaveExploits0References4
Fedora
Fedora
added 2026/05/28 12:48 a.m.24 views

[SECURITY] Fedora 43 Update: rrdtool-1.9.0-8.fc43

RRD is the Acronym for Round Robin Database. RRD is a system to store and display time-series data i.e. network bandwidth, machine-room temperature, server load average. It stores the data in a very compact way that will not expand over time, and it presents useful graphs by processing the data t...

5.8AI score
SaveExploits0
SUSE CVE
SUSE CVE
added 2026/05/27 4:12 a.m.13 views

SUSE CVE-2023-51448

Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection SQLi vulnerability within the SNMP Notification Receivers feature in the file 'managers.php'. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTT...

8.8CVSS7.4AI score0.67338EPSS
SaveExploits1References4
Packet Storm News
Packet Storm News
added 2026/05/27 12:00 a.m.20 views

HunterAgent: Neuro-Symbolic Attack Trace Reconstruction under Anti-Forensics

Modern alert-triage systems reduce SOC burden by filtering false positives, but flagging a high-risk alert is only the start of incident response. Threat hunting requires reconstructing causal attack chains across heterogeneous, partially corrupted logs. Against APTs using anti-forensics parent-P...

5.8AI score
SaveExploits0
CNNVD
CNNVD
added 2026/05/12 12:00 a.m.19 views

Heym 安全漏洞

Heym is an open-source AI-native workflow automation platform developed by heymrun. Versions of Heym prior to 0.0.21 contained security vulnerabilities. These vulnerabilities stemmed from sandbox escape vulnerabilities in custom Python tool executors, which could allow authenticated workflow...

8.8CVSS5.8AI score0.00227EPSS
SaveExploits0References1
Packet Storm News
Packet Storm News
added 2026/05/12 12:00 a.m.34 views

Do Skill Descriptions Tell the Truth? Detecting Undisclosed Security Behaviors in Code-Backed LLM Skills

Programmatic skills in LLM ecosystems consist of a natural-language description and executable implementation files. Users and LLMs rely on the description to understand the skill's scope. However, the implementation may perform security-relevant operations, such as credential access, network...

5.9AI score
SaveExploits0
Rows per page
Query Builder