Lucene search
+L

20256 matches found

NVD
NVD
added 2026/08/06 10:18 p.m.15 views

CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

6.5CVSS0.00434EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/06 10:18 p.m.10 views

UBUNTU-CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

6.5CVSS5.4AI score0.00434EPSS
SaveExploits0References6
CVE
CVE
added 2026/08/06 7:51 p.m.94 views

CVE-2026-71437

Mermaid.js architecture diagrams are affected by prototype pollution in versions 11.5.0–11.16.1. A diagram-defined group with id proto uses the id as an object property key, allowing pollution of Object.prototype and potentially affecting embedding applications. The issue is fixed in Mermaid v11....

6.5CVSS5.5AI score0.00434EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/08/06 7:51 p.m.13 views

CVE-2026-71437 Mermaid Architecture diagrams are vulnerable to prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

6.5CVSS5.3AI score0.00434EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/06 7:51 p.m.13 views

CVE-2026-71437

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

6.5CVSS5.5AI score0.00434EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/08/06 7:51 p.m.16 views

CVE-2026-71437 Mermaid Architecture diagrams are vulnerable to prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

6.5CVSS5.4AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/06 7:51 p.m.34 views

CVE-2026-71437 Mermaid Architecture diagrams are vulnerable to prototype pollution

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

6.5CVSS0.00434EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/06 7:51 p.m.15 views

EUVD-2026-54242

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.5.0 until 11.16.1, Mermaid Architecture Diagrams are vulnerable to prototype pollution when a diagram defines a group with an id of proto. Because the group id is used directly ...

6.5CVSS5.5AI score0.00434EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/06 7:16 a.m.15 views

CVE-2026-16290

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or...

5.3CVSS0.0021EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/06 6:00 a.m.13 views

EUVD-2026-53724

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or...

5.3CVSS5.5AI score0.0021EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/06 6:00 a.m.40 views

CVE-2026-16290 ProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group

The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for unauthenticated users, allowing any unauthenticated visitor to disclose the members and their identifiers of any group, including private or...

0.0021EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/06 6:00 a.m.63 views

CVE-2026-16290

ProfileGrid WordPress plugin prior to version 6.0.0.0 exposes a group member list without proper authorization checks. The vulnerability allows any unauthenticated visitor to disclose members and their identifiers for any group, including private/closed ones, by registering the handler for unauth...

5.3CVSS5.5AI score0.0021EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/08/06 12:00 a.m.13 views

FreeBSD : MySQL 8.4 -- Multiple vulnerabilities (10f5d195-90a5-11f1-bc30-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 10f5d195-90a5-11f1-bc30-3497f65b111b advisory. The Oracle Critical Patch Update of July 2026 addresses 54 issues in Oracle MySQL, 31 of which...

8.4CVSS5.7AI score0.00466EPSS
SaveExploits0References34
Tenable Nessus
Tenable Nessus
added 2026/08/06 12:00 a.m.11 views

FreeBSD : MySQL 9.7 -- Multiple vulnerabilities (10f5f76e-90a5-11f1-bc30-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 10f5f76e-90a5-11f1-bc30-3497f65b111b advisory. The Oracle Critical Patch Update of July 2026 addresses 54 issues in Oracle MySQL, 43 of which...

8.4CVSS5.8AI score0.00466EPSS
SaveExploits0References46
Tenable Nessus
Tenable Nessus
added 2026/08/06 12:00 a.m.15 views

EulerOS 2.0 SP13 : sudo (EulerOS-SA-2026-3002)

According to the versions of the sudo packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not...

7.8CVSS5.6AI score0.00173EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/05 8:17 p.m.11 views

CVE-2026-70617

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can exploit the...

8.6CVSS0.00231EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/05 8:17 p.m.21 views

CVE-2026-68746

Not Failing Securely 'Failing Open' vulnerability in livebook-dev livebook allows an unauthenticated network client to obtain full access to a Livebook server that enforces identity through Livebook Teams. A Livebook Agent or App Server connected to Livebook Teams caches the identifier of the...

8.8CVSS0.00447EPSS
SaveExploits0References6
NVD
NVD
added 2026/08/05 8:17 p.m.10 views

CVE-2026-66297

Improper Neutralization of Special Elements used in an OS Command OS Command Injection vulnerability in livebook-dev livebook allows command injection into generated deployment setup commands. LivebookWeb.Hub.Teams.DeploymentGroupAgentComponent.dockerinstructions/2 and...

8CVSS0.01876EPSS
SaveExploits1References6
OSV
OSV
added 2026/08/05 8:03 p.m.13 views

GHSA-945V-V9P3-V5XW rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

Summary When writing an object with metadata, the local backend applies the source-supplied mode, uid, and gid verbatim: it parses mode as an octal integer and passes it straight into os.Chmodo.path, os.FileModeumode, and passes uid/gid straight into os.Chown. The value is never masked to...

3.6CVSS5.5AI score0.0014EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/05 8:03 p.m.16 views

rclone local `--metadata` applies attacker-controlled mode/uid - setuid binary planted from an untrusted remote

Summary When writing an object with metadata, the local backend applies the source-supplied mode, uid, and gid verbatim: it parses mode as an octal integer and passes it straight into os.Chmodo.path, os.FileModeumode, and passes uid/gid straight into os.Chown. The value is never masked to...

5.5AI score
SaveExploits0References4Affected Software1
Rows per page
Query Builder