Lucene search
+L

43472 matches found

EUVD
EUVD
added 2026/07/17 12:6 a.m.8 views

EUVD-2026-45092

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

8.8CVSS6.2AI score0.00289EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/17 12:6 a.m.8 views

CVE-2026-62203

OpenClaw vulnerable before version 2026.6.6 due to an environment variable filtering issue in host exec that fails to sanitize rustup startup variables. Affected product: OpenClaw. Root cause: improper sanitization of environment variables during rustup startup. Impact: attackers with lower-trust...

8.8CVSS6.2AI score0.00289EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 2026/07/17 12:6 a.m.37 views

CVE-2026-62203 OpenClaw < 2026.6.6 Environment Variable Injection via rustup

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

8.8CVSS0.00289EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/17 12:6 a.m.5 views

CVE-2026-62203 OpenClaw < 2026.6.6 Environment Variable Injection via rustup

OpenClaw versions before 2026.6.6 contain an environment variable filtering vulnerability in host exec that fails to properly sanitize rustup startup variables. Attackers with lower-trust caller access or configured input paths can execute or persist actions beyond their intended authorization...

7.7CVSS5.4AI score0.00289EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 2026/07/17 12:0 a.m.7 views

RabbitMQ 3.7.x < 4.0.13 / 4.1.x < 4.1.2 XSS via Virtual Host Names

The version of RabbitMQ installed on the remote host is affected by a cross-site scripting vulnerability: - Unsanitized virtual host names allow for XSS in the management UI pages that list virtual hosts if the attacker manages to find a way to force a virtual host to restart. CVE-2026-44839 Note...

5.6CVSS5AI score0.0018EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/07/17 12:0 a.m.4 views

SUSE SLES16 Security Update : go1.25 (SUSE-SU-2026:22643-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22643-1 advisory. This update for go1.25 fixes the following issues - Update to version go1.25.12 bsc1244485. - CVE-2026-25679: net/url: reject IPv6...

7.8CVSS8.3AI score0.00728EPSS
SaveExploits0References19
Tenable Nessus
Tenable Nessus
added 2026/07/17 12:0 a.m.6 views

Rockwell Studio 5000 Logix Designer Unquoted Search Path (SD1783)

The version of Rockwell Studio 5000 Logix Designer installed on the remote Windows host is affected by a code execution vulnerability. An unquoted search path in the External Tools configuration means that executable paths containing spaces are not properly quoted, so the operating system may...

7.3CVSS7.8AI score0.00096EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/07/17 12:0 a.m.6 views

Rockwell Studio 5000 Logix Designer Incorrect Authorization RCE (SD1783)

The version of Rockwell Studio 5000 Logix Designer installed on the remote Windows host is affected by a remote code execution vulnerability. Due to incorrect authorization on a configuration file, any authenticated user can modify the paths of external tools configured within the application. An...

7.3CVSS6.4AI score0.0011EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/16 8:16 p.m.9 views

CVE-2026-54728

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a...

6.1CVSS0.00237EPSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/07/16 8:14 p.m.16 views

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Summary In affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...

8.1CVSS6AI score0.00149EPSS
SaveExploits0References6Affected Software1
OSV
OSV
added 2026/07/16 8:14 p.m.5 views

GHSA-VJ7Q-GJH5-988W MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Summary In affected versions, the deprecated WebSocket server transport mcp.server.websocket.websocketserver accepted the WebSocket handshake without applying any Host or Origin header validation. The TransportSecuritySettings mechanism that the SSE and Streamable HTTP transports use for this...

7.6CVSS6AI score0.00149EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/16 7:18 p.m.9 views

CVE-2026-54728

CVE-2026-54728 affects bunkerweb: prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated handling of Host header input in the UI/API allowed a low-privileged authenticated user to escalate privileges and impact confidentiality, integrity, and availability of the BunkerWeb instance. The i...

6.1CVSS6.1AI score0.00237EPSS
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:43 p.m.16 views

Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a9c1ea29800a587d513d49d1ed9ddd14d9cf9d246e6622f57389e9c91606ad5 The pypi package dde-common advertises itself as 'base types and interfaces' but exposes only a no-op DdeCommon stub. Its setup.py copies a...

5.9AI score
SaveExploits0References7
OSV
OSV
added 2026/07/16 6:43 p.m.5 views

MAL-2026-10757 Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a9c1ea29800a587d513d49d1ed9ddd14d9cf9d246e6622f57389e9c91606ad5 The pypi package dde-common advertises itself as 'base types and interfaces' but exposes only a no-op DdeCommon stub. Its setup.py copies a...

5.9AI score
SaveExploits0References7
OSV
OSV
added 2026/07/16 6:43 p.m.4 views

MAL-2026-10756 Malicious code in darkglitch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a84fec55fc625d5e2b337aafe5a9a95ff30c47403241c59dbb33543ec97311a The package installs a listener CLI darkglitch -l -b that opens a WebSocket to the hardcoded signaling host malware-signal.vercel.app and joins the...

5.6AI score
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/07/16 6:42 p.m.14 views

Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee854f4888e58f81b9e22e7addd740d28a717be453133c10267dd91fc5e50cee The package advertises itself as a REST client for a captcha-solving API, but the shipped captchasolveapi module is a 20-line stub. The tarball's rea...

5.8AI score
SaveExploits0References7
OSV
OSV
added 2026/07/16 6:42 p.m.5 views

MAL-2026-10755 Malicious code in captcha-solve-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee854f4888e58f81b9e22e7addd740d28a717be453133c10267dd91fc5e50cee The package advertises itself as a REST client for a captcha-solving API, but the shipped captchasolveapi module is a 20-line stub. The tarball's rea...

5.8AI score
SaveExploits0References7
NVD
NVD
added 2026/07/16 6:16 p.m.10 views

CVE-2026-46341

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetchapifydocs.ts validates allowlisted documentation domains with...

6.1CVSS0.00191EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/07/16 4:45 p.m.7 views

CVE-2026-45568

zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route accepts an absolute URL in the request path and passes it to urllib.parse.urljoin, allowing the requested path to replace the configured target host and causing...

9.9CVSS6.1AI score0.00361EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 2026/07/16 4:3 p.m.7 views

CVE-2026-63087 Grafana OnCall 1.16.11 Unauthenticated Token Hijack via Plugin Install Endpoint

Grafana OnCall through 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stackid and orgid values present in the public source tree...

9.3CVSS6.2AI score0.00427EPSS
SaveExploits0References5
Rows per page
Query Builder