Lucene search
+L

109964 matches found

Positive Technologies
Positive Technologies
added 2026/08/18 12:00 a.m.11 views

PT-2026-77471

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Sites version 12.2.1.4.0 Oracle WebCenter Sites version 14.1.2.0.0 Description An issue in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to...

8.2CVSS5.2AI score0.00338EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/18 12:00 a.m.10 views

PT-2026-77620

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Integration versions 25.12 through 26.6 Description A flaw in the Open Integration component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lead to unauthorized access t...

7.7CVSS5.2AI score0.00352EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/18 12:00 a.m.14 views

PT-2026-77810

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Internet Procurement Connector versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of the Oracle Internet Procurement Connector allows a low privileged attacker with network...

8.1CVSS5.2AI score0.00362EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/08/17 11:41 p.m.18 views

.NET: .NET Core: .NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...

5.9CVSS5.3AI score0.00706EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/08/17 11:41 p.m.12 views

.NET: .NET Core: .NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...

5.9CVSS5.3AI score0.00706EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/17 9:58 p.m.85 views

MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...

9.3CVSS6.2AI score0.1641EPSS
SaveExploits4References6Affected Software1
OSV
OSV
added 2026/08/17 9:58 p.m.11 views

GHSA-7GWP-5PFP-969J MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding)

Summary The default MLflow Tracking Server mlflow server, no authentication, default SQLite backend exposes the model-registry webhooks API unauthenticated, including a synchronous POST /api/2.0/mlflow/webhooks/id/test endpoint that returns the upstream response status and body to the caller. The...

9.3CVSS6.3AI score0.1641EPSS
SaveExploits3References6
RedHat Linux
RedHat Linux
added 2026/08/17 9:58 p.m.10 views

.NET: .NET Core: .NET Security Feature Bypass Vulnerability

Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...

5.9CVSS5.3AI score0.00706EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/08/17 9:57 p.m.16 views

http4k: `DigestAuthProvider.verify` did not bind to request URI

Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...

5.4AI score
SaveExploits0References4Affected Software1
Github Security Blog
Github Security Blog
added 2026/08/17 9:49 p.m.16 views

atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)

The HTTP MCP server-registry backend factory atomicagents/mcpregistry/http.py, makehttpmcpserverregistrybackendfromurl accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by...

6.2AI score
SaveExploits0References3Affected Software1
Anthropic
Anthropic
added 2026/08/17 9:12 p.m.7 views

ANT-2026-61Y3NTY3 · suricata · Use-after-free

use-after-free high GHSA-qmc9-vqq2-8mv3 Severity Claude critical · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-61Y3NTY3: Use-after-free in...

6AI score0.00052EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/17 9:08 p.m.9 views

Important: Red Hat Security Advisory: haproxy security update

An update for haproxy is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

8.7CVSS5.5AI score0.00484EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/17 8:36 p.m.6 views

CVE-2026-75482 SWE-agent Trajectory Inspector Path Traversal File Disclosure

SWE-agent's trajectory inspector sweagent inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory '..' references, bypassing the built-in path sanitization. The server binds all interface...

8.7CVSS5.5AI score
SaveExploits0References6
CVE
CVE
added 2026/08/17 8:36 p.m.67 views

CVE-2026-75482

SWE-agent's trajectory inspector (v1.1.0) exposes a path-traversal vulnerability in its /trajectory/ handler, allowing unauthenticated clients to read arbitrary files shaped as trajectory JSON, potentially leaking repository contents, command output, and API keys. The server binds to 0.0.0.0 with...

8.7CVSS5.4AI score0.00622EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/17 8:36 p.m.10 views

EUVD-2026-60394

SWE-agent's trajectory inspector sweagent inspector, confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory '..' references, bypassing the built-in path sanitization. The server binds all interface...

8.7CVSS5.5AI score0.00622EPSS
SaveExploits0References4
Chainguard
Chainguard
added 2026/08/17 8:31 p.m.21 views

GHSA-FM65-XRRR-C358 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

5.9AI score
SaveExploits0
Chainguard
Chainguard
added 2026/08/17 8:31 p.m.26 views

GHSA-6364-X4QJ-7W59 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

5.9AI score
SaveExploits0
Chainguard
Chainguard
added 2026/08/17 8:31 p.m.24 views

CVE-2026-28753 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

6.3CVSS5.9AI score0.00264EPSS
SaveExploits0
Wolfi
Wolfi
added 2026/08/17 8:21 p.m.19 views

GHSA-82W2-X7HF-5H8R vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

5.9AI score
SaveExploits0
Wolfi
Wolfi
added 2026/08/17 8:21 p.m.20 views

GHSA-FM65-XRRR-C358 vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

5.9AI score
SaveExploits0
Rows per page
Query Builder