Lucene search
+L

10869 matches found

OSV
OSV
added 2026/05/06 8:36 p.m.6 views

CVE-2026-40197 Incus nil-pointer dereference in custom volume import allows denial of service

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The custom volume backup import subsystem...

7.1CVSS5.9AI score
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/05/06 8:33 p.m.9 views

CVE-2026-40195

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup...

7.1CVSS5.8AI score0.00398EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2026/05/06 8:33 p.m.6 views

CVE-2026-40195 Incus nil-pointer dereference in storage bucket import allows denial of service

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup...

7.1CVSS5.9AI score
SaveExploits0References3
CVE
CVE
added 2026/05/06 8:33 p.m.26 views

CVE-2026-40195

CVE-2026-40195 affects Incus prior to v7.0.0, causing a nil-pointer dereference in the bucket-import path during bucket restoration from a malformed index.yaml. The bug occurs in CreateBucketFromBackup when srcBackup.Config is not validated (the code accesses srcBackup.Config.Bucket and related f...

7.1CVSS5.8AI score0.00398EPSS
SaveExploits1References1Affected Software1
AlpineLinux
AlpineLinux
added 2026/05/06 8:33 p.m.15 views

CVE-2026-40195

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup...

7.1CVSS5.8AI score0.00398EPSS
SaveExploits1
Cvelist
Cvelist
added 2026/05/06 8:33 p.m.33 views

CVE-2026-40195 Incus nil-pointer dereference in storage bucket import allows denial of service

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup...

7.1CVSS0.00398EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
added 2026/05/06 8:33 p.m.10 views

CVE-2026-40195 Incus nil-pointer dereference in storage bucket import allows denial of service

Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage bucket import logic allows an authenticated user with access to the storage bucket feature to cause the Incus daemon to crash. The vulnerability is present in the backup...

7.1CVSS5.8AI score0.00398EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/05/06 8:22 p.m.15 views

CVE-2026-38429

OpenCMS v20 and before is vulnerable to XML External Entity XXE in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml...

9.8CVSS5.8AI score0.003EPSS
SaveExploits0References1
NVD
NVD
added 2026/05/06 7:16 p.m.11 views

CVE-2026-41931

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal err...

6.9CVSS0.00247EPSS
SaveExploits0References3
NVD
NVD
added 2026/05/06 7:16 p.m.10 views

CVE-2026-41936

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

8.6CVSS0.00271EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/05/06 6:36 p.m.11 views

CVE-2026-41931

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal err...

6.9CVSS5.8AI score0.00247EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/05/06 6:36 p.m.15 views

EUVD-2026-27887

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal err...

6.9CVSS5.8AI score0.00247EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/05/06 6:27 p.m.20 views

EUVD-2026-27892

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

8.6CVSS5.9AI score0.00271EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/05/06 6:27 p.m.10 views

CVE-2026-41936 Vvveb < 1.0.8.2 XML External Entity Injection via Import

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

8.6CVSS5.9AI score0.00271EPSS
SaveExploits0References4
OSV
OSV
added 2026/05/06 6:27 p.m.10 views

CVE-2026-41936 Vvveb < 1.0.8.2 XML External Entity Injection via Import

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

8.6CVSS6AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/05/06 6:27 p.m.36 views

CVE-2026-41936 Vvveb < 1.0.8.2 XML External Entity Injection via Import

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

8.6CVSS0.00271EPSS
SaveExploits0References4
CVE
CVE
added 2026/05/06 6:27 p.m.19 views

CVE-2026-41936

Vvveb before 1.0.8.2 contains an XML External Entity (XXE) injection via the admin Tools/Import feature. Authenticated site_admins can exploit the XML parser in system/import/xml.php to inject file:// or php://filter references, enabling arbitrary file disclosure and administrator password hash o...

8.6CVSS5.9AI score0.00271EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/05/06 6:27 p.m.11 views

CVE-2026-41936

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated siteadmin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

8.6CVSS5.9AI score0.00271EPSS
SaveExploits0References5
SUSE CVE
SUSE CVE
added 2026/05/06 1:41 a.m.10 views

SUSE CVE-2026-43006

In the Linux kernel, the following vulnerability has been resolved: iouring/rsrc: reject zero-length fixed buffer import validatefixedrange admits bufaddr at the exact end of the registered region when len is zero, because the check uses strict greater-than bufend imu-ubuf + imu-len. ioimportfixe...

5.5CVSS5.8AI score0.00124EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/05/06 12:0 a.m.16 views

PT-2026-38222

Vvveb before version 1.0.8.2 contains an XML external entity XXE injection vulnerability in the admin Tools/Import feature that allows authenticated site admin users to read arbitrary files and modify database records. Attackers can exploit the XML parser configuration in system/import/xml.php to...

8.6CVSS5.8AI score0.00271EPSS
SaveExploits0References5
Rows per page
Query Builder