Lucene search
+L

49589 matches found

CVE
CVE
added 2026/06/05 6:44 p.m.38 views

CVE-2026-46396

CVE-2026-46396 stems from a stored XSS in HAX CMS prior to 26.0.0, caused by improper sanitization of elements that permit javascript: in the src attribute. When a victim views a page containing such an iframe, arbitrary JavaScript can execute in the browser context, enabling access to sensitive...

9.3CVSS5.5AI score0.0023EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/05 5:53 p.m.68 views

CVE-2026-45745

Termix Desktop (Electron) versions starting with 1.7.0 have disabled TLS certificate validation, enabling network-level MITM to intercept/modify HTTPS traffic to the Termix server and potentially steal credentials and JWT/session data during login and normal use. No patched versions are publicly ...

8CVSS5.5AI score0.00168EPSS
SaveExploits1References1Affected Software1
OSV
OSV
added 2026/06/05 5:53 p.m.10 views

CVE-2026-45745 Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop Electron disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured...

8CVSS6AI score0.00168EPSS
SaveExploits1References3
EUVD
EUVD
added 2026/06/05 5:53 p.m.16 views

EUVD-2026-34871

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop Electron disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured...

8CVSS5.5AI score0.00168EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
added 2026/06/05 5:53 p.m.9 views

CVE-2026-45745 Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop Electron disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured...

8CVSS5.5AI score0.00168EPSS
SaveExploits1References1
ATTACKERKB
ATTACKERKB
added 2026/06/05 5:53 p.m.6 views

CVE-2026-45745

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop Electron disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured...

8CVSS5.5AI score0.00168EPSS
SaveExploits1References2Affected Software1
Cvelist
Cvelist
added 2026/06/05 5:53 p.m.43 views

CVE-2026-45745 Termix has improper certificate validation in Electron desktop client that enables MITM credential/token theft

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Starting in version 1.7.0, Termix Desktop Electron disables TLS certificate validation, allowing a machine-in-the-middle attacker to intercept and modify HTTPS traffic to the configured...

8CVSS0.00168EPSS
SaveExploits1References1
OSV
OSV
added 2026/06/05 4:52 p.m.11 views

MINI-5658-GHWF-J8H4

Bulletin has no description...

9.1CVSS5.2AI score0.006EPSS
SaveExploits0
OSV
OSV
added 2026/06/05 4:52 p.m.10 views

MINI-XGFW-QWJQ-8RPP

Bulletin has no description...

5.3CVSS5.2AI score0.0037EPSS
SaveExploits0
OSV
OSV
added 2026/06/05 4:52 p.m.8 views

MINI-HXPC-M989-9CV4

Bulletin has no description...

5.3CVSS5.2AI score0.0037EPSS
SaveExploits0
OSV
OSV
added 2026/06/05 4:52 p.m.16 views

MINI-C4FG-6MW2-63J7

Bulletin has no description...

7.5CVSS5.2AI score0.0056EPSS
SaveExploits0
OSV
OSV
added 2026/06/05 4:51 p.m.11 views

MINI-P8MR-G7MW-PVGM

Bulletin has no description...

7.5CVSS5.2AI score0.0056EPSS
SaveExploits0
OSV
OSV
added 2026/06/05 4:51 p.m.12 views

MINI-JFMP-QFWG-3JCG

Bulletin has no description...

6.1CVSS5.1AI score0.00223EPSS
SaveExploits0
Vulnrichment
Vulnrichment
added 2026/06/05 4:22 p.m.12 views

CVE-2026-7473 Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN Virtual Extensible LAN, decap-groups, or a GRE Generic Routing Encapsulation tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a...

6.9CVSS5.4AI score0.01108EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/06/05 4:22 p.m.22 views

EUVD-2026-34858

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN Virtual Extensible LAN, decap-groups, or a GRE Generic Routing Encapsulation tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a...

6.9CVSS5.4AI score0.01108EPSS
SaveExploits1References1
Github Security Blog
Github Security Blog
added 2026/06/05 4:19 p.m.23 views

NocoDB: Stored Cross-Site Scripting via Row Comments

Summary An authenticated commenter could store HTML in row comments that executed as script when other users hovered over the comment in the expanded form view. Details The comment write paths persisted the raw comment body with no server-side sanitisation; the expanded-form sidebar then rendered...

7.4CVSS5.5AI score0.00288EPSS
SaveExploits0References4Affected Software1
NVD
NVD
added 2026/06/05 4:16 p.m.16 views

CVE-2026-9270

DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The sendstats method does not remove newlines from metric names $stat variable, allowing attackers to change t...

9.1CVSS0.00331EPSS
SaveExploits0References3
OSV
OSV
added 2026/06/05 4:3 p.m.15 views

GHSA-JR54-JWHJ-55GP NocoDB: User Enumeration via Sign-In Timing

Summary Sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. Details The unknown-user branch in auth.service.ts now performs a bcrypt.compare against a fixed dummy hash so the response ti...

6.3CVSS5.5AI score0.00197EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/06/05 4:3 p.m.20 views

NocoDB: User Enumeration via Sign-In Timing

Summary Sign-in response timing differed between known and unknown email addresses because the unknown-user branch returned without performing a password hash comparison. Details The unknown-user branch in auth.service.ts now performs a bcrypt.compare against a fixed dummy hash so the response ti...

6.3CVSS5.5AI score0.00197EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2026/06/05 2:49 p.m.104 views

CVE-2026-9270

DataDog::DogStatsd for Perl (up to version 0.07) is vulnerable to metric injections due to insufficient input sanitization in the send_stats pathway. The stat name is not stripped of newlines, enabling prefix manipulation; the value (delta) is not validated, allowing injection via set/gauge/count...

9.1CVSS5.5AI score0.00331EPSS
SaveExploits0References3Affected Software1
Rows per page
Query Builder