Lucene search
+L

49707 matches found

Cvelist
Cvelist
added 2026/05/13 2:12 p.m.58 views

CVE-2026-42946 NGINX ngx_http_scgi_module and ngx_http_uwsgi_module vulnerability

A vulnerability exists in the ngxhttpscgimodule and ngxhttpuwsgimodule modules that may result in excessive memory allocation or an over-read of data. When scgipass or uwsgipass is configured, an unauthenticated attacker with man-in-the-middle MITM ability to control responses from an upstream...

8.3CVSS0.00932EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/05/13 2:12 p.m.19 views

CVE-2026-42946

A vulnerability exists in the ngxhttpscgimodule and ngxhttpuwsgimodule modules that may result in excessive memory allocation or an over-read of data. When scgipass or uwsgipass is configured, an unauthenticated attacker with man-in-the-middle MITM ability to control responses from an upstream...

8.3CVSS5.8AI score0.00932EPSS
SaveExploits0References2Affected Software1
NVD
NVD
added 2026/05/13 1:16 p.m.16 views

CVE-2026-42950

ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken...

5.1CVSS0.00207EPSS
SaveExploits0References2
NVD
NVD
added 2026/05/13 1:16 p.m.18 views

CVE-2026-35506

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of pingipaddr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed...

8.6CVSS0.01308EPSS
SaveExploits0References2
Wiz blog
Wiz blog
added 2026/05/13 12:13 p.m.22 views

Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP

A new page-cache corruption vulnerability in the Dirty Frag family enables unprivileged local attackers to achieve root...

5.8AI score
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/05/13 12:2 p.m.8 views

CVE-2026-42961

ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a malicious page while logged in, the user may be tricked to do unintended operations...

5.1CVSS5.8AI score0.00186EPSS
SaveExploits0References3Affected Software4
ATTACKERKB
ATTACKERKB
added 2026/05/13 12:2 p.m.8 views

CVE-2026-42950

ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value. If a user views a malicious page while logged in, the admin page on the user's web browser may become broken...

5.1CVSS5.8AI score0.00207EPSS
SaveExploits0References3Affected Software4
CVE
CVE
added 2026/05/13 12:2 p.m.32 views

CVE-2026-42950

The CVE-2026-42950 entry concerns ELECOM wireless LAN access point devices where the language parameter can be given an inappropriate value. The underlying issue may cause the admin page in the user’s web browser to become broken if a logged-in user visits a malicious page. Documented impact is b...

5.1CVSS5.8AI score0.00207EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/05/13 12:1 p.m.10 views

CVE-2026-35506

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of pingipaddr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed...

8.6CVSS7.2AI score0.01308EPSS
SaveExploits0References3Affected Software4
CVE
CVE
added 2026/05/13 12:1 p.m.24 views

CVE-2026-35506

CVE-2026-35506 affects ELECOM wireless LAN access point devices. A vulnerability in the processing of the ping_ip_addr parameter allows an authenticated, logged-in user to inject and execute arbitrary OS commands, as described in the CVE entry. The issue is a command injection in the handling of ...

8.6CVSS7.2AI score0.01308EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/05/13 12:1 p.m.9 views

CVE-2026-35506

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of pingipaddr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed...

8.6CVSS5.9AI score0.01308EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/05/13 12:1 p.m.58 views

CVE-2026-35506

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of pingipaddr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed...

8.6CVSS0.01308EPSS
SaveExploits0References2
OSV
OSV
added 2026/05/13 10:5 a.m.7 views

SUSE-SU-2026:1840-1 Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP6 kernel was updated to fix the following issue: - CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags bsc1264449. - CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present bsc1264450...

8.8CVSS6AI score0.93235EPSS
SaveExploits34References5
Cvelist
Cvelist
added 2026/05/13 9:26 a.m.57 views

CVE-2026-4782 Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter

The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusiongetsvgfromfile' function with the 'customsvg' parameter of the 'fusionsectionseparator' shortcode. This makes it possible for authenticated attackers, with...

6.5CVSS0.00473EPSS
SaveExploits1References2
OSV
OSV
added 2026/05/13 9:0 a.m.5 views

MINI-4MWP-32G3-4X3M

Bulletin has no description...

5.7AI score0.0004EPSS
SaveExploits0
RedhatCVE
RedhatCVE
added 2026/05/13 8:21 a.m.15 views

CVE-2026-5958

A Time-of-Check Time-of-Use TOCTOU race condition was found in GNU sed. When the -i in-place and --follow-symlinks options are used together, sed resolves the symlink but reopens the path for writing. An attacker with write access to the directory containing the symlink can swap it between the...

6.3CVSS5.8AI score0.00142EPSS
SaveExploits0References3
The Hacker News
The Hacker News
added 2026/05/13 6:55 a.m.53 views

Android Adds Intrusion Logging for Sophisticated Spyware Forensics

Google on Tuesday unveiled a new opt-in Android feature called Intrusion Logging for storing forensic logs to better analyze sophisticated spyware attacks. Intrusion Logging, available as part of Advanced Protection Mode, enables "persistent and privacy-preserving forensics logging to allow for...

5.9AI score
SaveExploits0
Vulnrichment
Vulnrichment
added 2026/05/13 4:26 a.m.8 views

CVE-2026-6962 Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Cost of Goods: Product Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'algwccogproductcost' and 'algwccogproductprofit' shortcodes in all versions up to, and including, 4.1.0 due to insufficient input sanitization an...

6.4CVSS6AI score0.00193EPSS
SaveExploits0References5
SUSE CVE
SUSE CVE
added 2026/05/13 3:38 a.m.15 views

SUSE CVE-2026-33603

Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding. This requires that the attacker is able to position itself between Dovecot and the client connection. If successful, the attacker can eavesdrop communications between Dovecot and...

6.8CVSS5.8AI score0.00222EPSS
SaveExploits0References5
SUSE CVE
SUSE CVE
added 2026/05/13 3:35 a.m.16 views

SUSE CVE-2026-43334

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements before building the pairing response smpcmdpairingreq currently builds the pairing response from the initiator authreq before enforcing the local BTSECURITYHIGH requirement. If th...

8.1CVSS5.7AI score0.00252EPSS
SaveExploits0References19
Rows per page
Query Builder