Lucene search
+L

49811 matches found

Oracle linux
Oracle linux
added 2026/05/01 12:0 a.m.19 views

Unbreakable Enterprise kernel security update: Copy Fail

5.15.0-319.201.4.4 - crypto: algifaead - Fix minimum RX size check for decryption Herbert Xu Orabug: 39291961 - crypto: afalg - Fix page reassignment overflow in afalgpulltsgl Herbert Xu Orabug: 39291961 - crypto: authencesn - Fix src offset when decrypting in-place Herbert Xu Orabug: 39291961 -...

7.8CVSS6.1AI score0.99907EPSS
SaveExploits238
RedhatCVE
RedhatCVE
added 2026/04/30 8:48 p.m.14 views

CVE-2026-40557

Improper Certificate Validation via Global SSL Context Downgrade in Apache Storm Prometheus Reporter Versions Affected: from 2.6.3 to 2.8.6 Description: In production deployments where an administrator enables storm.daemon.metrics.reporter.plugin.prometheus.skiptlsvalidation by default it is...

4.8CVSS5.2AI score0.00193EPSS
SaveExploits0References1
Github Security Blog
Github Security Blog
added 2026/04/30 5:27 p.m.37 views

Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)

Vulnerability Details CWE: CWE-20 - Improper Input Validation The metadata value sanitization introduced in v8.30.1 commit 405f106 only validates metadata KEYS via safeKeyPattern regex. Metadata VALUES are passed unsanitized to go-exiftool SetString, which writes them as fmt.Fprintlne.stdin,...

10CVSS5.6AI score0.00612EPSS
SaveExploits1References5Affected Software1
OSV
OSV
added 2026/04/30 5:27 p.m.9 views

GHSA-Q7R4-HC83-HF2Q Gotenberg has ExifTool stdin argument injection via metadata value newlines (bypass of key sanitization fix)

Vulnerability Details CWE: CWE-20 - Improper Input Validation The metadata value sanitization introduced in v8.30.1 commit 405f106 only validates metadata KEYS via safeKeyPattern regex. Metadata VALUES are passed unsanitized to go-exiftool SetString, which writes them as fmt.Fprintlne.stdin,...

10CVSS5.9AI score0.00612EPSS
SaveExploits1References5
RedhatCVE
RedhatCVE
added 2026/04/30 2:47 p.m.19 views

CVE-2026-3861

LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs due to insufficient safeguards when handling arbitrary URL schemes, potentially causing the iOS device to become temporarily...

7.1CVSS5.3AI score0.00305EPSS
SaveExploits0References1
OSV
OSV
added 2026/04/30 2:46 p.m.8 views

MINI-MG35-8FPJ-G3PF

Bulletin has no description...

6.1CVSS4.8AI score0.00259EPSS
SaveExploits1
OSV
OSV
added 2026/04/30 12:33 p.m.20 views

GHSA-X8MH-94WC-33GV apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider

Apache Airflow's SMTP provider SmtpHook called Python's smtplib.SMTP.starttls without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS...

5.9CVSS5.8AI score0.00268EPSS
SaveExploits0References5
Github Security Blog
Github Security Blog
added 2026/04/30 12:33 p.m.20 views

apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider

Apache Airflow's SMTP provider SmtpHook called Python's smtplib.SMTP.starttls without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS...

5.9CVSS5.8AI score0.00268EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/04/30 11:22 a.m.10 views

CLSA-2026-1777548161 Fix CVE(s): CVE-2023-31486

SECURITY UPDATE: HTTP::Tiny does not verify TLS certificates by default - debian/patches/CVE-2023-31486.patch: flip verifySSL default from 0 to 1 in cpan/HTTP-Tiny/lib/HTTP/Tiny.pm; add PERLHTTPTINYSSLINSECUREBYDEFAULT escape-hatch env var; update POD SSL SUPPORT - TLS/SSL SUPPORT,...

8.1CVSS7.3AI score0.01742EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/04/30 11:5 a.m.12 views

CVE-2026-41882

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server...

7.4CVSS5.3AI score0.00401EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/04/30 11:5 a.m.10 views

CVE-2026-41882

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server...

7.4CVSS5.3AI score0.00401EPSS
SaveExploits0References1
OSV
OSV
added 2026/04/30 11:5 a.m.11 views

CVE-2026-41882

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server...

7.4CVSS7.2AI score
SaveExploits0References3
CVE
CVE
added 2026/04/30 11:5 a.m.30 views

CVE-2026-41882

CVE-2026-41882 affects JetBrains IntelliJ IDEA prior to 2024.3.7.1 and versions 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, and 2026.1.1. The issue enables reading arbitrary local files via the built‑in web server. The root cause details are not provided in the given documents. A patch is indicated by th...

7.5CVSS5.3AI score0.00401EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/04/30 11:5 a.m.11 views

EUVD-2026-26368

In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web server...

7.4CVSS5.3AI score0.00401EPSS
SaveExploits0References1
GithubExploit
GithubExploit
added 2026/04/30 11:4 a.m.197 views

Exploit for CVE-2026-31431

copy-fail-cve-2026-31431 Passive detection tooling and techni...

7.8CVSS5.9AI score0.99907EPSS
SaveExploits238
Snyk
Snyk
added 2026/04/30 10:20 a.m.8 views

Improper Certificate Validation

Overview apache-airflow-providers-smtp is a Provider for Apache Airflow. Implements apache-airflow-providers-smtp package Affected versions of this package are vulnerable to Improper Certificate Validation in the SmtpHook when establishing a STARTTLS connection. An attacker can intercept SMTP...

8.2CVSS5.8AI score0.00268EPSS
SaveExploits0References2
NVD
NVD
added 2026/04/30 10:16 a.m.13 views

CVE-2026-41016

Apache Airflow's SMTP provider SmtpHook called Python's smtplib.SMTP.starttls without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS...

5.9CVSS0.00268EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/04/30 9:9 a.m.38 views

CVE-2026-41016 Apache Airflow Providers SMTP: No certificate validation on SMTP STARTTLS connections in SMTP provider

Apache Airflow's SMTP provider SmtpHook called Python's smtplib.SMTP.starttls without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS...

0.00268EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/04/30 9:9 a.m.10 views

CVE-2026-41016

Apache Airflow's SMTP provider SmtpHook called Python's smtplib.SMTP.starttls without an SSL context, so no certificate validation was performed on the TLS upgrade. A man-in-the-middle between the Airflow worker and the SMTP server could present a self-signed certificate, complete the STARTTLS...

5.9CVSS5.3AI score0.00268EPSS
SaveExploits0References3Affected Software1
GithubExploit
GithubExploit
added 2026/04/30 8:34 a.m.189 views

cve_2026_31431

CVE-2026-31431 "Copy Fail" Toolkit Detector and proof-of-co...

7.8CVSS5.6AI score0.99907EPSS
SaveExploits238
Rows per page
Query Builder