Lucene search
+L

49406 matches found

Vulnrichment
Vulnrichment
added 2026/07/18 1:10 p.m.9 views

CVE-2024-58365 SurrealDB before 1.2.0 Denial of Service via Nonexistent Function

SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built-in functions. Authorized clients can craft pre-parsed queries invoking nonexistent functions to trigger a panic that crashes the server...

7.1CVSS5.3AI score0.00249EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/18 1:10 p.m.6 views

CVE-2024-58358 SurrealDB before 2.1.0 Denial of Service via Nonexistent Role

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server...

6.9CVSS5.3AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/18 8:57 a.m.46 views

CVE-2026-47868 VMware Avi Load Balancer Local Privilege Escalation Vulnerability

VMware Avi Load Balancer contains a local privilege escalation vulnerability. A malicious user with local access may be able to escalate their privileges to run code as root. Affected versions: 32.1.1 fixed in 32.1.2 31.1.1 through 31.2.2 fixed in 31.2.2-2p3 30.1.1 through 30.2.6 fixed in 30.2.7...

7.8CVSS0.0011EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/18 8:57 a.m.45 views

CVE-2026-47865 VMware Avi Load Balancer Authentication Bypass Vulnerability

VMware Avi Load Balancer contains an authentication bypass vulnerability. A malicious user with network access may be able to access the Avi Control plane by bypassing the authentication mechanism. Affected versions: 31.1.1 through 31.2.2 fixed in 31.2.2-2p3 30.1.1 through 30.2.6 fixed in 30.2.7...

9.8CVSS0.00874EPSS
SaveExploits0References1
Fedora
Fedora
added 2026/07/18 12:29 a.m.13 views

[SECURITY] Fedora 43 Update: node-exporter-1.12.1-1.fc43

Prometheus exporter for hardware and OS metrics exposed by NIX kernels, writ ten in Go with pluggable metric collectors...

7.5CVSS5.2AI score0.00591EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/07/17 8:46 p.m.9 views

CVE-2026-54498

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 4.0.0 until 4.12.0, ViewComponent::Basearoundrender can return HTML-unsafe strings that bypass the escaping behavior applied to normal call return values. This creates an XSS risk...

8.7CVSS5.2AI score0.00312EPSS
SaveExploits1References5Affected Software1
CVE
CVE
added 2026/07/17 8:46 p.m.37 views

CVE-2026-54498

CVE-2026-54498 affects ViewComponent (Ruby on Rails) where ViewComponent::Base#around_render can return HTML-unsafe strings, bypassing normal escaping and causing XSS. The issue is amplified when ViewComponent::Collection#render_in joins per-item results and marks the whole output html_safe, conv...

8.7CVSS5.2AI score0.00312EPSS
SaveExploits1References4Affected Software1
Cvelist
Cvelist
added 2026/07/17 8:36 p.m.40 views

CVE-2026-48062 CodeIgniter: Uploaded file extension validation bypass in `ext_in` rule

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.3, the extin upload validation rule in system/Validation/StrictRules/FileRules.php checked the MIME-derived guessed extension instead of the client-provided filename extension. As a result, an uploaded file named shell.php containing...

9.8CVSS0.00438EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/17 8:17 p.m.4 views

DEBIAN-CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

9.8CVSS6.4AI score0.98417EPSS
SaveExploits69References1
NVD
NVD
added 2026/07/17 8:17 p.m.21 views

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

9.8CVSS0.98417EPSS
SaveExploits69References3
NVD
NVD
added 2026/07/17 8:17 p.m.18 views

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

9.1CVSS0.79029EPSS
SaveExploits52References3
OSV
OSV
added 2026/07/17 8:17 p.m.4 views

DEBIAN-CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

5.9CVSS6.3AI score0.79029EPSS
SaveExploits52References1
OSV
OSV
added 2026/07/17 7:46 p.m.6 views

CVE-2026-48819 Hey API: `buildClientParams` template: prototype chain substitution via unknown `$<slot>___proto__` key

Hey API is an ecosystem for turning API specifications into production-ready code. Prior to 0.97.3, dist/clients/core/params.ts ships a runtime template copied into generated SDKs as params.gen.ts, and buildClientParams writes unknown slot-prefixed keys such as $body, $headers, $path, and $query...

4.8CVSS5.3AI score
SaveExploits0References6
OSV
OSV
added 2026/07/17 7:42 p.m.7 views

GO-2026-5998 open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters in github.com/open-feature/open-feature-operator

open-feature-operator: Cross-namespace FeatureFlagSource and InProcessConfiguration resolution exposes spec contents on multi-tenant clusters in github.com/open-feature/open-feature-operator...

5.2AI score
SaveExploits0References2
OSV
OSV
added 2026/07/17 7:36 p.m.5 views

CVE-2026-50163 oras-go: Hardlink entry with relative Linkname escapes extract dir via process CWD resolution in `oras-go` tar extraction

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/utils.go:262-275 validates a hardlink target relative to the extract base but returns the unresolved target, causing os.Link"victim.secret", "/payload.tar.gz/evilcwdlink" to resolve header.Linkname...

7.1CVSS5.3AI score
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/17 7:14 p.m.77 views

CVE-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

9.8CVSS0.98417EPSS
SaveExploits69References2
CVE
CVE
added 2026/07/17 7:14 p.m.320 views

CVE-2026-60137

CVE-2026-60137 (SQL injection in WP_Query::author__not_in) affects WordPress 6.8.x (6.8.0–6.8.5), 6.9.x (6.9.0–6.9.4), and 7.0.x (7.0.0–7.0.1). The vulnerability occurs when author__not_in is passed as a string instead of an array, bypassing sanitisation and allowing unsafe interpolation into an ...

9.1CVSS5.8AI score0.79029EPSS
SaveIn wildExploits52References3Affected Software1
Debian CVE
Debian CVE
added 2026/07/17 7:14 p.m.7 views

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

9.1CVSS6.3AI score0.79029EPSS
SaveExploits52
Vulnrichment
Vulnrichment
added 2026/07/17 7:14 p.m.20 views

CVE-2026-60137 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

5.9CVSS5.9AI score0.79029EPSS
SaveExploits52References2
EUVD
EUVD
added 2026/07/17 7:14 p.m.19 views

EUVD-2026-45279

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

9.1CVSS5.8AI score0.79029EPSS
SaveExploits52References2
Rows per page
Query Builder