Lucene search
+L

49427 matches found

RedhatCVE
RedhatCVE
added 2026/07/15 10:17 a.m.15 views

CVE-2026-49978

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

8.1CVSS6.1AI score0.00334EPSS
SaveExploits1References6
SUSE CVE
SUSE CVE
added 2026/07/15 5:35 a.m.6 views

SUSE CVE-2026-15719

We are aware that exploit code for this is public however we are not aware of any attacks in the wild abusing this flaw. This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13...

5.4CVSS6.3AI score0.00339EPSS
SaveExploits0References9
RedHat Linux
RedHat Linux
added 2026/07/15 5:27 a.m.6 views

firefox: thunderbird: JIT miscompilation in the DOM: Core & HTML component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the DOM: Core & HTML component...

7.5CVSS6AI score0.00306EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment
added 2026/07/15 2:1 a.m.16 views

CVE-2026-13385

An Improper Validation of Integrity Check Value and Improper Certificate Validation in certain ASUS router models allows a remote man-in-the-middleMITM user to make the router download and execute arbitrary command via a spoofed server. Refer to the ' Security Update for ASUS Router Firmware '...

9.5CVSS6.3AI score0.00142EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/15 2:1 a.m.31 views

CVE-2026-13385

The CVE-2026-13385 entry affects certain ASUS router models. It covers an vulnerability path where an attacker can perform a remote MITM to cause the device to download and execute arbitrary commands via a spoofed server, due to improper validation of the integrity check value and improper certif...

9.5CVSS6.3AI score0.00142EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/15 1:17 a.m.14 views

CVE-2026-9770

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract the embedded key. Successful exploitation may allow an unauthenticated attacker on the same...

8.6CVSS0.00363EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/15 12:21 a.m.29 views

CVE-2026-9770

Affected products: TP-Link Kasa EC70 v4 and EC71 v4 firmware. Issue: a static cryptographic private key is stored in a read-only filesystem shared across devices, allowing extraction from the firmware image. Impact: an unauthenticated attacker on the same network could use the embedded key in the...

8.6CVSS6.1AI score0.00363EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/07/15 12:21 a.m.15 views

EUVD-2026-44576

Kasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract the embedded key. Successful exploitation may allow an unauthenticated attacker on the same...

8.6CVSS6.1AI score0.00363EPSS
SaveExploits0References5
Tenable Nessus
Tenable Nessus
added 2026/07/15 12:0 a.m.8 views

Linux Distros Unpatched Vulnerability : CVE-2026-62643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or...

10CVSS6.8AI score0.0031EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.17 views

PT-2026-60296

Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.0.61 Description An issue exists in the @nocobase/plugin-notification-in-app-message where the 'GET /api/myInAppChannels:list' endpoint is exposed. A signed-up authenticated user can exploit this by providing a val...

10CVSS5.7AI score0.00593EPSS
SaveExploits1References11
Snyk
Snyk
added 2026/07/15 12:0 a.m.9 views

Key Exchange without Entity Authentication

Overview Affected versions of this package are vulnerable to Key Exchange without Entity Authentication through contrib/paramikovendor.py in the SSH connection path. An attacker can intercept or impersonate an SSH server and have the client connect without validating the server’s host key by...

8.8CVSS5.5AI score0.00195EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/07/15 12:0 a.m.8 views

Oracle Linux 10 : openssh (ELSA-2026-19069)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19069 advisory. - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add...

8.2CVSS6.7AI score0.0218EPSS
SaveExploits2References6
Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.20 views

PT-2026-60388

Name of the Vulnerable Software and Affected Versions view component versions 4.0.0 through 4.11.0 Description ViewComponent::Base instances retain render-scoped objects across calls to the render in function. If the same component, collection, or spacer component instance is reused across...

6.8CVSS5.3AI score0.00249EPSS
SaveExploits1References9
Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.22 views

PT-2026-60387

This update for govulncheck-vulndb fixes the following issues: - Update to version 0.0.20260723T184607 2026-07-23T18:46:07Z jscPED-11136. Go CVE Numbering Authority IDs added or updated with aliases: GO-2026-4730 CVE-2026-33022 GHSA-cv4x-93xx-wgfj GO-2026-4761 CVE-2026-33211 GHSA-j5q5-j9gm-2w5c...

9.9CVSS6.7AI score0.03082EPSS
SaveExploits10
Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.22 views

PT-2026-58872

Name of the Vulnerable Software and Affected Versions ASUS router models affected versions not specified Description Improper Validation of Integrity Check Value and Improper Certificate Validation allow a remote man-in-the-middle MITM user to force the router to download and execute arbitrary...

9.5CVSS6.3AI score0.00142EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.22 views

PT-2026-60184

Name of the Vulnerable Software and Affected Versions NGINX Plus affected versions not specified NGINX Open Source affected versions not specified Description A use-after-free issue exists in the ngx http ssi module module. This occurs when Server-Side Includes SSI, proxy pass, and proxy bufferin...

8.3CVSS5.2AI score0.0045EPSS
SaveExploits0References15
Tenable Nessus
Tenable Nessus
added 2026/07/15 12:0 a.m.7 views

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : GnuTLS vulnerabilities (USN-8539-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8539-1 advisory. Haruto Kimura discovered that GnuTLS did not properly apply permitted name constraints in certain certificate validation paths. A...

8.2CVSS6.9AI score0.00727EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/14 10:17 p.m.12 views

CVE-2026-48807

Twig is a template language for PHP. Prior to 3.27.0, the sandbox toString checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the...

9.1CVSS0.00215EPSS
SaveExploits0References2
UbuntuCve
UbuntuCve
added 2026/07/14 10:17 p.m.20 views

CVE-2026-48807

Twig is a template language for PHP. Prior to 3.27.0, the sandbox toString checks do not fully cover Traversable values passed to join and replace filters or operands evaluated by the in and not in operators, allowing contained Stringable objects to be coerced to strings without consulting the...

9.1CVSS6.1AI score0.00215EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/14 10:16 p.m.11 views

CVE-2026-47730

Twig is a template language for PHP. From 3.0.0 until 3.26.0, Twig\Profiler\Dumper\HtmlDumper writes Profile::getTemplate and Profile::getName into HTML output without escaping, allowing attacker-controlled template or profile names to inject arbitrary HTML when a browser renders the profiler dum...

5.4CVSS0.00169EPSS
SaveExploits0References3
Rows per page
Query Builder