Lucene search
+L

64320 matches found

CVE
CVE
added 2026/07/06 9:0 p.m.15 views

CVE-2026-42331

FOSSBilling before version 0.8.0 has an authorization gap in the Guest API invoice/update endpoint. An unauthenticated attacker who knows an invoice hash can modify the payment gateway associated with an unpaid invoice, potentially changing gateway_id to any gateway configured in the system. The ...

7.7CVSS6AI score0.00247EPSS
SaveExploits0References1
Github Security Blog
Github Security Blog
added 2026/07/06 8:55 p.m.12 views

Coder's workspace app upsert allows cross-workspace agent rebinding via user-controlled app ID

Summary UpsertWorkspaceApp overwrites an existing app's agentid on a primary-key conflict and insertAgentApp accepts the app ID from the provisioner's CompleteJob payload without verifying it belongs to the workspace being built. CompleteJob runs under dbauthz.AsProvisionerd so the authorization...

8.7CVSS5.9AI score0.00508EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/07/06 8:16 p.m.6 views

CVE-2026-57572

Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browserconfig.extraargs, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a child-process launch command together...

10CVSS6.1AI score0.00523EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2026/07/06 8:16 p.m.32 views

CVE-2026-57572

Crawl4AI prior to version 0.9.0 was vulnerable to unauthenticated remote command execution through Chromium launch-argument injection. The Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium’s launch arguments and could be manipulated to replace a chi...

10CVSS6.1AI score0.00523EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/06 8:10 p.m.3 views

SUSE-SU-2026:22542-1 Security update for dhcpcd

This update for dhcpcd fixes the following issue Update to 10.3.2: - CVE-2025-70102: NULL pointer dereference in parseoption when processing a specially crafted configuration input bsc1268761. Changes for dhcpcd: options: Ensure ldop is not NULL dereferenced DHCP: Don't run double EXPIRE hooks on...

6.3CVSS6.1AI score0.00169EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/06 4:46 p.m.5 views

EUVD-2026-41892

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server...

9.9CVSS6.1AI score0.0033EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/06 10:16 a.m.37 views

CVE-2025-8591 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can...

6.1CVSS0.00161EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/06 9:16 a.m.20 views

CVE-2026-1433

uniFLOW Universal Login Manager ULM Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface RUI. Exploitation requires administrative privileges and may disclose...

4.8CVSS0.00217EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/07/06 8:46 a.m.8 views

CVE-2026-9165

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central...

7.7CVSS5.9AI score0.00319EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/07/06 8:46 a.m.7 views

CVE-2026-12252

A flaw was found in the nltk library. Several Stanford interface classes within nltk are susceptible to arbitrary code execution. This vulnerability allows a local attacker to execute malicious code by providing an untrusted Java Archive JAR file, as the system lacks integrity verification for...

7.8CVSS6.4AI score0.00158EPSS
SaveExploits1References4
OSV
OSV
added 2026/07/06 8:34 a.m.4 views

CVE-2026-24014 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name t...

9.8CVSS6.2AI score0.00509EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/06 8:12 a.m.6 views

EUVD-2026-41848

uniFLOW Universal Login Manager ULM Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface RUI. Exploitation requires administrative privileges and may disclose...

4.8CVSS5.9AI score0.00217EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/06 8:12 a.m.33 views

CVE-2026-1433 uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure

uniFLOW Universal Login Manager ULM Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface RUI. Exploitation requires administrative privileges and may disclose...

4.8CVSS0.00217EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/06 8:12 a.m.18 views

CVE-2026-1433

The CVE-2026-1433 issue affects uniFLOW Universal Login Manager (ULM) Standalone. An information disclosure vulnerability allows an authenticated administrator to access sensitive configuration data via the ULM Remote User Interface (RUI). The exposure can reveal SMTP/LDAP integration configurati...

4.8CVSS5.9AI score0.00217EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/06 8:12 a.m.10 views

CVE-2026-1433

uniFLOW Universal Login Manager ULM Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface RUI. Exploitation requires administrative privileges and may disclose...

4.8CVSS5.9AI score0.00217EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/06 7:52 a.m.2 views

SUSE-SU-2026:2774-1 Security update 5.1.4 for Multi-Linux Manager Server

This update fixes the following issues: Release Notes Highlights: - Update to SUSE Multi-Linux Manager 5.1.4 Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0 SUSE Liberty Linux 9.6 Support New...

9.6CVSS6.9AI score0.05994EPSS
SaveExploits0References101
OSV
OSV
added 2026/07/06 6:31 a.m.4 views

OESA-2026-2875 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: When an application drives an AES-OCB context through the public EVPCipher one-shot interface, the application-supplied initialisation vector IV is...

7.5CVSS7.2AI score0.0032EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/07/06 5:32 a.m.11 views

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

3.3CVSS5.9AI score0.00154EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/07/06 4:52 a.m.10 views

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

3.3CVSS6.2AI score0.00154EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/06 12:0 a.m.8 views

EUVD-2026-41795

A vulnerability was identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown function of the file backend/pkg/docker/client.go of the component Docker API. The manipulation leads to sandbox issue. The attack may be initiated remotely. The pull request to fix this issue awaits acceptan...

6.5CVSS6.2AI score0.00228EPSS
SaveExploits0References7
Rows per page
Query Builder