Lucene search
+L

64295 matches found

EUVD
EUVD
added 2026/07/06 4:46 p.m.5 views

EUVD-2026-41892

An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege escalation on the underlying server...

9.9CVSS6.1AI score0.0033EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/06 10:16 a.m.37 views

CVE-2025-8591 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Modification

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious script content into pages served by the application. By leveraging this weakness, an attacker can...

6.1CVSS0.00161EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/06 9:16 a.m.20 views

CVE-2026-1433

uniFLOW Universal Login Manager ULM Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface RUI. Exploitation requires administrative privileges and may disclose...

4.8CVSS0.00217EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/07/06 8:46 a.m.8 views

CVE-2026-9165

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes RHACS. Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central...

7.7CVSS5.9AI score0.00319EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/07/06 8:46 a.m.7 views

CVE-2026-12252

A flaw was found in the nltk library. Several Stanford interface classes within nltk are susceptible to arbitrary code execution. This vulnerability allows a local attacker to execute malicious code by providing an untrusted Java Archive JAR file, as the system lacks integrity verification for...

7.8CVSS6.4AI score0.00158EPSS
SaveExploits1References4
OSV
OSV
added 2026/07/06 8:34 a.m.4 views

CVE-2026-24014 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write

Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port is exposed to an untrusted network, an attacker may use path traversal sequences in the JAR name t...

9.8CVSS6.2AI score0.00509EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/06 8:12 a.m.6 views

EUVD-2026-41848

uniFLOW Universal Login Manager ULM Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface RUI. Exploitation requires administrative privileges and may disclose...

4.8CVSS5.9AI score0.00217EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/06 8:12 a.m.33 views

CVE-2026-1433 uniFLOW Universal Login Manager (ULM) Standalone Improper Protection of Sensitive Information Leads to Information Disclosure

uniFLOW Universal Login Manager ULM Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface RUI. Exploitation requires administrative privileges and may disclose...

4.8CVSS0.00217EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/06 8:12 a.m.18 views

CVE-2026-1433

The CVE-2026-1433 issue affects uniFLOW Universal Login Manager (ULM) Standalone. An information disclosure vulnerability allows an authenticated administrator to access sensitive configuration data via the ULM Remote User Interface (RUI). The exposure can reveal SMTP/LDAP integration configurati...

4.8CVSS5.9AI score0.00217EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/06 8:12 a.m.10 views

CVE-2026-1433

uniFLOW Universal Login Manager ULM Standalone contains an information disclosure vulnerability that may allow an authenticated administrator to access sensitive configuration information through the ULM Remote User Interface RUI. Exploitation requires administrative privileges and may disclose...

4.8CVSS5.9AI score0.00217EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/06 7:52 a.m.2 views

SUSE-SU-2026:2774-1 Security update 5.1.4 for Multi-Linux Manager Server

This update fixes the following issues: Release Notes Highlights: - Update to SUSE Multi-Linux Manager 5.1.4 Added note about migration for SUSE Linux Enterprise Server 16 on SSH managed minions Product Migration from SUSE Linux Enterprise Server 15 SP7 to 16.0 SUSE Liberty Linux 9.6 Support New...

9.6CVSS6.9AI score0.05994EPSS
SaveExploits0References101
OSV
OSV
added 2026/07/06 6:31 a.m.4 views

OESA-2026-2875 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: When an application drives an AES-OCB context through the public EVPCipher one-shot interface, the application-supplied initialisation vector IV is...

7.5CVSS7.2AI score0.0032EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/07/06 5:32 a.m.11 views

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

3.3CVSS5.9AI score0.00154EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/07/06 4:52 a.m.10 views

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

3.3CVSS6.2AI score0.00154EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/06 12:0 a.m.8 views

EUVD-2026-41795

A vulnerability was identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown function of the file backend/pkg/docker/client.go of the component Docker API. The manipulation leads to sandbox issue. The attack may be initiated remotely. The pull request to fix this issue awaits acceptan...

6.5CVSS6.2AI score0.00228EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.11 views

PT-2026-56023

Name of the Vulnerable Software and Affected Versions ajenti versions prior to 2.2.14 Description The browser-facing login and administrative UI contains a clickjacking weakness. This occurs because the core HTTP response path in ajenti-core/aj/http.py initializes an empty header list and finaliz...

5.4CVSS5.9AI score0.00159EPSS
SaveExploits0References7
CVE
CVE
added 2026/07/06 12:0 a.m.12 views

CVE-2026-38979

Ajenti prior to version 2.2.14 is affected by a clickjacking weakness in the browser-facing login and administrative UI due to anti-framing protections missing in the HTTP response path (ajenti-core/aj/http.py). The vulnerability arises from initializing an empty header list, forwarding handler-a...

5.4CVSS5.9AI score0.00159EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/06 12:0 a.m.11 views

PT-2026-56036

Name of the Vulnerable Software and Affected Versions FOSSBilling versions prior to 0.8.0 Description Low-privileged staff accounts can perform unauthorized actions through admin API endpoints. This issue stems from the can always access module flag, which grants all staff access to specific...

8.7CVSS6AI score0.00226EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/06 12:0 a.m.4 views

CVE-2026-38979

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

5.4CVSS5.9AI score0.00159EPSS
SaveExploits0References4
Fedora
Fedora
added 2026/07/05 1:10 a.m.15 views

[SECURITY] Fedora 44 Update: nextcloud-33.0.6-1.fc44

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

8.7CVSS7.1AI score0.01041EPSS
SaveExploits8
Rows per page
Query Builder