Lucene search
+L

60651 matches found

Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.23 views

PT-2026-50168

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.2 Description An authenticated user with workflow edit access can inject arbitrary JavaScript into the page generated by the Chat Trigger by providing a...

7.6CVSS6.1AI score0.0021EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.34 views

PT-2026-50175

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.25.7 n8n versions prior to 2.26.2 Description When @n8n/mcp-browser is operated in HTTP transport mode using the --transport http flag, the MCP endpoint allows session initialization and tool invocation requests without...

10CVSS5.9AI score0.00404EPSS
SaveExploits0References7
Tenable Nessus
Tenable Nessus
added 2026/06/16 12:0 a.m.10 views

RHEL 8 : thunderbird (RHSA-2026:26270)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:26270 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: Incorrect boundary conditions in the JavaScript...

9.8CVSS5.7AI score0.00605EPSS
SaveExploits0References40
Tenable Nessus
Tenable Nessus
added 2026/06/16 12:0 a.m.34 views

MongoDB 4.4.x < 4.4.31 / 5.0.x < 5.0.34 / 6.0.x < 6.0.29 / 7.0.x < 7.0.37 / 8.0.x < 8.0.26 / 8.2.x < 8.2.11 / 8.3.x < 8.3.4 Use-After-Free (CVE-2026-11933)

The version of MongoDB installed on the remote host is 4.4.x prior to 4.4.31, 5.0.x prior to 5.0.34, 6.0.x prior to 6.0.29, 7.0.x prior to 7.0.37, 8.0.x prior to 8.0.26, 8.2.x prior to 8.2.11, or 8.3.x prior to 8.3.4. It is, therefore, affected by a use-after-free vulnerability: - A use-after-fre...

8.8CVSS5.9AI score0.00384EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.14 views

PT-2026-49690

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 152 Thunderbird versions prior to 152 Description JIT miscompilation occurs in the JavaScript: WebAssembly component. Just-In-Time JIT compilation is a method used to improve the execution speed of programs by compili...

9.8CVSS6AI score0.00659EPSS
SaveExploits0References272
Positive Technologies
Positive Technologies
added 2026/06/16 12:0 a.m.28 views

PT-2026-49758

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12 Description Exported session HTML preserves unsafe javascript: and data: links in generated content. This allows for the execution of browser-side scripts if a trusted operator opens the exported file and...

6.1CVSS5.5AI score0.00188EPSS
SaveExploits0References5
GitLab Advisory Database
GitLab Advisory Database
added 2026/06/16 12:0 a.m.21 views

Crawl4AI: Multiple Docker API Vulnerabilities - File Write, SSRF, Auth Bypass, XSS, JS Execution

Multiple security vulnerabilities in the Crawl4AI Docker API server affecting endpoints for crawling, markdown/LLM extraction, screenshots, PDFs, webhooks, monitoring, JavaScript execution, and configuration...

9.2CVSS5.3AI score0.00476EPSS
SaveExploits0References22Affected Software1
NVD
NVD
added 2026/06/15 10:16 p.m.19 views

CVE-2026-48017

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

8.8CVSS0.00511EPSS
SaveExploits1References2
EUVD
EUVD
added 2026/06/15 8:54 p.m.15 views

EUVD-2026-37007

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

8.8CVSS5.9AI score0.00511EPSS
SaveExploits1References2
Vulnrichment
Vulnrichment
added 2026/06/15 8:19 p.m.11 views

CVE-2026-48887 WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in JS Help Desk = 3.0.9 versions...

6.5CVSS5.1AI score0.00235EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/15 8:19 p.m.19 views

CVE-2026-48887

CVE-2026-48887 affects the WordPress JS Help Desk plugin ≤ 3.0.9 with an unauthenticated Broken Access Control flaw. Documents note unauthorized access control weakness but do not provide root cause details or a stated remediation; Patchstack is cited as the source. Exploitation status is not des...

6.5CVSS5.1AI score0.00235EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/15 8:19 p.m.11 views

EUVD-2026-36861

Unauthenticated Broken Access Control in JS Help Desk = 3.0.9 versions...

6.5CVSS5.1AI score0.00235EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/06/15 8:19 p.m.37 views

CVE-2026-48886 WordPress JS Help Desk plugin <= 3.0.9 - SQL Injection vulnerability

Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...

9.3CVSS0.00283EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/15 8:19 p.m.10 views

EUVD-2026-36860

Unauthenticated SQL Injection in JS Help Desk = 3.0.9 versions...

9.3CVSS5.7AI score0.00283EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/15 8:19 p.m.28 views

CVE-2026-48886

The CVE-2026-48886 entry describes an unauthenticated SQL Injection in WordPress JS Help Desk plugin versions

9.3CVSS5.7AI score0.00283EPSS
SaveExploits0References1
OSV
OSV
added 2026/06/15 8:15 p.m.8 views

GHSA-9H5V-PFQQ-X599 UAParser.js: Unbounded `Sec-CH-UA-Model` parsing can trigger ReDoS in `withClientHints()`

Summary A regular expression denial-of-service ReDoS vulnerability has been discovered in ua-parser-js when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParserheaders.withClientHints, an attacker can cause the parser to spend excessive CPU...

5.3CVSS5.4AI score0.00445EPSS
SaveExploits1References2
vulnersOsv
vulnersOsv
added 2026/06/15 4:34 p.m.14 views

003-gas-convert (=1.0.1), 0x-hunter-core (>=1.0.0 <=1.0.1-5) +29218 more potentially affected by CVE-2026-48779 via ws (>=1.1.0 <=5.2.2)

ws NPM version =1.1.0, =1.0.0, =0.0.3, =1.1.0, =0.9.9, =1.0.0, =0.0.1, =0.11.3, =0.1.0, =1.0.2, =1.0.7 and more Source cves: CVE-2026-48779 Source advisory: SNYK:JS-WS-17344547...

7.5CVSS5.7AI score0.00782EPSS
SaveExploits1
OSV
OSV
added 2026/06/15 4:28 p.m.6 views

CVE-2026-49294 Valhalla has reflected XSS via unsanitized JSONP callback parameter

Valhalla is an open source routing engine and accompanying libraries for use with OpenStreetMap data. Versions 3.6.3 and prior are vulnerable to reflected cross-site scripting XSS due to improper neutralization of input in the JSONP callback parameter. When a request specifies a JSONP callback, t...

6.1CVSS6AI score
SaveExploits0References3
NVD
NVD
added 2026/06/15 12:16 p.m.16 views

CVE-2026-12057

When the application executes the JavaScript script embedded in the PDF within the sandbox, it fails to intercept some dangerous interfaces, which allows remote scripts to be loaded, resulting in arbitrary code execution...

8.6CVSS0.00129EPSS
SaveExploits0References1
Veracode
Veracode
added 2026/06/15 11:24 a.m.15 views

Cross-site Scripting

Nuxt is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient validation of URL schemes in the component, where attacker-controlled values supplied to the to or href props can contain javascript: or vbscript: URLs that are rendered directly into the underlying element,...

5.4CVSS5.6AI score0.00198EPSS
SaveExploits0References3Affected Software1
Rows per page
Query Builder