Lucene search
+L

61144 matches found

Packet Storm News
Packet Storm News
added 2026/03/12 12:0 a.m.43 views

Keys on Doormats: Exposed API Credentials on the Web

Application programming interfaces APIs have become a central part of the modern IT environment, allowing developers to enrich the functionality of applications and interact with third parties such as cloud and payment providers. This interaction often occurs through authentication mechanisms tha...

5.9AI score
SaveExploits0
Packet Storm News
Packet Storm News
added 2026/03/12 12:0 a.m.7 views

AEGIS: No Tool Call Left Unchecked -- a Pre-Execution Firewall and Audit Layer for AI Agents

AI agents increasingly act through external tools: they query databases, execute shell commands, read and write files, and send network requests. Yet in most current agent stacks, model-generated tool calls are handed to the execution layer with no framework-agnostic control point in between...

6AI score
SaveExploits0
Tenable Nessus
Tenable Nessus
added 2026/03/12 12:0 a.m.8 views

RHEL 8 : thunderbird (RHSA-2026:4432)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:4432 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: libvpx: Heap buffer overflow in libvpx CVE-2026-2447 firefox:...

10CVSS6.1AI score0.00604EPSS
SaveExploits2References78
RubySec
RubySec
added 2026/03/12 12:0 a.m.5 views

Trix has a Stored XSS vulnerability through serialized attributes

Impact The Trix editor, in versions prior to 2.1.17, is vulnerable to XSS attacks when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker could craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when the content ...

4.6CVSS5.6AI score0.00321EPSS
SaveExploits0References1Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/11 10:58 p.m.7 views

CVE-2026-31988

yauzl aka Yet Another Unzip Library version 3.2.0 for Node.js contains an off-by-one error in the NTFS extended timestamp extra field parser within the getLastModDate function. The while loop condition checks cursor data.length + 4 instead of cursor + 4 = data.length, allowing readUInt16LE to rea...

6.9CVSS6AI score0.00485EPSS
SaveExploits0References5Affected Software1
Snyk
Snyk
added 2026/03/11 10:40 p.m.3 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the upload of .prologue.html file when a crafted URL is accessed. An attacker can execute arbitrary JavaScript in the context of another user's session by uploading a malicious .prologue.html file and tricki...

4.4CVSS5.7AI score0.00162EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/11 10:16 p.m.10 views

CVE-2026-32117

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign / window.open with no scheme validation. An attacker with dashboard Editor privileges can set the link t...

7.6CVSS0.00265EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/03/11 10:4 p.m.10 views

CVE-2026-3926

Out of bounds read in V8 in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...

8.8CVSS5.3AI score0.00226EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/03/11 10:4 p.m.10 views

CVE-2026-3926

Out of bounds read in V8 in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Chromium security severity: Medium...

5.8AI score0.00226EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2026/03/11 10:4 p.m.49 views

CVE-2026-3926

CVE-2026-3926 refers to an out-of-bounds read in V8 used by Google Chrome, exploitable via a crafted HTML page. Affected: Chrome/Chromium prior to 146.0.7680.71. Impact described as remote memory access with potential for arbitrary behavior; CVSS indicates high impact to confidentiality, integrit...

8.8CVSS5.8AI score0.00226EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/03/11 9:31 p.m.13 views

EUVD-2026-11403

A security vulnerability has been detected in elecV2P up to 3.8.3. Affected by this issue is the function runJSFile of the file source-code/elecV2P-master/webser/wbjs.js of the component jsfile Endpoint. Such manipulation leads to code injection. The attack may be launched remotely. The exploit h...

6.5CVSS5.5AI score0.00228EPSS
SaveExploits0References6
OSV
OSV
added 2026/03/11 9:28 p.m.12 views

CVE-2026-32117 grafanacubism-panel : Stored XSS via javascript: URL in panel zoom link (Editor → Viewer)

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign / window.open with no scheme validation. An attacker with dashboard Editor privileges can set the link t...

7.6CVSS5.8AI score
SaveExploits0References4
Cvelist
Cvelist
added 2026/03/11 9:28 p.m.40 views

CVE-2026-32117 grafanacubism-panel : Stored XSS via javascript: URL in panel zoom link (Editor → Viewer)

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign / window.open with no scheme validation. An attacker with dashboard Editor privileges can set the link t...

7.6CVSS0.00265EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/11 9:28 p.m.3 views

CVE-2026-32117

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign / window.open with no scheme validation. An attacker with dashboard Editor privileges can set the link t...

7.6CVSS5.8AI score0.00265EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2026/03/11 9:28 p.m.26 views

CVE-2026-32117

The CVE concerns the grafanacubism-panel Grafana plugin. In versions

7.6CVSS5.8AI score0.00265EPSS
SaveExploits0References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/03/11 9:28 p.m.3 views

CVE-2026-32117 grafanacubism-panel : Stored XSS via javascript: URL in panel zoom link (Editor → Viewer)

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign / window.open with no scheme validation. An attacker with dashboard Editor privileges can set the link t...

7.6CVSS5.8AI score0.00265EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/03/11 9:28 p.m.11 views

EUVD-2026-11407

The grafanacubism-panel plugin allows use of cubism.js in Grafana. In 0.1.2 and earlier, the panel's zoom-link handler passes a dashboard-editor-supplied URL directly to window.location.assign / window.open with no scheme validation. An attacker with dashboard Editor privileges can set the link t...

7.6CVSS5.8AI score0.00265EPSS
SaveExploits0References2
NVD
NVD
added 2026/03/11 9:16 p.m.13 views

CVE-2026-32112

ha-mcp is a Home Assistant MCP Server. Prior to 7.0.0, the ha-mcp OAuth consent form renders user-controlled parameters via Python f-strings with no HTML escaping. An attacker who can reach the OAuth endpoint and convince the server operator to follow a crafted authorization URL could execute...

6.8CVSS0.00181EPSS
SaveExploits0References1
OSV
OSV
added 2026/03/11 9:16 p.m.12 views

PYSEC-2026-32

Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...

4.4CVSS6AI score0.00162EPSS
SaveExploits0References1
NVD
NVD
added 2026/03/11 9:16 p.m.12 views

CVE-2026-32109

Copyparty is a portable file server. Prior to 1.20.12, if an attacker has been given both read- and write-permissions to the server, they can upload a malicious file with the filename .prologue.html and then craft a link to potentially execute arbitrary JavaScript in the victim's context. Note th...

4.4CVSS0.00162EPSS
SaveExploits0References1
Rows per page
Query Builder