CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

65 matches found

Snyk•added 2026/05/24 8:47 p.m.•13 views

XML External Entity (XXE) Injection

Overview tpwd/kesearch is a search extension for TYPO3, including faceting search functions. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the additionaltables configuration of the page and ttcontent indexers that accept arbitrary table and field names....

5.9CVSS6AI score0.00318EPSS

SaveExploits0References2

OSV•added 2026/05/19 12:31 p.m.•10 views

GHSA-C72X-MC2P-WV7X TYPO3 ke_search path traversal due to lack of normalization on config directory from file indexer

In TYPO3 faceted fulltext search kesearch, the file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences. This has been patche...

5.9CVSS5.9AI score0.00404EPSS

SaveExploits0References4

OSV•added 2026/05/19 12:31 p.m.•6 views

GHSA-FQ39-62GX-8HQX TYPO3 ke_search XML External Entity Injection

In TYPO3 faceted fulltext search kesearch, the OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being...

5.9CVSS5.7AI score0.00302EPSS

SaveExploits0References4

CVE•added 2026/05/19 9:24 a.m.•30 views

CVE-2026-46724

CVE-2026-46724 affects the Typo3 extension Faceted Search (ke_search). The file indexer does not normalize the configured directory path, allowing a backend user with permission to edit indexer configurations to index documents from arbitrary server file-system locations via path traversal. CVSS ...

5.9CVSS5.9AI score0.00404EPSS

SaveExploits0References1

OSV•added 2026/05/19 9:23 a.m.•6 views

CVE-2026-46723 Information Disclosure in extension "Faceted Search" (ke_search)

The additionaltables configuration of the page and ttcontent indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index...

5.9CVSS6AI score

SaveExploits0References5

Friends Of PHP•added 2026/05/18 2:30 p.m.•16 views

TYPO3-EXT-SA-2026-011: XML External Entity Injection in extension "Faceted Search" (ke_search)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-011...

5.9CVSS5.8AI score0.00302EPSS

SaveExploits0Affected Software1

Friends Of PHP•added 2026/05/18 2:30 p.m.•12 views

TYPO3-EXT-SA-2026-011: Path Traversal in extension "Faceted Search" (ke_search)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2026-011...

5.9CVSS5.8AI score0.00318EPSS

SaveExploits0Affected Software1

Vulnrichment•added 2026/05/01 3:59 p.m.•5 views

CVE-2026-22166 GPU DDK - Write UAF in KEGLGetPoolBuffers, WebGL reachable

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared library. On certain platforms, when the process executing graphics workload has system privileges this could enable subsequent exploit on the...

5.8AI score0.00346EPSS

SaveExploits0References1

Tenable Nessus•added 2026/03/05 12:0 a.m.•6 views

Wireshark 4.6.x < 4.6.4 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.6.4. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.4 advisory. - RF4CE Profile protocol dissector crash in Wireshark 4.6.0 to 4.6.3 and 4.4.0 to 4.4.13 allows denial of...

7.8CVSS5.9AI score0.00184EPSS

SaveExploits5References30

Tenable Nessus•added 2026/03/01 12:0 a.m.•4 views

Linux Distros Unpatched Vulnerability : CVE-2026-3202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NTS-KE protocol dissector crash in Wireshark 4.6.0 to 4.6.3 allows denial of service CVE-2026-3202 Note that Nessus relies on the presence of the package as...

7.5CVSS6.6AI score0.00157EPSS

SaveExploits0References2