Lucene search
+L

45373 matches found

NVD
NVD
added 5 hours ago7 views

CVE-2026-14804

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

9.1CVSS
SaveExploits0References1
CVE
CVE
added 6 hours ago11 views

CVE-2026-14804

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

9.1CVSS5.4AI score
SaveExploits0References1
Cvelist
Cvelist
added 6 hours ago8 views

CVE-2026-14804 Hardcoded Cryptographic Key in Bilin Software's HUMANIST Digital Human Resources

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

9.1CVSS
SaveExploits0References1
EUVD
EUVD
added 6 hours ago6 views

EUVD-2026-52651

Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

9.1CVSS5.4AI score
SaveExploits0References1
NVD
NVD
added 7 hours ago7 views

CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

8.5CVSS
SaveExploits0References1
NVD
NVD
added 7 hours ago6 views

CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 7 hours ago6 views

CVE-2026-18759

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

8.5CVSS5.6AI score
SaveExploits0References2Affected Software2
EUVD
EUVD
added 7 hours ago8 views

EUVD-2026-52640

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

8.5CVSS5.6AI score
SaveExploits0References1
CVE
CVE
added 8 hours ago7 views

CVE-2026-18754

CVE-2026-18754 affects GV-AS1620 Controller Firmware (GV-Cloud). The firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. The exposed private key can compromise HTTPS confidentiality and integrity, enabling traffic decryption and potential ser...

9.1CVSS5.5AI score
SaveExploits0References1
EUVD
EUVD
added 8 hours ago6 views

EUVD-2026-52638

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 8 hours ago2 views

CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 8 hours ago6 views

CVE-2026-18753 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-ASManager)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS
SaveExploits0References1
CVE
CVE
added 8 hours ago8 views

CVE-2026-18753

CVE-2026-18753 concerns GV-AS1620 Controller Firmware (GV-ASManager). The firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. Exposure of this private key allows attackers to decrypt HTTPS traffic and spoof the server, compromising confidenti...

9.1CVSS5.5AI score
SaveExploits0References1
EUVD
EUVD
added 8 hours ago5 views

EUVD-2026-52637

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score
SaveExploits0References1
CVE
CVE
added 9 hours ago8 views

CVE-2026-11366

The CVE concerns the WordPress plugin MonsterInsights prior to version 11.1.0. It fails to correctly validate the signature on an unauthenticated AJAX action when not connected to Google Analytics, leaving an empty HMAC signing key. This enables unauthenticated attackers to forge a valid signatur...

5.5AI score
SaveExploits0References1
Cvelist
Cvelist
added 9 hours ago6 views

CVE-2026-11366 MonsterInsights < 11.1.0 - Unauthenticated Measurement Protocol Secret Update via Empty-Key HMAC Bypass

The MonsterInsights WordPress plugin before 11.1.0 does not correctly validate the signature on one of its unauthenticated AJAX actions: when the MonsterInsights WordPress plugin before 11.1.0 is not connected to Google Analytics the HMAC signing key is empty, which lets unauthenticated attackers...

SaveExploits0References1
Nuclei
Nuclei
added 12 hours ago175 views

Apache Superset < 4.0.2 - SQL Injection

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...

9.8CVSS5.8AI score0.04433EPSS
SaveExploits2References4
Nuclei
Nuclei
added 12 hours ago41 views

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. id: CVE-2026-1368 info: name: Video Conferencing with Zoom API 4.6.6 -...

7.5CVSS5.5AI score0.01211EPSS
SaveExploits0References3
Nuclei
Nuclei
added 12 hours ago27 views

SmartSearchWP < 2.4.6 - OpenAI Key Disclosure

The plugin does not have proper authorization in one of its REST endpoint, allowing unauthenticated users to retrieve the encoded key and then decode it, thereby leaking the OpenAI API key. id: CVE-2024-6845 info: name: SmartSearchWP 2.4.6 - OpenAI Key Disclosure author: s4e-io severity: medium...

5.3CVSS5.5AI score0.01113EPSS
SaveExploits1References2
Nuclei
Nuclei
added 12 hours ago6 views

Tautulli <= 2.16.1 - Path Traversal

Tautulli is a monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images endpoint joins user-controlled path segments onto the newsletter image directory without containment validation. Authentication is not required for this endpoint, allowing...

8.7CVSS5.6AI score0.01587EPSS
SaveExploits1References2
Rows per page
Query Builder