Lucene search
+L

64931 matches found

CVE
CVE
added 2026/07/14 7:24 p.m.74 views

CVE-2026-48038

Joi (JavaScript) vulnerability CVE-2026-48038: In versions prior to 17.13.4 and 18.2.1, validation of deeply nested user input via recursive link() schemas can trigger an unhandled RangeError when validate() runs without try/catch, potentially crashing the process. Fixed in 17.13.4 and 18.2.1. CV...

5.3CVSS6.1AI score0.00302EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/14 7:24 p.m.7 views

CVE-2026-48038 joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link schemas. When validate is called without try/catch in a reque...

5.3CVSS6.1AI score
SaveExploits0References6
Circl
Circl
added 2026/07/14 7:11 p.m.15 views

GHSA-G7MM-9VX7-JM7H

creationtimestamp| type| source ---|---|--- 2026-07-14 19:11:47+00:00| seen| https://gist.github.com/alon710/97fd87eaf3ecb37ec75f6abd3050d94a...

6.1AI score
SaveExploits0References1
Circl
Circl
added 2026/07/14 7:11 p.m.12 views

CVE-2026-50141

creationtimestamp| type| source ---|---|--- 2026-07-14 19:11:47+00:00| seen| https://gist.github.com/alon710/97fd87eaf3ecb37ec75f6abd3050d94a...

7.1CVSS6.1AI score0.00427EPSS
SaveExploits0References1
Circl
Circl
added 2026/07/14 7:1 p.m.15 views

CVE-2026-50684

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:32+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:02:29+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:13+00:00| seen|...

4.8CVSS6.1AI score0.00372EPSS
SaveExploits0References3
Circl
Circl
added 2026/07/14 7:1 p.m.13 views

CVE-2026-44800

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:08+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0231 2026-07-14 22:04:29+00:00| seen| https://www.thezdi.com/blog/2026/7/14/the-july-2026-security-update-review 2026-07-15 01:01:02+00:00| seen|...

7.8CVSS6.1AI score0.00153EPSS
SaveExploits0References3
Circl
Circl
added 2026/07/14 7:1 p.m.13 views

CVE-2026-56170

creationtimestamp| type| source ---|---|--- 2026-07-14 19:01:00+00:00| seen| https://advisories.ncsc.nl/advisory?id=NCSC-2026-0235 2026-07-14 20:34:13+00:00| seen| https://bsky.app/profile/blowdart.me/post/3mqn2jvvr2k2u 2026-07-14 20:34:27+00:00| seen|...

7.5CVSS6.1AI score0.01008EPSS
SaveExploits0References22
Debian CVE
Debian CVE
added 2026/07/14 6:35 p.m.11 views

CVE-2026-45064

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...

6.1CVSS5.3AI score0.00293EPSS
SaveExploits0
OSV
OSV
added 2026/07/14 6:35 p.m.7 views

CVE-2026-45064 Symfony: HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlSanitizer::parse passes Unicode explicit-direction BiDi formatting characters through into sanitized href and src attributes, allowing sanitized...

2.3CVSS6.1AI score
SaveExploits0References7
CVE
CVE
added 2026/07/14 6:21 p.m.59 views

CVE-2026-45753

Symfony HtmlSanitizer UrlAttributeSanitizer omits action, formaction, poster, and cite URL-valued attributes, allowing javascript: URIs to bypass sanitization and enable XSS when forms or buttons are used. Affected: Symfony components prior to versions 6.4.40, 7.4.12, and 8.0.12. Mitigation: upgr...

6.1CVSS6.1AI score0.00293EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/07/14 6:21 p.m.11 views

CVE-2026-45753 Symfony: HtmlSanitizer UrlAttributeSanitizer Omits action/formaction/poster/cite — javascript: URI Survives Sanitization (XSS)

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, UrlAttributeSanitizer::getSupportedAttributes omits URL-valued attributes including action, formaction, poster, and cite, so configurations that adm...

2.1CVSS6.1AI score
SaveExploits0References7
NVD
NVD
added 2026/07/14 6:17 p.m.11 views

CVE-2026-50469

Improper link resolution before file access 'link following' in Windows Projected File System allows an authorized attacker to elevate privileges locally...

7.8CVSS0.00271EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/14 6:17 p.m.12 views

CVE-2026-50438

Improper link resolution before file access 'link following' in Microsoft PC Manager allows an authorized attacker to elevate privileges locally...

8.8CVSS0.00277EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/14 6:17 p.m.13 views

CVE-2026-45066

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...

6.1CVSS0.00298EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/07/14 6:0 p.m.12 views

CVE-2026-5040

TP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication...

7.1CVSS6.1AI score0.00093EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/14 5:53 p.m.49 views

CVE-2026-45066

CVE-2026-45066 affects Symfony’s HtmlSanitizer: URL sanitization bypass due to UrlSanitizer::parse() following RFC 3986 while browsers use WHATWG, and because is checked against the media policy instead of the link policy. Affected versions: 6.1.0-BETA1–6.4.40, 7.4.12, and 8.0.12. Impact: off-al...

6.1CVSS6.1AI score0.00298EPSS
SaveExploits0References5Affected Software1
Debian CVE
Debian CVE
added 2026/07/14 5:53 p.m.26 views

CVE-2026-45066

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. From 6.1.0-BETA1 until 6.4.40, 7.4.12, and 8.0.12, HtmlSanitizer URL sanitization can allow off-allowlist URLs through allowLinkHosts or allowMediaHosts because UrlSanitizer::parse follows RFC 3986...

6.1CVSS5.3AI score0.00298EPSS
SaveExploits0
Circl
Circl
added 2026/07/14 5:30 p.m.9 views

CVE-2026-51821

creationtimestamp| type| source ---|---|--- 2026-07-14 17:30:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqmqbeydro2w...

9.8CVSS6.1AI score0.00527EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/14 5:17 p.m.14 views

CVE-2026-58636

Improper link resolution before file access 'link following' in Window PC Manager allows an authorized attacker to elevate privileges locally...

7.8CVSS0.00267EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/14 5:17 p.m.12 views

CVE-2026-50364

Improper link resolution before file access 'link following' in Windows Server Backup allows an authorized attacker to elevate privileges locally...

7.3CVSS0.00343EPSS
SaveExploits0References1
Rows per page
Query Builder