Lucene search
+L

11608 matches found

Tenable Nessus
Tenable Nessus
•added 2026/08/10 12:00 a.m.•10 views

Photon OS 5.0: Gtk3 PHSA-2026-5.0-90-0855

An update of the gtk3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-90-0855. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

7CVSS5.2AI score0.00468EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
•added 2026/08/10 12:00 a.m.•9 views

PT-2026-69334

Name of the Vulnerable Software and Affected Versions keras-team/keras versions prior to 3.15.1 Description A denial of service DoS issue occurs when loading malicious .keras model files using the keras.models.load model function. The H5IOStore. getitem method in keras/src/saving/saving lib.py...

5.5CVSS5.8AI score0.00128EPSS
SaveExploits0References19
OSV
OSV
•added 2026/08/09 11:16 p.m.•7 views

UBUNTU-CVE-2026-12372

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

3.7CVSS6AI score0.0031EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
•added 2026/08/09 10:45 p.m.•7 views

CVE-2026-12372 Server-Side Request Forgery (SSRF) in nltk/nltk

A Server-Side Request Forgery SSRF vulnerability exists in nltk/nltk versions 3.9.4 and the current develop branch. The nltk.pathsec.validatenetworkurl function, intended to prevent SSRF by rejecting internal network addresses, fails to reject IPs in the RFC 6598 shared address space 100.64.0.0/1...

3.7CVSS5.4AI score0.0031EPSS
SaveExploits0References1
Microsoft CVE
Microsoft CVE
•added 2026/08/09 8:01 a.m.•12 views

Kata Containers: Config Path Annotation Arbitrary File Loading

...

9.6CVSS5.2AI score0.00606EPSS
SaveExploits0
OSV
OSV
•added 2026/08/07 9:17 p.m.•17 views

AZL-94682 CVE-2026-50540 affecting package kata-containers-preview 3.27.0~preview2-2

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an...

9.6CVSS6.1AI score0.00606EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2026/08/07 8:56 p.m.•12 views

CVE-2026-50540 Kata Containers: Config Path Annotation Arbitrary File Loading

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an...

9.6CVSS6AI score0.00606EPSS
SaveExploits0References2
CVE
CVE
•added 2026/08/07 8:56 p.m.•111 views

CVE-2026-50540

Kata Containers CVE-2026-50540 affects kata-runtime prior to 4.0.0, where an unvalidated io.katacontainers.config_path pod annotation lets a pod user load a host TOML file. This enables selecting attacker-controlled binaries (hypervisor or virtio-fs daemon) on the host, leading to root code execu...

9.6CVSS6AI score0.00606EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/08/07 8:56 p.m.•101 views

CVE-2026-50540 Kata Containers: Config Path Annotation Arbitrary File Loading

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines VMs that perform like containers. Prior to version 4.0.0, kata-runtime is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an...

9.6CVSS0.00606EPSS
SaveExploits0References2
The Hacker News
The Hacker News
•added 2026/08/07 6:48 p.m.•42 views

Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. "These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but...

6.8AI score
SaveExploits0
EUVD
EUVD
•added 2026/08/06 2:48 p.m.•26 views

EUVD-2026-54080

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

2.3CVSS5.5AI score0.00512EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
•added 2026/08/06 12:32 p.m.•15 views

pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading

A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library,...

8.8CVSS6.2AI score0.00185EPSS
SaveExploits0References4
NVD
NVD
•added 2026/08/05 8:17 p.m.•13 views

CVE-2026-70616

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

7.1CVSS0.00336EPSS
SaveExploits0References2
EUVD
EUVD
•added 2026/08/05 7:37 p.m.•15 views

EUVD-2026-53598

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

7.1CVSS5.5AI score0.00336EPSS
SaveExploits0References2
OSV
OSV
•added 2026/08/05 7:37 p.m.•20 views

CVE-2026-70616 boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

7.1CVSS5.5AI score
SaveExploits0References5
CVE
CVE
•added 2026/08/05 7:37 p.m.•65 views

CVE-2026-70616

CVE-2026-70616 affects boringproxy 0.10.0. The vulnerability allows an authenticated user to cause resource exhaustion on the server by sending requests to GET /loading with attacker-supplied id values. The handler performs no map-lookup validation and blocks on a nil channel, with no timeout, ca...

7.1CVSS5.5AI score0.00336EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/08/05 7:37 p.m.•42 views

CVE-2026-70616 boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

7.1CVSS0.00336EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
•added 2026/08/05 7:37 p.m.•12 views

CVE-2026-70616 boringproxy 0.10.0 Resource Exhaustion DoS via GET /loading endpoint

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

7.1CVSS5.5AI score0.00336EPSS
SaveExploits0References2
attackerkb
attackerkb
•added 2026/08/05 7:37 p.m.•19 views

CVE-2026-70616

boringproxy through 0.10.0 contains a resource exhaustion vulnerability that allows any authenticated user to permanently exhaust server file descriptors, goroutines, and memory by sending requests to the GET /loading endpoint with attacker-supplied id query parameter values. Because the handler...

7.1CVSS5.5AI score0.00336EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
•added 2026/08/05 4:17 p.m.•14 views

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

8.1CVSS6.2AI score0.00999EPSS
SaveExploits2References7
Rows per page
Query Builder