Lucene search
+L

36248 matches found

RedhatCVE
RedhatCVE
added 5 hours ago4 views

CVE-2026-17351

A flaw was found in pgAdmin 4. The AI Assistant's SQL query tool, designed for read-only operations, contains a vulnerability where a disagreement between its SQL validator and the PostgreSQL database parser allows for a transaction bypass. A remote attacker with low-privilege database write acce...

9.4CVSS6.5AI score0.00447EPSS
SaveExploits1References2
Nuclei
Nuclei
added 15 hours ago46 views

W&B Weave Server - Remote Arbitrary File Leak

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin. id:...

8.8CVSS8.2AI score0.04974EPSS
SaveExploits0References3
Nuclei
Nuclei
added 15 hours ago162 views

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

8.1CVSS7.4AI score0.02862EPSS
SaveExploits0References5
CVE
CVE
added yesterday14 views

CVE-2026-15248

Meta Box WordPress plugin (versions before 5.13.1) does not verify a user’s authorization to delete a supplied attachment, enabling a low-privilege role (e.g., Contributor) to permanently delete media belonging to other users via an IDOR-like action. Affected component: attachment deletion path i...

5.6AI score0.00168EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday12 views

EUVD-2026-51935

The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users...

5.6AI score0.00168EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday6 views

CVE-2026-15151

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...

5.5AI score0.00132EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday10 views

EUVD-2026-51932

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's setting...

5.5AI score0.00132EPSS
SaveExploits0References1
Fedora
Fedora
added 2 days ago10 views

[SECURITY] Fedora 43 Update: GitPython-3.1.55-1.fc43

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

5.5AI score
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2 days ago6 views

CVE-2026-67316

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

6.3CVSS5.5AI score0.00258EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2 days ago32 views

CVE-2026-67316 axios before 1.18.0 Prototype Pollution via bodyless methods

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

6.3CVSS0.00258EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2 days ago38 views

DevDojo Voyager <=1.8.0 - Cross-Site Scripting

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed. id: CVE-2024-55416 info: name: DevDojo Voyager =1.8.0 - Cross-Site Scripting author:...

3.5CVSS8.1AI score0.24095EPSS
SaveExploits1References4
CVE
CVE
added 3 days ago25 views

CVE-2026-52855

Wings (Pterodactyl server control plane) contains a vulnerability in egg configuration-file templating prior to v1.12.3: {{config.}} placeholders can reveal sensitive daemon config values ({{config.token}}, {{config.token_id}}, {{config.docker.registries}}) to a low-privilege user. The issue aris...

9.9CVSS5.5AI score0.00274EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 3 days ago8 views

CVE-2026-52855

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

9.9CVSS5.5AI score0.00274EPSS
SaveExploits0References4Affected Software1
SUSE CVE
SUSE CVE
added 4 days ago5 views

SUSE CVE-2026-17914

Side-channel information leakage in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

5.3CVSS5.5AI score0.00205EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 4 days ago5 views

SUSE CVE-2026-17939

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. Chromium security severity: Low...

4.3CVSS5.5AI score0.00155EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 4 days ago5 views

SUSE CVE-2026-17958

Inappropriate implementation in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

4.3CVSS5.5AI score0.00168EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 4 days ago5 views

SUSE CVE-2026-17966

Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

6.2CVSS5.4AI score0.00083EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 4 days ago5 views

SUSE CVE-2026-17972

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

4.3CVSS5.5AI score0.00168EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 4 days ago5 views

SUSE CVE-2026-17981

Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

4.3CVSS5.5AI score0.00119EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 4 days ago5 views

SUSE CVE-2026-17984

Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

3.3CVSS5.5AI score0.00063EPSS
SaveExploits0References3
Rows per page
Query Builder