Lucene search
+L

38504 matches found

CVE
CVE
added 2026/08/25 3:15 p.m.16 views

CVE-2025-71346

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 (before 2.13.8), introducing a heap-based buffer under-read in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The flaw is triggered when validating against an untrusted XML Schema, or when validating untrusted documents aga...

5.6AI score0.0018EPSS
SaveExploits0
Cvelist
Cvelist
added 2026/08/25 3:15 p.m.36 views

CVE-2025-71346

...

0.0018EPSS
SaveExploits0
Debian CVE
Debian CVE
added 2026/08/25 3:15 p.m.17 views

CVE-2025-71346

Removed by vendor...

5.8AI score0.0018EPSS
SaveExploits0
OSV
OSV
added 2026/08/25 3:15 p.m.4 views

CVE-2025-71346 Nokogiri before 1.18.8 Heap Buffer Under-read via XML Schema

Nokogiri before 1.18.8 packages a vulnerable version of libxml2 before 2.13.8 that contains a heap-based buffer under-read CVE-2025-32415 in the xmlSchemaIDCFillNodeTables function in xmlschemas.c. The issue can be triggered when validating against an untrusted XML Schema, or when validating...

8.7CVSS5.8AI score
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/08/25 1:30 p.m.10 views

CVE-2026-20786

A flaw was found in the Intel NPU Driver. This vulnerability, an out-of-bounds read, could allow a local attacker with low privileges to cause a denial of service DoS. A denial of service means the system or application becomes unavailable to legitimate users. The flaw can be exploited by an...

6.9CVSS5.2AI score0.00143EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/25 9:17 a.m.11 views

CVE-2026-77137

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

7.7CVSS0.00234EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/25 9:17 a.m.9 views

CVE-2026-77127

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

6CVSS0.00255EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/25 9:00 a.m.12 views

EUVD-2026-65348

The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current databa...

6CVSS5.7AI score0.00255EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/25 9:00 a.m.41 views

CVE-2026-77137 SQL Injection in extension "Forms Export" (frp_form_answers)

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

7.7CVSS0.00234EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/25 9:00 a.m.9 views

EUVD-2026-65339

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

7.7CVSS6AI score0.00234EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/25 9:00 a.m.28 views

CVE-2026-77137

CVE-2026-77137 is a SQL injection vulnerability in the TYPO3 extension "Forms Export" (extension key: frp_form_answers ). The extension fails to properly sanitize user input before using it in a database query, allowing a low-privileged backend user to inject arbitrary SQL through a URL parameter...

7.7CVSS6AI score0.00234EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/25 9:00 a.m.10 views

EUVD-2026-65333

The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content,...

8.8CVSS5.3AI score0.00239EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/25 2:16 a.m.5 views

DEBIAN-CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

6.1CVSS6.1AI score0.00294EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/25 2:16 a.m.15 views

CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

6.8CVSS0.00294EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/08/25 1:30 a.m.7 views

CVE-2026-56706

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

6.8CVSS6.1AI score0.00294EPSS
SaveExploits0
EUVD
EUVD
added 2026/08/25 1:30 a.m.10 views

EUVD-2026-65204

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone who observes a single CSRF token e.g., via network sniffing, log files, Referrer header, or XSS to recover the session secret with a sing...

6.8CVSS6.2AI score0.00294EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.12 views

PT-2026-81820

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description Improper input validation in Cookies allows a remote attacker who has compromised the renderer process to bypass the web origin policy through a crafted HTML page. The web origin policy...

9.6CVSS6AI score0.0056EPSS
SaveExploits1References334
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.13 views

PT-2026-81615

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description A race condition in Extensions allows a remote attacker to bypass system access restrictions by using a crafted Chrome extension. A race condition occurs when the timing or order of...

9.6CVSS6AI score0.0056EPSS
SaveExploits1References334
Positive Technologies
Positive Technologies
added 2026/08/25 12:00 a.m.13 views

PT-2026-81814

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.65 Description Incorrect reference resolution in CustomTabs allows a remote attacker to bypass system access restrictions by using a crafted HTML page. Recommendations Update Google Chrome ...

9.6CVSS6AI score0.0056EPSS
SaveExploits1References334
Tenable Nessus
Tenable Nessus
added 2026/08/25 12:00 a.m.6 views

Linux Distros Unpatched Vulnerability : CVE-2026-56706

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token format rand XOR secret:rand, allowing anyone...

6.8CVSS6.2AI score0.00294EPSS
SaveExploits0References3
Rows per page
Query Builder