Lucene search
+L

192 matches found

CVE
CVE
added 2026/09/12 12:08 p.m.10 views

CVE-2026-90543

WWBN AVideo (with the Live plugin enabled) contains a missing authentication vulnerability in plugin/Live/socketMessageLiveOwner.json.php. The script resolves the stream owner via LiveTransmition::keyExists and checks that the owner is an administrator, but performs no User::isLogged() check and ...

6.9CVSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/12 9:54 a.m.3 views

VanCleef

VanCleef Rancher 2.1.4 웹 파라미터 변조 CVE-2019-11881 root@kitploit: ./vancleef.rb rancherip rancherport messagetodisplay double-quoted Example: ./vancleef.rb 192.168.0.1 8080 "Rancher is outdated. Please update following the instructions at http://192.168.0.25/rancher-updating" MITRE CVE 공지...

4.7CVSS6.2AI score0.02263EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/11 10:21 p.m.8 views

CVE-2022-25257

CVE-2022-25257 SAS Logon 9.4 では、警告メッセージのインジェクションが可能です。 発見日: 2022年2月15日 影響を受けるバージョン: 9.4 POC エクスプロイト: SASLogon/csrf には "target" というパラメータが 1 つあります。 このパラメータは、ユーザーが開こうとしていた URL の警告メッセージに影響を与えます ただし、発信元が不明なため、システムはそれをブロックします。 このパラメータを変更することで、長い偽の文章を書き込み、それに気づかないユーザーに影響を与えることができます。 ペイロードの例:...

5.9AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/09 11:35 a.m.7 views

Log4j_CVE-2021-44228

Уязвимость Log4j, также известная как "Log4Shell" или "CVE-2021-44228", является критической ошибкой безопасности в библиотеке Apache Log4j. Log4j — это широко используемый фреймворк для журналирования на Java, который позволяет разработчикам записывать сообщения из приложений в различные места...

10CVSS7.2AI score0.99999EPSS
SaveExploits368References1
Kitploit
Kitploit
added 2026/09/09 9:59 a.m.7 views

CVE-2018-10933

Воссоздание и улучшение сценария CVE-2018-10933 Объяснение root@kitploit: Это учебный материал по CVE-2018-10933, который представляет собой обход аутентификации libSSH! Версии libssh 0.6 и выше содержат уязвимость обхода аутентификации в серверном коде. Представляя серверу сообщение...

9.1CVSS7.6AI score0.91789EPSS
SaveExploits13
NVD
NVD
added 2026/09/04 5:16 p.m.5 views

CVE-2026-17627

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...

7.1CVSS0.00199EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/04 4:30 p.m.6 views

EUVD-2026-71466

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization...

4.9CVSS5.3AI score0.00199EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/04 3:17 p.m.7 views

CVE-2026-85667

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...

9.3CVSS0.00383EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/09/04 2:32 p.m.32 views

CVE-2026-85667 xiaobei through 5.5.2 Unauthenticated Webhook Message Injection

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...

9.3CVSS0.00383EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/04 2:32 p.m.5 views

EUVD-2026-71123

xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to inject arbitrary messages into the agent pipeline. Attackers can publish malicious messages via the /webhookworktool handler and exploit unvalidated media UR...

9.3CVSS5.5AI score0.00383EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/04 2:32 p.m.13 views

CVE-2026-85667

xiaobei through 5.5.2 fails to implement authentication or signature validation on its webhook endpoints, specifically the /webhook_worktool handler. This allows unauthenticated network attackers to inject arbitrary messages into the agent pipeline and exploit unvalidated media URL fetching to pe...

9.3CVSS5.5AI score0.00383EPSS
SaveExploits0References4
IBM Security Bulletins
IBM Security Bulletins
added 2026/09/03 7:13 p.m.11 views

Security Bulletin: Langflow is affected by improper authorization due to missing access control on the voice-mode WebSocket endpoint

Summary Langflow provides a voice-mode feature through a WebSocket API endpoint that accepts a flow identifier as a URL path parameter and uses it to retrieve the target flow description and persist conversation messages against that flow. The endpoint authenticates the connecting user's identity...

7.1CVSS6AI score0.00199EPSS
SaveExploits0Affected Software1
RedHat Linux
RedHat Linux
added 2026/08/31 4:11 a.m.10 views

net/textproto: golang: Golang net/textproto: Misleading error messages via input injection

A flaw was found in the net/textproto package in Golang. When functions in this package return errors, they include their input as part of the error message. An attacker could exploit this by injecting misleading content into these error messages, which are then printed or logged. This could lead...

5.3CVSS7.2AI score0.0037EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/08/29 12:31 a.m.12 views

EUVD-2026-67955

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

8.2CVSS5.9AI score0.00309EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/28 10:16 p.m.4 views

CVE-2026-18904

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

8.2CVSS5.9AI score
SaveExploits0References1
NVD
NVD
added 2026/08/28 10:16 p.m.13 views

CVE-2026-18904

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers...

8.2CVSS0.00309EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/28 8:52 p.m.32 views

CVE-2026-18904

IBM Langflow OSS versions 1.0.0 through 1.11.1 are affected by an authorization bypass (CWE-639) stemming from a namespace collision between user identifiers . The public flow metadata endpoint exposes the owner's user_id, which an unauthenticated attacker can reuse as a client_id to collide with...

8.2CVSS5.9AI score0.00309EPSS
SaveExploits0References1Affected Software1
NVD
NVD
added 2026/08/28 8:20 p.m.10 views

CVE-2026-82284

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...

8.6CVSS0.00238EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/28 8:20 p.m.12 views

CVE-2026-82271

R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users'...

7.1CVSS0.0022EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/28 6:47 p.m.36 views

CVE-2026-82020 Hermes Agent 0.16.0 < 0.17.0 Credential Store Overwrite via File-Write Tool

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages...

7.6CVSS0.00329EPSS
SaveExploits0References5
Rows per page
Query Builder