Lucene search
+L

11946 matches found

RedhatCVE
RedhatCVE
added 2026/01/09 9:16 a.m.22 views

CVE-2025-40695

Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'remark', 'status' and 'takeaction' parameters via POST at the endpoint '/ofrs/admin/request-details.php'. This...

5.4CVSS5.5AI score0.00193EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 9:15 a.m.11 views

CVE-2022-23123

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getdirparams method. The issue results from the lack of proper validation of...

9.8CVSS6.4AI score0.03848EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 9:0 a.m.14 views

CVE-2023-29008

The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a +server.js file, containing endpoint handlers for different HTTP methods. SvelteKit provides out-of-the-box cross-site request forgery CSRF protection to its users. The protection is...

8.8CVSS7.5AI score0.00373EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/01/09 8:55 a.m.12 views

CVE-2018-21268

The traceroute aka node-traceroute package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec method, which is considered to be not entirely safe, is used. In particular, an OS command can be placed after a newline character...

10CVSS7.4AI score0.04321EPSS
SaveExploits2References1
RedhatCVE
RedhatCVE
added 2026/01/09 8:54 a.m.11 views

CVE-2021-41120

sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to predict. The problem is that the Credit card form has...

7.5CVSS6.4AI score0.01542EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/09 8:37 a.m.12 views

CVE-2019-20520

ERPNext 11.1.47 allows reflected XSS via the PATHINFO to the api/method/ URI...

7.4CVSS5.7AI score0.00786EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2026/01/09 6:43 a.m.34 views

CVE-2025-70974

Fastjson before 1.2.48 mishandles autoType because, when an @type key is in a JSON document, and the value of that key is the name of a Java class, there may be calls to certain public methods of that class. Depending on the behavior of those methods, there may be JNDI injection with an...

10CVSS0.0069EPSS
SaveExploits0References7
Packet Storm News
Packet Storm News
added 2026/01/09 12:0 a.m.13 views

The Echo Chamber Multi-Turn LLM Jailbreak

The availability of Large Language Models LLMs has led to a new generation of powerful chatbots that can be developed at relatively low cost. As companies deploy these tools, security challenges need to be addressed to prevent financial loss and reputational damage. A key security challenge is...

7.2AI score
SaveExploits0
RedHat Linux
RedHat Linux
added 2026/01/08 4:57 p.m.9 views

undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows...

7.5CVSS5.8AI score0.01256EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2026/01/08 4:53 p.m.8 views

undertow: OutOfMemory when parsing form data encoding with application/x-www-form-urlencoded

A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParseStreamSourceChannel method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows...

7.5CVSS5.8AI score0.01256EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/01/08 12:0 a.m.5 views

CVE-2025-67089

A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the plugins.installpackage RPC method, which fails to properly sanitize user input in package names. Authenticated attackers can exploit this to execute arbitrary commands wi...

7.8AI score0.01426EPSS
SaveExploits1References2
OSV
OSV
added 2026/01/07 9:50 p.m.6 views

CVE-2026-21690 iccDEV has Type Confusion in CIccTagXmlTagData::ToXml()

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium ICC color management profiles. Versions prior to 2.3.1.2 have a Type Confusion vulnerability in CIccTagXmlTagData::ToXml. This vulnerability affects users o...

6.3CVSS6.7AI score0.0019EPSS
SaveExploits1References5
EUVD
EUVD
added 2026/01/07 9:25 p.m.9 views

EUVD-2026-1392

iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of International Color Consortium ICC color management profiles. Versions prior to 2.3.1.2 have Undefined Behavior in CIccTagLutAtoB::Validate. This vulnerability affects users of the iccDEV...

7.1CVSS6.3AI score0.00243EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/01/07 7:28 p.m.6 views

Incorrect Type Conversion or Cast

Overview loggingredactor is a Redact data in logs based on regex filters and keys Affected versions of this package are vulnerable to Incorrect Type Conversion or Cast via the RedactingFilter.redact method which converts all datatypes to string. An attacker can cause type errors and disrupt...

5.3CVSS6.8AI score0.00228EPSS
SaveExploits1References2
GithubExploit
GithubExploit
added 2026/01/07 2:40 p.m.430 views

Exploit for Improper Initialization in Linux Linux_Kernel

CVE-2022-0847 A simple reproduction of CVE-2022-0847 Orig...

7.8CVSS7AI score0.88606EPSS
SaveExploits100
RedhatCVE
RedhatCVE
added 2026/01/07 9:53 a.m.14 views

CVE-2013-6852

Cross-site request forgery CSRF vulnerability in html/json.html on HP 2620 switches allows remote attackers to hijack the authentication of administrators for requests that change an administrative password via the setPassword method...

6.8CVSS7.7AI score0.01464EPSS
SaveExploits2References1
RedhatCVE
RedhatCVE
added 2026/01/07 9:39 a.m.7 views

CVE-1999-0877

Internet Explorer 5 allows remote attackers to read files via an ExecCommand method called on an IFRAME...

4.3CVSS7AI score0.17672EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/01/07 9:38 a.m.11 views

CVE-1999-0547

An SSH server allows authentication through the .rhosts file...

10CVSS7.2AI score0.02099EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/01/07 9:34 a.m.6 views

CVE-2019-7537

An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collectyaml method in configobj.py. It can execute arbitrary Python commands, resulting in command execution...

9.8CVSS7.5AI score0.03442EPSS
SaveExploits1References1
RedhatCVE
RedhatCVE
added 2026/01/07 9:31 a.m.23 views

CVE-2019-16371

LogMeIn LastPass before 4.33.0 allows attackers to construct a crafted web site that captures the credentials for a victim's account on a previously visited web site, because dopopupregister can be bypassed via clickjacking...

8.2CVSS6.8AI score0.0118EPSS
SaveExploits1References1
Rows per page
Query Builder