Lucene search
+L

56378 matches found

RedhatCVE
RedhatCVE
added 2 days ago9 views

CVE-2026-64339

A flaw was found in the Linux kernel's USB subsystem, specifically within the usbio module. A malicious or malfunctioning Universal Serial Bus USB device can exploit this vulnerability by providing crafted input during a bulk IN transfer. This can lead to an out-of-bounds read, allowing the devic...

5.5CVSS5.3AI score0.00198EPSS
SaveExploits0References4
Nuclei
Nuclei
added 3 days ago218 views

Honeywell PM43 Printers - Command Injection

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM Printer web page modules allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 e.g. P10.19.050006 id:...

9.9CVSS7.7AI score0.33094EPSS
SaveExploits3References5
NVD
NVD
added 4 days ago8 views

CVE-2026-9044

An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper...

8.5CVSS0.00973EPSS
SaveExploits0References3
NVD
NVD
added 4 days ago10 views

CVE-2026-68770

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

9.8CVSS0.00521EPSS
SaveExploits0References5
NVD
NVD
added 4 days ago9 views

CVE-2026-50986

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

8.8CVSS0.00145EPSS
SaveExploits0References2
Cvelist
Cvelist
added 4 days ago37 views

CVE-2026-68770 sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

9.8CVSS0.00521EPSS
SaveExploits0References5
EUVD
EUVD
added 4 days ago11 views

EUVD-2026-51650

sentence-transformers contains a security control bypass vulnerability that allows attackers to achieve arbitrary code execution by exploiting a logic flaw in the importmoduleclass helper within sentencetransformers/util/misc.py, where the guard condition includes an 'or...

9.8CVSS6.4AI score0.00521EPSS
SaveExploits0References5
CVE
CVE
added 4 days ago84 views

CVE-2026-53510

Savon (Ruby SOAP client) contains a vulnerability in Savon::Model.all_operations, which interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing arbitrary code execution in the application process. Affected versions are 0.9.8 through 2.17.1; the issue...

8.1CVSS6AI score0.00396EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 4 days ago7 views

CVE-2026-53510

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

8.1CVSS6AI score0.00396EPSS
SaveExploits0References4Affected Software1
Vulnrichment
Vulnrichment
added 4 days ago7 views

CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

8.1CVSS6AI score0.00396EPSS
SaveExploits0References3
OSV
OSV
added 4 days ago5 views

CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

8.1CVSS6AI score
SaveExploits0References5
Cvelist
Cvelist
added 4 days ago36 views

CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

3.1CVSS0.00182EPSS
SaveExploits0References3
OSV
OSV
added 4 days ago5 views

CVE-2026-57232 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module

Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs from FeedReaderController::getResponse to feedIo-read without scheme or private-address validation, allowing a backend user with module-edit...

3.1CVSS5.5AI score
SaveExploits0References5
Github Security Blog
Github Security Blog
added 4 days ago8 views

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

Summary nltk.pathsec provides an SSRF filter that NLTK documents as a security control, blocking loopback, private, link-local, and multicast ranges including obfuscated forms and recommending strict ENFORCE mode for security-sensitive environments. The filter is bypassable by DNS rebinding:...

5.7AI score
SaveExploits0References2Affected Software1
Positive Technologies
Positive Technologies
added 4 days ago14 views

PT-2026-66857

Name of the Vulnerable Software and Affected Versions totadministrativemandate versions prior to 1.8.1 Description The payment validation controller in the PrestaShop module lacks a CSRF token, making it susceptible to Cross Site Request Forgery CSRF. This allows an attacker to confirm an order...

5.5AI score0.00145EPSS
SaveExploits0References4
EUVD
EUVD
added 4 days ago10 views

EUVD-2026-51644

PrestaShop module, totadministrativemandate 1.8.1 is vulnerable to Cross Site Request Forgery CSRF. The payment validation controller has no CSRF token. An attacker can confirm an order in an awaiting status by hijacking a link...

5.4AI score0.00145EPSS
SaveExploits0References2
CVE
CVE
added 4 days ago11 views

CVE-2026-50986

CVE-2026-50986 affects the PrestaShop module totadministrativemandate prior to 1.8.1. The root cause is a missing CSRF token in the payment validation controller, enabling CSRF exploitation to confirm an order in the awaiting state by hijacking a link. The CVSS vector indicates high impact to con...

8.8CVSS5.4AI score0.00145EPSS
SaveExploits0References2
NVD
NVD
added 5 days ago9 views

CVE-2026-18064

An incomplete fix for CVE-2026-15352 in the NASA core Flight System cFS Health and Safety HS application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to...

8.2CVSS0.00339EPSS
SaveExploits0References3
NVD
NVD
added 5 days ago11 views

CVE-2026-51290

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

0.00347EPSS
SaveExploits0
SUSE CVE
SUSE CVE
added 5 days ago5 views

SUSE CVE-2026-47078

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:checkdirlevel/2, which tracks directory depth as a running integer...

4.8CVSS5.5AI score0.00152EPSS
SaveExploits0References3
Rows per page
Query Builder