Lucene search
+L

202897 matches found

Cvelist
Cvelist
added 2026/08/07 4:41 p.m.33 views

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

6.3CVSS0.00413EPSS
SaveExploits1References7
ATTACKERKB
ATTACKERKB
added 2026/08/07 4:41 p.m.11 views

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

6.3CVSS5.2AI score0.00413EPSS
SaveExploits1References8Affected Software1
OSV
OSV
added 2026/08/07 4:41 p.m.29 views

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

6.3CVSS5.3AI score
SaveExploits0References9
Vulnrichment
Vulnrichment
added 2026/08/07 4:41 p.m.11 views

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

6.3CVSS5.2AI score0.00413EPSS
SaveExploits1References7
EUVD
EUVD
added 2026/08/07 4:07 p.m.16 views

EUVD-2026-54518

Nexus Repository 3 was found to be vulnerable to stored cross-site scripting XSS. A user with the nexus:blobstores:create or nexus:blobstores:update permission could set a blob store name containing malicious script content, which would later execute in the browser of another user viewing system...

6.3CVSS5AI score0.00239EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/07 4:00 p.m.13 views

EUVD-2026-54511

A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=saveupload. Such manipulation of the argument img/imgName leads to unrestricted upload. The attack may be launched remotely. The exploit has be...

6.5CVSS6.2AI score0.00282EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment
added 2026/08/07 9:46 a.m.12 views

CVE-2026-54210 TeamDavid: Buffer Overflow in file names of file upload functionalities

Tobit Laboratories AG TeamDavid's Webbox application implements various file upload functionalities that are vulnerable to a buffer overflow condition. By specifying an excessively long filename in a file upload request, an unauthenticated attacker can trigger a crash of the server, resulting in ...

9.5CVSS6.2AI score0.00466EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 2026/08/07 12:00 a.m.15 views

MiracleLinux 9 : vim-8.2.2637-26.el9_8.10.ML.1 (AXSA:2026-1480:21)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1480:21 advisory. vim: command injection when decompressing .tgz archives CVE-2026-46483 vim: Vim: Arbitrary Code Execution via crafted directory names CVE-2026-47162...

8.8CVSS7.8AI score0.00552EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/06 10:18 p.m.9 views

UBUNTU-CVE-2026-64655

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

2.1CVSS5.3AI score0.00333EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/06 10:17 p.m.17 views

CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

5.3CVSS0.00609EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/06 10:17 p.m.10 views

UBUNTU-CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

5.3CVSS5.5AI score0.00609EPSS
SaveExploits0References8
OSV
OSV
added 2026/08/06 9:09 p.m.13 views

GHSA-PMHH-3W7G-XQP8 jsoup: Cleaner may expose markup with custom raw-text elements

When a custom Safelist permits certain raw-text elements, jsoup may incorrectly sanitize malformed HTML containing a tag name that ends in a control character. The tag may acquire the parsing behavior of a different element, causing content that should remain text to be emitted as active markup...

4.7CVSS5.5AI score0.0019EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/08/06 7:55 p.m.12 views

CVE-2026-50159 Mermaid allows CSS injection applying to sibling elements of the diagram

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

5.3CVSS5.4AI score0.00609EPSS
SaveExploits0References6
Debian CVE
Debian CVE
added 2026/08/06 7:55 p.m.11 views

CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

5.3CVSS5.5AI score0.00609EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 2026/08/06 7:55 p.m.10 views

CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

5.3CVSS5.6AI score0.00609EPSS
SaveExploits0References7Affected Software1
EUVD
EUVD
added 2026/08/06 7:55 p.m.14 views

EUVD-2026-54243

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

5.3CVSS5.6AI score0.00609EPSS
SaveExploits0References6
OSV
OSV
added 2026/08/06 7:55 p.m.18 views

CVE-2026-50159 Mermaid allows CSS injection applying to sibling elements of the diagram

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

5.3CVSS5.5AI score
SaveExploits0References8
Cvelist
Cvelist
added 2026/08/06 7:55 p.m.35 views

CVE-2026-50159 Mermaid allows CSS injection applying to sibling elements of the diagram

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

5.3CVSS0.00609EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/08/06 6:41 p.m.35 views

CVE-2026-64655 GitHub CLI: Attestation Verification Bypass via Unescaped Regex Metacharacters in SAN Matching

GitHub CLI gh is GitHub’s official command line tool. Prior to 2.97.0, gh attestation verify builds the certificate Subject Alternative Name matcher from the --signer-repo and --signer-workflow flag values without escaping regex metacharacters, so a user-supplied repository or workflow name is...

2.1CVSS0.00333EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/08/06 5:05 p.m.22 views

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

9.6CVSS5.5AI score0.00692EPSS
SaveExploits0References8
Rows per page
Query Builder