Lucene search
+L

6011 matches found

OSV
OSV
•added 2026/09/01 3:17 p.m.•10 views

UBUNTU-CVE-2026-74994

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

6CVSS5.5AI score0.00633EPSS
SaveExploits0References8
OSV
OSV
•added 2026/09/01 2:45 p.m.•7 views

CVE-2026-74994 inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

6CVSS5.9AI score0.00633EPSS
SaveExploits0References10
EUVD
EUVD
•added 2026/09/01 2:45 p.m.•10 views

EUVD-2026-69240

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

6CVSS5.9AI score0.00633EPSS
SaveExploits0References6
Vulnrichment
Vulnrichment
•added 2026/09/01 2:45 p.m.•14 views

CVE-2026-74994 inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

6CVSS5.9AI score0.00633EPSS
SaveExploits0References6
CVE
CVE
•added 2026/09/01 2:45 p.m.•40 views

CVE-2026-74994

The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace . This means a user authorized for one protected directory is also acc...

6CVSS5.9AI score0.00633EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/01 2:45 p.m.•39 views

CVE-2026-74994 inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

6CVSS0.00633EPSS
SaveExploits0References6
OSV
OSV
•added 2026/09/01 2:45 p.m.•10 views

EEF-CVE-2026-74994 inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth

Summary The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid f...

6CVSS5.7AI score0.00633EPSS
SaveExploits0References5
Debian CVE
Debian CVE
•added 2026/09/01 2:45 p.m.•12 views

CVE-2026-74994

The modauth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

6CVSS5.9AI score0.00633EPSS
SaveExploits0
CVE
CVE
•added 2026/09/01 2:44 p.m.•43 views

CVE-2026-83615

xmldom , a pure JavaScript XML DOM parser, has a quadratic memory consumption flaw in appendElement within lib/sax.js. The function clones the entire namespace map (currentNSMap) via _copy for every nested element that declares a new namespace prefix, keeping all ancestor maps alive on the parse ...

8.7CVSS5.9AI score0.0059EPSS
SaveExploits0References7
Vulnrichment
Vulnrichment
•added 2026/09/01 2:44 p.m.•10 views

CVE-2026-83615 xmldom: Quadratic-memory consumption

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses copy to clone the complete currentNSMap for each nested element...

8.7CVSS5.2AI score0.0059EPSS
SaveExploits0References7
Debian CVE
Debian CVE
•added 2026/09/01 2:44 p.m.•12 views

CVE-2026-83615

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses copy to clone the complete currentNSMap for each nested element...

8.7CVSS5.9AI score0.0059EPSS
SaveExploits0
Cvelist
Cvelist
•added 2026/09/01 2:44 p.m.•35 views

CVE-2026-83615 xmldom: Quadratic-memory consumption

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses copy to clone the complete currentNSMap for each nested element...

8.7CVSS0.0059EPSS
SaveExploits0References7
OSV
OSV
•added 2026/09/01 2:44 p.m.•7 views

CVE-2026-83615 xmldom: Quadratic-memory consumption

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses copy to clone the complete currentNSMap for each nested element...

8.7CVSS5.9AI score
SaveExploits0References9
RedHat Linux
RedHat Linux
•added 2026/09/01 8:34 a.m.•10 views

kernel: ip6_gre: Use cached t->net in ip6erspan_changelink()

A flaw was found in the Linux kernel's ip6gre module. An unprivileged user could exploit this vulnerability by migrating a network device, causing the ip6erspanchangelink function to incorrectly handle network namespace references. This error leads to a use-after-free condition when the original...

7.8CVSS5.8AI score0.00171EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
•added 2026/09/01 12:00 a.m.•15 views

PT-2026-84268

The mod auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace. A user added to one protected directory is accepted as valid for all...

6CVSS5.9AI score0.00633EPSS
SaveExploits0References7
Tenable Nessus
Tenable Nessus
•added 2026/09/01 12:00 a.m.•13 views

Linux Distros Unpatched Vulnerability : CVE-2026-83615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

8.7CVSS7.1AI score0.0059EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
•added 2026/09/01 12:00 a.m.•13 views

PT-2026-84160

Kyverno before 1.16.2 contains a server-side request forgery SSRF vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal...

7.7CVSS6AI score0.00357EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
•added 2026/09/01 12:00 a.m.•23 views

PT-2026-84508

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9 Description The removeScripts plugin known as removeScriptElement in versions 2 and 3 incompletely filters executable links within...

8.2CVSS5.9AI score0.00525EPSS
SaveExploits0References17
NVD
NVD
•added 2026/08/31 7:16 p.m.•15 views

CVE-2026-53552

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

9.6CVSS0.0035EPSS
SaveExploits0References1
OSV
OSV
•added 2026/08/31 6:46 p.m.•16 views

CVE-2026-53552 Goploy: Cross-namespace IDOR and RCE via body-supplied row id in project and project_file handlers

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

9.6CVSS5.9AI score
SaveExploits0References3
Rows per page
Query Builder