Lucene search
+L

138457 matches found

OSV
OSV
added 2026/07/14 6:09 p.m.10 views

GHSA-QW5R-PPCG-F8RJ MKP: Unbounded Pod Log Read via Attacker-Controlled `limitBytes`/`tailLines` Causes Memory Exhaustion

Unbounded Pod Log Read via Attacker-Controlled limitBytes/tailLines Causes Memory Exhaustion Summary The MKP Model Context Protocol for Kubernetes server exposes a getresource MCP tool that proxies Kubernetes pod log requests. User-supplied limitBytes and tailLines parameters are parsed as...

7.5CVSS6.2AI score
SaveExploits0References2
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 5:51 p.m.12 views

Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is affected by a HTTP Request Smuggling Vulnerability in Netty (CVE-2026-33870)

Summary Netty is used by IBM DevOps Deploy / IBM UrbanCode Deploy UCD as part of the Server/Agent/Relay communication system. CVE-2026-33870. Vulnerability Details CVEID:CVE-2026-33870 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. In versions prior to...

7.5CVSS6.6AI score0.0064EPSS
SaveExploits1Affected Software1
GithubExploit
GithubExploit
added 2026/07/14 5:32 p.m.81 views

fastify-static-zero-days

@fastify/static — Multiple Zero-Day Vulnerabilities Package...

6.2AI score
SaveExploits0
The Hacker News
The Hacker News
added 2026/07/14 5:27 p.m.23 views

Researchers Say Claude for Chrome Flaw Lets Rogue Extensions Trigger Gmail Reads

Any other browser extension that can run a script on claude.ai can still trigger Claude for Chrome tasks aimed at your Gmail, your latest Google Doc and its comments, and your Calendar. Both this and ClaudeBleed need a rogue extension that can already run a script on claude.ai; the difference is...

6.3AI score
SaveExploits0
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 5:24 p.m.9 views

Security Bulletin: IBM Sterling Connect:Direct FTP+ is impacted by vulnerabilities

Summary IBM Java 17 is used by IBM Sterling Connect:Direct FTP+ in product configuration and data transmission. IBM Sterling Connect:Direct FTP+ is impacted by vulnerabilities in IBM Java 17. IBM Sterling Connect:Direct FTP+ has upgraded IBM Java 17 to address the issues CVE-2026-34282,...

8.7CVSS6.6AI score0.00702EPSS
SaveExploits3Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 5:22 p.m.10 views

Security Bulletin: IBM Sterling Connect:Direct for Unix is impacted by vulnerabilities

Summary IBM Java 17 is used by IBM Sterling Connect:Direct for UNIX in product configuration and data transmission. IBM Sterling Connect:Direct for UNIX is impacted by vulnerabilities in IBM Java 17. IBM Sterling Connect:Direct for UNIX has upgraded IBM Java 17 to address the issues CVE-2026-3428...

8.7CVSS6.6AI score0.00702EPSS
SaveExploits3Affected Software1
OSV
OSV
added 2026/07/14 5:18 p.m.11 views

GHSA-2P5X-4JR6-X5JG FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

Summary Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user lowpriv created a customer with nombre = "=SUM1+1cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payloa...

8CVSS6.3AI score
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/07/14 5:18 p.m.17 views

FacturaScripts: CSV formula injection in CSVExport allows authenticated low-priv users to plant payloads that execute when an admin opens the export

Summary Live PoC verified 2026-04-30 against a stock FacturaScripts master at 127.0.0.1:8081. A low-privilege user lowpriv created a customer with nombre = "=SUM1+1cmd|/c calc!A1". An admin then exported ListCliente to CSV via ?action=export&option=CSV. The downloaded file contains the raw payloa...

6.3AI score
SaveExploits0References2Affected Software1
Github Security Blog
Github Security Blog
added 2026/07/14 5:07 p.m.24 views

OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

6.2AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/14 5:07 p.m.6 views

GHSA-WMJ8-9953-VFF5 OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection

Summary OpenCost contains an unauthenticated file write vulnerability in the /serviceKey endpoint that allows remote attackers to overwrite the GCP service account key file without authentication. This can lead to service disruption, credential theft, and potential privilege escalation within...

8.8CVSS6.2AI score
SaveExploits0References2
CVE
CVE
added 2026/07/14 5:06 p.m.66 views

CVE-2026-50360

The CVE-2026-50360 entry describes an Elevation of Privilege in Windows SMB Server caused by an incorrect authentication algorithm, allowing an authorized attacker to elevate privileges over the network. Published CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 8.8, HIGH). Windows has...

8.8CVSS6.1AI score0.00526EPSS
SaveExploits0References1Affected Software7
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 3:47 p.m.15 views

Security Bulletin: Vulnerability affect cryptography-46.0.5, and bcprov-jdk18on-1.82.jar IBM COS Systems (July 2026)

Summary Vulnerability with cryptography-46.0.5 CVE-2026-39892, and bcprov-jdk18on-1.82.jar CVE-2025-14813, CVE-2026-5598 . This vulnerability has been addressed in the latest ClevOS release. Vulnerability Details CVEID:CVE-2026-39892 DESCRIPTION: cryptography is a package designed to expose...

9.9CVSS6.4AI score0.00899EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 3:35 p.m.10 views

Security Bulletin: IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell (CVE-2026-10535)

Summary IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell. Vulnerability Details CVEID:CVE-2026-10535 DESCRIPTION: IBM Db2 is vulnerable to buffer overflow in setgid helper db2flacc...

8.4CVSS6.2AI score0.00113EPSS
SaveExploits0Affected Software1
NVD
NVD
added 2026/07/14 3:16 p.m.25 views

CVE-2026-10714

A security issue exists within FactoryTalk® Services Platform FTSP, allowing an attacker to bypass JWT signature validation during Okta Web Authentication. The vulnerability stems from the application not verifying that the JWT algorithm is configured for RSA, enabling an attacker to set the...

8.8CVSS0.00113EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 3:15 p.m.21 views

Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...

9.8CVSS6.4AI score0.00456EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 3:14 p.m.11 views

Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...

8.8CVSS6.5AI score0.00448EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 3:12 p.m.7 views

Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...

9.8CVSS6.4AI score0.00524EPSS
SaveExploits1Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 3:10 p.m.8 views

Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...

7.1CVSS6.4AI score0.00215EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 3:08 p.m.9 views

Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...

7.5CVSS6.4AI score0.00416EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/14 3:05 p.m.11 views

Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...

9.8CVSS6.4AI score0.00226EPSS
SaveExploits0Affected Software1
Rows per page
Query Builder