Lucene search
+L

1553 matches found

Positive Technologies
Positive Technologies
added 2026/03/03 12:0 a.m.9 views

PT-2026-22741

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.2 Django versions 5.2 through 5.2.11 Django versions 4.2 through 4.2.28 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier Description The URLField.to python...

7.8CVSS6AI score0.00734EPSS
SaveExploits0References28
OSV
OSV
added 2026/03/02 9:49 p.m.6 views

GHSA-WR6M-JG37-68XH OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)

Summary Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route. Impact An attacker could cause memory pressure and potential process instability or OOM, degrading availability. Fix Webhook...

6.9CVSS6AI score0.00354EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/03/02 9:49 p.m.14 views

OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)

Summary Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route. Impact An attacker could cause memory pressure and potential process instability or OOM, degrading availability. Fix Webhook...

6AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/03/02 7:16 p.m.6 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

7.8CVSS5.9AI score0.0011EPSS
SaveExploits0References1
NVD
NVD
added 2026/03/02 7:16 p.m.10 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

7.8CVSS0.0011EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/03/02 6:42 p.m.2 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

6.1AI score0.0011EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/03/02 6:42 p.m.6 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

7.8CVSS6.1AI score0.0011EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2026/03/02 6:42 p.m.37 views

CVE-2025-48567

CVE-2025-48567 involves a bypass of a file path filter intended to restrict access to sensitive directories, caused by incorrect Unicode normalization. This can enable local escalation of privilege; exploitation requires user interaction. The CVE is referenced across multiple sources (NVD, Red Ha...

7.8CVSS6.1AI score0.0011EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/03/02 6:42 p.m.40 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

0.0011EPSS
SaveExploits0References1
Github Security Blog
Github Security Blog
added 2026/03/02 2:34 p.m.18 views

Nest has a Fastify URL Encoding Middleware Bypass

Impact What kind of vulnerability is it? Who is impacted? A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter are enabled. In affected route-scoped...

9.8CVSS6.1AI score0.00666EPSS
SaveExploits1References6Affected Software1
OSV
OSV
added 2026/03/02 2:34 p.m.6 views

GHSA-R4WM-X892-VJMX Nest has a Fastify URL Encoding Middleware Bypass

Impact What kind of vulnerability is it? Who is impacted? A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter are enabled. In affected route-scoped...

8.2CVSS6.1AI score0.00666EPSS
SaveExploits1References6
RedhatCVE
RedhatCVE
added 2026/03/02 12:37 p.m.12 views

CVE-2026-2293

A flaw was found in NestJS. When a NestJS application uses @nestjs/platform-fastify with Fastify path-normalization options enabled, a remote attacker can exploit this to bypass authentication and authorization middleware. This bypass allows unauthorized access to protected resources, compromisin...

8.2CVSS5.9AI score0.00666EPSS
SaveExploits1References6
NVD
NVD
added 2026/03/02 12:16 p.m.17 views

CVE-2025-30044

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstatsimple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection...

9.4CVSS0.00544EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/03/02 11:15 a.m.5 views

CVE-2025-30044 RCE on uhcapache user permissions

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstatsimple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection...

9.4CVSS6AI score0.00544EPSS
SaveExploits0References2
CVE
CVE
added 2026/03/02 11:15 a.m.17 views

CVE-2025-30044

CVE-2025-30044 affects endpoints under CliniNET.prd/utils (usrlogstat_simple.pl, usrlogstat.pl, userlogstat2.pl, dblogstat.pl). The issue is insufficient input normalization on parameters, enabling code injection. According to the provided metrics, the vulnerability has CRITICAL impact with HIGH ...

9.4CVSS6AI score0.00544EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/03/02 11:15 a.m.11 views

EUVD-2025-208148

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstatsimple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection...

9.4CVSS6AI score0.00544EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/03/02 12:0 a.m.17 views

PT-2026-22575

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection...

9.4CVSS6AI score0.00544EPSS
SaveExploits0References3
CNNVD
CNNVD
added 2026/03/02 12:0 a.m.11 views

Google Android 安全漏洞

Google Android is an open-source operating system based on Linux, developed by Google Inc. There are security vulnerabilities in Google Android, which stem from incorrect Unicode normalization in multiple locations. These vulnerabilities may bypass the file path filters designed to prevent access...

7.8CVSS5.8AI score0.0011EPSS
SaveExploits0References2
OSV
OSV
added 2026/03/01 12:0 a.m.11 views

ASB-A-377888957

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

7.8CVSS6.1AI score0.0011EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/02/28 7:45 p.m.10 views

CVE-2026-2880

A vulnerability in @fastify/middie versions 9.2.0 can result in authentication/authorization bypass when using path-scoped middleware for example, app.use'/secret', auth. When Fastify router normalization options are enabled such as ignoreDuplicateSlashes, useSemicolonDelimiter, and related...

9.1CVSS5.9AI score0.0039EPSS
SaveExploits0References1
Rows per page
Query Builder