Lucene search
+L

1556 matches found

OSV
OSV
added 2026/03/03 12:38 a.m.8 views

GHSA-5847-RM3G-23MW OpenClaw has hook auth rate limiter bypass via IPv4-mapped IPv6 client key variants

Vulnerability The hook authentication throttle keyed failed attempts by raw socket remoteAddress text. IPv4 and IPv4-mapped IPv6 forms of the same client for example 1.2.3.4 and ::ffff:1.2.3.4 were treated as different clients, allowing separate rate-limit buckets. Impact An attacker could split...

6.9CVSS6AI score
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/03/03 12:0 a.m.16 views

PT-2026-26402

Summary Feishu allowlist authorization could be bypassed by display-name collision. Details channels.feishu.allowFrom is documented as an ID-based allowlist open id list, but Feishu policy matching accepted mutable sender display names in the same namespace. An attacker could set a display name...

6.3CVSS5.8AI score0.00205EPSS
SaveExploits0References7
CNNVD
CNNVD
added 2026/03/03 12:0 a.m.13 views

Django 安全漏洞

Django is a Python-based open-source web framework developed by the Django Foundation. This framework includes an object-oriented mapper, view system, template system, etc. Versions of Django prior to 6.0.3, 5.2.12, and 4.2.29 contained security vulnerabilities. These vulnerabilities stemmed from...

7.5CVSS5.8AI score0.00734EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/03/03 12:0 a.m.9 views

PT-2026-22741

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.2 Django versions 5.2 through 5.2.11 Django versions 4.2 through 4.2.28 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier Description The URLField.to python...

7.8CVSS6AI score0.00734EPSS
SaveExploits0References28
OSV
OSV
added 2026/03/02 9:49 p.m.6 views

GHSA-WR6M-JG37-68XH OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)

Summary Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route. Impact An attacker could cause memory pressure and potential process instability or OOM, degrading availability. Fix Webhook...

6.9CVSS6AI score0.00354EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 2026/03/02 9:49 p.m.14 views

OpenClaw has unbounded memory growth in Zalo webhook via query-string key churn (unauthenticated DoS)

Summary Unauthenticated requests to a reachable Zalo webhook endpoint could trigger unbounded in-memory key growth by varying query strings on the same valid webhook route. Impact An attacker could cause memory pressure and potential process instability or OOM, degrading availability. Fix Webhook...

6AI score
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/03/02 7:16 p.m.6 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

7.8CVSS5.9AI score0.0011EPSS
SaveExploits0References1
NVD
NVD
added 2026/03/02 7:16 p.m.10 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

7.8CVSS0.0011EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 2026/03/02 6:42 p.m.2 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

6.1AI score0.0011EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/03/02 6:42 p.m.6 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

7.8CVSS6.1AI score0.0011EPSS
SaveExploits0References3Affected Software1
CVE
CVE
added 2026/03/02 6:42 p.m.37 views

CVE-2025-48567

CVE-2025-48567 involves a bypass of a file path filter intended to restrict access to sensitive directories, caused by incorrect Unicode normalization. This can enable local escalation of privilege; exploitation requires user interaction. The CVE is referenced across multiple sources (NVD, Red Ha...

7.8CVSS6.1AI score0.0011EPSS
SaveExploits0References1Affected Software1
Cvelist
Cvelist
added 2026/03/02 6:42 p.m.41 views

CVE-2025-48567

In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for...

0.0011EPSS
SaveExploits0References1
Github Security Blog
Github Security Blog
added 2026/03/02 2:34 p.m.18 views

Nest has a Fastify URL Encoding Middleware Bypass

Impact What kind of vulnerability is it? Who is impacted? A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter are enabled. In affected route-scoped...

9.8CVSS6.1AI score0.00666EPSS
SaveExploits1References6Affected Software1
OSV
OSV
added 2026/03/02 2:34 p.m.6 views

GHSA-R4WM-X892-VJMX Nest has a Fastify URL Encoding Middleware Bypass

Impact What kind of vulnerability is it? Who is impacted? A NestJS application using @nestjs/platform-fastify can allow bypass of any middleware when Fastify path-normalization options e.g., ignoreTrailingSlash, ignoreDuplicateSlashes, useSemicolonDelimiter are enabled. In affected route-scoped...

8.2CVSS6.1AI score0.00666EPSS
SaveExploits1References6
RedhatCVE
RedhatCVE
added 2026/03/02 12:37 p.m.12 views

CVE-2026-2293

A flaw was found in NestJS. When a NestJS application uses @nestjs/platform-fastify with Fastify path-normalization options enabled, a remote attacker can exploit this to bypass authentication and authorization middleware. This bypass allows unauthorized access to protected resources, compromisin...

9.8CVSS5.9AI score0.00666EPSS
SaveExploits1References6
NVD
NVD
added 2026/03/02 12:16 p.m.17 views

CVE-2025-30044

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstatsimple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection...

9.4CVSS0.00544EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/03/02 11:15 a.m.5 views

CVE-2025-30044 RCE on uhcapache user permissions

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstatsimple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection...

9.4CVSS6AI score0.00544EPSS
SaveExploits0References2
CVE
CVE
added 2026/03/02 11:15 a.m.17 views

CVE-2025-30044

CVE-2025-30044 affects endpoints under CliniNET.prd/utils (usrlogstat_simple.pl, usrlogstat.pl, userlogstat2.pl, dblogstat.pl). The issue is insufficient input normalization on parameters, enabling code injection. According to the provided metrics, the vulnerability has CRITICAL impact with HIGH ...

9.4CVSS6AI score0.00544EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/03/02 11:15 a.m.11 views

EUVD-2025-208148

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstatsimple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection...

9.4CVSS6AI score0.00544EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/03/02 12:0 a.m.17 views

PT-2026-22575

In the endpoints "/cgi-bin/CliniNET.prd/utils/usrlogstat simple.pl", "/cgi-bin/CliniNET.prd/utils/usrlogstat.pl", "/cgi-bin/CliniNET.prd/utils/userlogstat2.pl", and "/cgi-bin/CliniNET.prd/utils/dblogstat.pl", the parameters are not sufficiently normalized, which enables code injection...

9.4CVSS6AI score0.00544EPSS
SaveExploits0References3
Rows per page
Query Builder