Lucene search
+L

671134 matches found

NVD
NVD
added 9 minutes ago0 views

CVE-2026-63048

The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE...

9.4CVSS
Exploits0References1
NVD
NVD
added 9 minutes ago0 views

CVE-2026-45820

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync. A crafted ZIP archive with a central directory entry declaring compressedsize=0xFFFFFFFF ZIP64 sentinel but missing the required ZIP64 extra field tag 0x0001 causes z64e to loop indefinitely due to...

8.7CVSS
Exploits0References2
NVD
NVD
added 9 minutes ago0 views

CVE-2026-63047

The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information...

Exploits0References1
NVD
NVD
added 1 hour ago3 views

CVE-2026-3821

Supermicro SMC SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service DoS attack against the BMC...

8.8CVSS
Exploits0References1
NVD
NVD
added 1 hour ago3 views

CVE-2026-12987

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

Exploits0References1
NVD
NVD
added 1 hour ago4 views

CVE-2026-14322

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment...

Exploits0References1
NVD
NVD
added 1 hour ago4 views

CVE-2026-12968

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline, allowing an unauthenticated attacker to upload a malicious SVG whose embedded script executes...

Exploits0References1
NVD
NVD
added 3 hours ago5 views

CVE-2026-15802

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'deletelocationsbackupfilecallback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access...

8.1CVSS
Exploits0References2
GithubExploit
GithubExploit
added 6 hours ago15 views

pedit-cow-exploit

CVE-2026-46331 – pedit COW Local Privilege Escalation Proof-of...

7.8CVSS6AI score0.00321EPSS
Exploits12
NVD
NVD
added 7 hours ago6 views

CVE-2026-16492

A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component GIT File Helper. This manipulation causes os command injection. The exploit has been made available to the public a...

5.5CVSS
Exploits0References9
NVD
NVD
added 7 hours ago5 views

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

8.4CVSS
Exploits0References1
NVD
NVD
added 7 hours ago6 views

CVE-2026-16490

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the argument editid results in sql injection. The attack can be executed remotely. The exploit has been released to the public and...

6.5CVSS
Exploits0References6
NVD
NVD
added 8 hours ago7 views

CVE-2026-63262

Missing Authorization CWE-862 in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control...

4.3CVSS
Exploits0References1
NVD
NVD
added 8 hours ago3 views

CVE-2026-63263

Uncontrolled Resource Consumption CWE-400 in Elasticsearch can lead to denial of service via Exponential Data Expansion CAPEC-197. An authenticated user may submit a specially crafted query to the ES|QL engine that causes exponential CPU consumption during query evaluation. Because the resource...

6.5CVSS
Exploits0References1
NVD
NVD
added 8 hours ago5 views

CVE-2026-16488

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

5.1CVSS
Exploits0References10
NVD
NVD
added 8 hours ago7 views

CVE-2026-16489

A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. The manipulation leads to os command injection. The attack can only be performed from a local environment. The exploi...

5.3CVSS
Exploits0References6
NVD
NVD
added yesterday4 views

CVE-2026-63142

Incomplete List of Disallowed Inputs CWE-184 in Kibana can allow an authenticated attacker with access to the Reporting feature to bypass outbound request restrictions configured by an administrator, causing the reporting service to send requests to network destinations that should be denied by t...

5CVSS
Exploits0References1
NVD
NVD
added yesterday5 views

CVE-2026-63143

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

4.3CVSS
Exploits0References1
NVD
NVD
added yesterday4 views

CVE-2026-63261

Uncontrolled Resource Consumption CWE-400 in Kibana can lead to denial of service via Excessive Allocation CAPEC-130. A low-privileged authenticated user can send a specially crafted request to a Kibana machine learning feature, causing the server to exhaust available memory and become unavailabl...

6.5CVSS
Exploits0References1
NVD
NVD
added yesterday5 views

CVE-2026-63145

Incorrect Authorization CWE-863 in Kibana can lead to integrity compromise of Machine Learning audit and notification records via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A vulnerability exists in Kibana's Machine Learning functionality where a Machine Learning management...

4.3CVSS
Exploits0References1
Rows per page
Query Builder