Lucene search
+L

35924 matches found

Cvelist
Cvelist
added 2 days ago35 views

CVE-2026-70554 MaxSite CMS Unauthenticated PHP Object Injection via maxsite_comuser Cookie

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsitecomuser cookie directly to unserialize without validation or class allowlisting. Attackers can craft a malicious...

9.8CVSS0.00851EPSS
SaveExploits0References3
CVE
CVE
added 2 days ago18 views

CVE-2026-70554

CVE-2026-70554 affects MaxSite CMS. It describes an unauthenticated PHP object injection via the maxsite_comuser cookie, where unvalidated serialized data is passed directly to unserialize(), allowing an attacker to reconstruct object graphs and trigger magic methods. This can enable property-ori...

9.8CVSS6.8AI score0.00851EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2 days ago5 views

pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One ASN.1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload...

7.5CVSS5.5AI score0.00335EPSS
SaveExploits0References7
Patchstack
Patchstack
added 2 days ago4 views

WordPress Groundhogg — CRM, Newsletters, and Marketing Automation plugin <= 4.5.2 - Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability discovered by Lucius-log in WordPress Plugin Groundhogg versions = 4.5.2...

6.5CVSS5.5AI score0.00395EPSS
SaveExploits0References1Affected Software1
RedHat Linux
RedHat Linux
added 2 days ago4 views

pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One ASN.1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload...

7.5CVSS5.5AI score0.00335EPSS
SaveExploits0References7
OSSF Malicious Packages
OSSF Malicious Packages
added 2 days ago4 views

Malicious code in qlik-object-conversion (npm)

npm/qlik-object-conversion is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.7AI score
SaveExploits0References6
OSV
OSV
added 2 days ago4 views

MAL-2026-11984 Malicious code in qlik-object-conversion (npm)

npm/qlik-object-conversion is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.7AI score
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2 days ago4 views

firefox: thunderbird: Mitigation bypass in the DOM: Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Networking component...

9.8CVSS5.4AI score0.00387EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2 days ago6 views

firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the DOM: Navigation component...

9.8CVSS5.4AI score0.00215EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2 days ago5 views

firefox: thunderbird: Privilege escalation in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Navigation component...

8.8CVSS5.4AI score0.00278EPSS
SaveExploits0References6
CVE
CVE
added 2 days ago11 views

CVE-2026-16070

The CVE-2026-16070 relates to the Brizy WordPress plugin (before 2.8.19). The vulnerability arises because it does not properly verify authorization when updating a template’s type meta, validating a request parameter different from the one used in the write operation. This IDOR-like flaw enables...

2.7CVSS5.5AI score0.00168EPSS
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2 days ago7 views

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

8CVSS5.4AI score0.00669EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2 days ago8 views

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

8.8CVSS5.5AI score0.00568EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2 days ago7 views

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

8CVSS5.4AI score0.00669EPSS
SaveExploits0References4
CVE
CVE
added 2 days ago15 views

CVE-2026-67979

NASA cFS v7.0.1 is affected by CVE-2026-67979 due to incorrect access control in the Executive Services dynamic application start path component. The flaw allows an attacker to achieve arbitrary code execution by placing a shared object on target storage. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:...

9.1CVSS6AI score0.00155EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2 days ago6 views

RHEL 8 : thunderbird (RHSA-2026:49922)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49922 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

9.8CVSS5.8AI score0.00436EPSS
SaveExploits0References68
Cvelist
Cvelist
added 2 days ago33 views

CVE-2026-67979

Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...

0.00155EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 3 days ago7 views

CVE-2026-67321

A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This ca...

7.5CVSS5.5AI score0.00291EPSS
SaveExploits0References5
NVD
NVD
added 3 days ago12 views

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

5.3CVSS0.00158EPSS
SaveExploits0References2
NVD
NVD
added 3 days ago7 views

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

7.8CVSS0.00134EPSS
SaveExploits0References1
Rows per page
Query Builder