Lucene search
+L

35922 matches found

OSV
OSV
added 2 days ago3 views

MAL-2026-11984 Malicious code in qlik-object-conversion (npm)

npm/qlik-object-conversion is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.7AI score
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2 days ago4 views

firefox: thunderbird: Mitigation bypass in the DOM: Networking component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the DOM: Networking component...

9.8CVSS5.4AI score0.00387EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2 days ago5 views

firefox: thunderbird: Privilege escalation in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Privilege escalation in the DOM: Navigation component...

8.8CVSS5.4AI score0.00278EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2 days ago5 views

firefox: thunderbird: Same-origin policy bypass in the DOM: Navigation component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the DOM: Navigation component...

9.8CVSS5.4AI score0.00215EPSS
SaveExploits0References6
CVE
CVE
added 2 days ago9 views

CVE-2026-16070

The CVE-2026-16070 relates to the Brizy WordPress plugin (before 2.8.19). The vulnerability arises because it does not properly verify authorization when updating a template’s type meta, validating a request parameter different from the one used in the write operation. This IDOR-like flaw enables...

2.7CVSS5.5AI score0.00168EPSS
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2 days ago7 views

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

8CVSS5.4AI score0.00669EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2 days ago8 views

sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation

A flaw was found in SSSD's LDAP sudo provider. When the ldapsudosearchbase option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo...

8.8CVSS5.5AI score0.00568EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2 days ago6 views

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

8CVSS5.4AI score0.00669EPSS
SaveExploits0References4
CVE
CVE
added 2 days ago14 views

CVE-2026-67979

NASA cFS v7.0.1 is affected by CVE-2026-67979 due to incorrect access control in the Executive Services dynamic application start path component. The flaw allows an attacker to achieve arbitrary code execution by placing a shared object on target storage. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:...

9.1CVSS6AI score0.00155EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2 days ago32 views

CVE-2026-67979

Incorrect access control in the Executive Services dynamic application start path component of NASA cFS v7.0.1 allows attackers to execute arbitrary code via placing a shared object on target storage...

0.00155EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2 days ago6 views

RHEL 8 : thunderbird (RHSA-2026:49922)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:49922 advisory. Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: firefox: thunderbird: Site isolation issue in the DOM:...

9.8CVSS5.8AI score0.00436EPSS
SaveExploits0References68
RedhatCVE
RedhatCVE
added 3 days ago7 views

CVE-2026-67321

A flaw was found in axios. A remote attacker could exploit an incomplete depth-limit bypass when the component serializes objects with specific top-level keys. By manipulating object keys and nested values during form or parameter serialization, an attacker can trigger a processing error. This ca...

7.5CVSS5.5AI score0.00291EPSS
SaveExploits0References5
NVD
NVD
added 3 days ago12 views

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

5.3CVSS0.00158EPSS
SaveExploits0References2
NVD
NVD
added 3 days ago7 views

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

7.8CVSS0.00134EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 3 days ago6 views

CVE-2026-18642

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

7.8CVSS5.5AI score0.00134EPSS
SaveExploits0References2
CVE
CVE
added 3 days ago17 views

CVE-2026-18642

CVE-2026-18642 describes a deserialization of untrusted data vulnerability in TÜBİTAK BİLGEM’s eta-otp-lock (affected: before 1.0.4) that may enable Object Injection. The CVSS 3.1 base score is 7.8 (HIGH) with LOCAL attack vector, NO privileges required, but USER INTERACTION is required; confiden...

7.8CVSS5.5AI score0.00134EPSS
SaveExploits0References1
Cvelist
Cvelist
added 3 days ago44 views

CVE-2026-18642 Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

7.8CVSS0.00134EPSS
SaveExploits0References1
EUVD
EUVD
added 3 days ago7 views

EUVD-2026-52294

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4...

7.8CVSS5.5AI score0.00134EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 3 days ago7 views

CVE-2026-69094

Admidio before 5.0.11 contains an insecure direct object reference vulnerability in the savetemporary mode of mylistfunction.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' privat...

5.3CVSS5.5AI score0.00158EPSS
SaveExploits0References3
CVE
CVE
added 3 days ago11 views

CVE-2026-69094

Admidio before 5.0.11 is affected by CVE-2026-69094: an insecure direct object reference in the save_temporary mode of mylist_function.php allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users’ p...

5.3CVSS5.5AI score0.00158EPSS
SaveExploits0References2
Rows per page
Query Builder