Lucene search
+L

35859 matches found

Fedora
Fedora
added 3 days ago10 views

[SECURITY] Fedora 43 Update: GitPython-3.1.55-1.fc43

GitPython is a python library used to interact with git repositories, high-level like git-porcelain, or low-level like git-plumbing. It provides abstractions of git objects for easy access of repository data, a nd additionally allows you to access the git repository more directly using eith er a...

5.5AI score
SaveExploits0
NVD
NVD
added 3 days ago7 views

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

5.4CVSS0.00182EPSS
SaveExploits0References2
EUVD
EUVD
added 3 days ago9 views

EUVD-2026-51809

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...

6.3CVSS5.5AI score0.00258EPSS
SaveExploits0References2
EUVD
EUVD
added 3 days ago7 views

EUVD-2026-51827

axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.prototype has already been polluted by a separate vulnerability or dependency. In the bodyless method aliases axios.get, axios.delete, axios.head, axios.options, inherited data is read via...

6.3CVSS5.5AI score0.00258EPSS
SaveExploits0References2
Cvelist
Cvelist
added 3 days ago31 views

CVE-2026-67319 axios before 0.33.0 Prototype Pollution via nested option objects

axios before 0.33.0 and 1.x before 1.18.0 can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth a...

6.3CVSS0.00258EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 3 days ago7 views

CVE-2026-67310

OpenRemote org.openremote:openremote versions = 1.26.2 contain an insecure direct object reference vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream.findFirst on a HashSet of realms from the request,...

5.4CVSS5.5AI score0.00182EPSS
SaveExploits0References3
Nuclei
Nuclei
added 3 days ago51 views

Webmin < 1.920 - Authenticated Remote Code Execution

rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialisevariable makes an eval call. NOTE: the WebminServersIndex documentation states "RPC can be used to run any command or modify any file on a server, which is why access to it must...

8.8CVSS7.8AI score0.38038EPSS
SaveExploits4References5
NVD
NVD
added 3 days ago6 views

CVE-2025-14073

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

5.3CVSS0.00232EPSS
SaveExploits0References4
EUVD
EUVD
added 3 days ago8 views

EUVD-2025-210580

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

5.3CVSS5.5AI score0.00232EPSS
SaveExploits0References4
Cvelist
Cvelist
added 3 days ago32 views

CVE-2025-14073 WooCommerce PayPal Payments <= 3.3.2 - Unauthenticated Sensitive Information Disclosure

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

5.3CVSS0.00232EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 3 days ago7 views

CVE-2025-14073

The WooCommerce PayPal Payments plugin for WordPress is vulnerable to Sensitive Information Disclosure due to an Insecure Direct Object Reference in all versions up to, and including, 3.3.2 via the enqueuepaypalinsightsscriptonorderreceived function due to missing validation on a user controlled...

5.3CVSS5.5AI score0.00232EPSS
SaveExploits0References5
CVE
CVE
added 3 days ago8 views

CVE-2025-14073

The CVE-2025-14073 entry concerns the WooCommerce PayPal Payments plugin for WordPress (affected versions up to 3.3.2). It describes an Insecure Direct Object Reference flaw in the enqueue_paypal_insights_script_on_order_received() function caused by missing validation on a user-controlled key. T...

5.3CVSS5.5AI score0.00232EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 3 days ago8 views

CVE-2026-18059

The PixelYourSite – Your smart PIXEL TAG & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata...

5.3CVSS5.7AI score0.00331EPSS
SaveExploits0References13
NVD
NVD
added 4 days ago10 views

CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

7.3CVSS0.00262EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 4 days ago8 views

CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

7.3CVSS5.4AI score0.00262EPSS
SaveExploits0References4
OSV
OSV
added 4 days ago4 views

CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

7.3CVSS5.4AI score0.00262EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 4 days ago8 views

CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

7.3CVSS5.4AI score0.00262EPSS
SaveExploits0References5Affected Software1
RedHat Linux
RedHat Linux
added 4 days ago6 views

github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object

A flaw was found in Go JOSE, a library for handling JSON Web Encryption JWE objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the...

7.5CVSS6.6AI score0.00651EPSS
SaveExploits0References6
Wiz blog
Wiz blog
added 4 days ago6 views

S3 Clones in the Neoclouds

S3 compatible services carry many of the same concerns as the original S3 service. This article highlights which assumptions break and what risks remain...

5.5AI score
SaveExploits0
NVD
NVD
added 4 days ago7 views

CVE-2026-17567

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

5.3CVSS0.00377EPSS
SaveExploits0References9
Rows per page
Query Builder