Lucene search
+L

17199 matches found

EUVD
EUVD
added 2026/07/31 2:58 a.m.14 views

EUVD-2026-51388

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUTRELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file directory and create or conditionally overwrite...

4.3CVSS5.8AI score0.0026EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 2026/07/31 12:00 a.m.9 views

SUSE SLES12: ImageMagick-config-6-SUSE / ImageMagick-config-6-upstream / etc (SUSE-SU-2026:3412-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3412-1 advisory. - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. - CVE-2026-62946: integer overfl...

5.7CVSS7.3AI score0.00161EPSS
SaveExploits0References10
Tenable Nessus
Tenable Nessus
added 2026/07/31 12:00 a.m.8 views

SUSE SLED15 / SLES15 Security Update : ImageMagick (SUSE-SU-2026:3413-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3413-1 advisory. - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575....

5.7CVSS7.3AI score0.00161EPSS
SaveExploits0References10
SUSE CVE
SUSE CVE
added 2026/07/30 4:38 p.m.11 views

SUSE CVE-2026-56390

GNU Bison improperly handles grammar-defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller-supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

4.6CVSS5.6AI score0.00125EPSS
SaveExploits0References3
SUSE CVE
SUSE CVE
added 2026/07/30 4:30 p.m.11 views

SUSE CVE-2026-64863

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.4, the httpserver/server.go wdGuard handled WebDAV MOVE as a write-only method and did not enforce --no-delete, allowing WebDAV clients to delete or overwrite files via MOVE with Overwrite: T. This issu...

9.1CVSS5.5AI score0.00356EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/07/30 10:06 a.m.9 views

CVE-2026-62946

A flaw was found in ImageMagick. When processing extremely large JNX image files on 32-bit systems, an attacker could trigger an integer overflow. This overflow leads to a heap buffer over-write, which can cause the application to crash, resulting in a denial of service. Mitigation To mitigate th...

5.1CVSS6AI score0.0009EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/30 8:28 a.m.12 views

CVE-2026-62343

A flaw was found in ImageMagick, a widely used software for editing and manipulating digital images. A local user could provide a specially crafted, invalid kernel during a morphology operation. This action could trigger a heap buffer over-write, leading to a denial of service DoS for the...

4.7CVSS5.9AI score0.00091EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/07/30 8:27 a.m.10 views

CVE-2026-62363

A flaw was found in ImageMagick. A local attacker with low privileges could cause a heap buffer over-write by passing a specially crafted argument to the 'fx' operation. This could lead to a denial of service...

5CVSS6AI score0.00092EPSS
SaveExploits0References4
SUSE Linux
SUSE Linux
added 2026/07/30 6:53 a.m.7 views

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument bsc1272582. CVE-2026-62946: integer overflo...

5.9CVSS7.1AI score0.00161EPSS
SaveExploits0References20
SUSE Linux
SUSE Linux
added 2026/07/30 6:50 a.m.8 views

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bit...

5.9CVSS7.1AI score0.00161EPSS
SaveExploits0References12
OSV
OSV
added 2026/07/30 6:50 a.m.6 views

SUSE-SU-2026:3413-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. - CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bi...

5.7CVSS7.1AI score0.00161EPSS
SaveExploits0References7
SUSE Linux
SUSE Linux
added 2026/07/30 6:49 a.m.14 views

Security update for ImageMagick

This update for ImageMagick fixes the following issues: CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bit...

5.9CVSS7.1AI score0.00161EPSS
SaveExploits0References12
OSV
OSV
added 2026/07/30 6:49 a.m.7 views

SUSE-SU-2026:3412-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. - CVE-2026-62946: integer overflow in JNX decoder can lead to heap buffer overwrite when processing extremely large files on 32-bi...

5.7CVSS7.1AI score0.00161EPSS
SaveExploits0References7
NVD
NVD
added 2026/07/30 6:25 a.m.17 views

CVE-2026-15257

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

5.3CVSS0.0019EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/30 6:25 a.m.15 views

CVE-2026-16527

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

7.3CVSS0.00498EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/30 6:25 a.m.13 views

CVE-2026-14923

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

6.5CVSS0.00259EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/30 6:25 a.m.10 views

UBUNTU-CVE-2026-16527

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover...

7.3CVSS6.3AI score0.00498EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/07/30 6:00 a.m.14 views

EUVD-2026-51006

The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Travel Engine WordPress plugin before 6.8.2 option the public...

7.5CVSS5.9AI score0.00253EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/30 6:00 a.m.14 views

EUVD-2026-50988

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

6.5CVSS5.9AI score0.00259EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/30 5:30 a.m.59 views

CVE-2026-16527

CVE-2026-16527 affects the PCP project’s pmproxy service. An unauthenticated attacker can bypass access controls via crafted requests to the /store endpoint, enabling overwriting of any PMDA metric and leading to arbitrary code execution and system takeover. Root cause: missing/ineffective access...

7.3CVSS6.5AI score0.00498EPSS
SaveExploits0References5
Rows per page
Query Builder