Lucene search
+L

108163 matches found

Packet Storm News
Packet Storm News
added 2026/08/04 12:0 a.m.13 views

Breaking ACDGV MinRank Gabidulin Encryption Schemes over Matrix Codes

Enhanced Gabidulin Matrix Codes EGMC, introduced by Aragon, Couvreur, Dyseryn, Gaborit, and Vincotte at Asiacrypt 2024, were designed to hide the algebraic structure of Gabidulin matrix codes while enabling very compact McEliece- and Niederreiter-type encryption schemes, with ciphertexts as small...

5.5AI score
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/08/04 12:0 a.m.21 views

PT-2026-67671

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp process asconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctp rcv. For an ASCONF located...

5.4AI score0.00476EPSS
SaveExploits1References6
NVD
NVD
added 2026/08/03 10:16 p.m.8 views

CVE-2026-67617

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

4.8CVSS0.00161EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/03 9:53 p.m.37 views

CVE-2026-67617

CVE-2026-67617 (Microweber CMS 2.0.20) describes a stored XSS in the content tagging system. An admin-authenticated attacker can inject arbitrary JavaScript by submitting payloads to the tag_names parameter of the GET /api/save_content_admin endpoint. The vulnerability allegedly bypasses three sa...

4.8CVSS5.5AI score0.00161EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/03 9:53 p.m.43 views

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

4.8CVSS0.00161EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/03 9:53 p.m.5 views

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

4.8CVSS5.5AI score
SaveExploits0References5
NVD
NVD
added 2026/08/03 9:16 p.m.9 views

CVE-2026-18737

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...

7.1CVSS0.00241EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/03 8:40 p.m.44 views

CVE-2026-18737 Shlink Blind SQL Injection via tags/stats orderBy Parameter

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...

7.1CVSS0.00241EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/03 8:40 p.m.7 views

CVE-2026-18737 Shlink Blind SQL Injection via tags/stats orderBy Parameter

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...

7.1CVSS5.8AI score
SaveExploits0References5
EUVD
EUVD
added 2026/08/03 8:33 p.m.10 views

EUVD-2026-52432

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

8.8CVSS6AI score0.00322EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/03 8:17 p.m.8 views

CVE-2026-68980

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

9.1CVSS0.00318EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/03 8:17 p.m.17 views

CVE-2026-68979

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization wa...

9.8CVSS0.00522EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/03 8:17 p.m.8 views

CVE-2026-62354

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

7.7CVSS0.00311EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/03 8:15 p.m.44 views

CVE-2026-18645 danpros HTMLy Admin Content Endpoint admin.php add_content path traversal

A security flaw has been discovered in danpros HTMLy up to 3.1.1. This affects the function addcontent of the file /system/admin/admin.php of the component Admin Content Endpoint. Performing a manipulation of the argument oldfile results in path traversal. The attack may be initiated remotely. Th...

5.5CVSS0.00427EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/03 7:58 p.m.6 views

CVE-2026-68980 Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

2.3CVSS5.5AI score
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/03 7:58 p.m.10 views

CVE-2026-68980

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

2.3CVSS5.5AI score0.00318EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 2026/08/03 7:58 p.m.63 views

CVE-2026-68980 Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

2.3CVSS0.00318EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/03 7:58 p.m.7 views

EUVD-2026-52421

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework...

2.3CVSS5.5AI score0.00318EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/03 7:58 p.m.40 views

CVE-2026-68980

CVE-2026-68980 affects Apache NiFi 2.0.0–2.10.0. The issue is an authorization bypass in Asset management for Parameter Contexts via the REST API: deletion of an Asset is authorized by the provided Parameter Context Identifier without validating the Asset Identifier against the stored one. This c...

9.1CVSS5.5AI score0.00318EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/08/03 7:57 p.m.7 views

EUVD-2026-52420

Authorization handling for Parameter Context validation requests in Apache NiFi 1.10.0 through 2.10.0 allows clients with read access to submit proposed Parameter values. The proposed values override current configuration, enabling users with read access to invoke predefined component validation...

7.7CVSS5.5AI score0.00311EPSS
SaveExploits0References1
Rows per page
Query Builder