Lucene search
+L

108184 matches found

RedHat Linux
RedHat Linux
added 2026/08/04 4:49 p.m.6 views

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

6.3CVSS5.5AI score0.00313EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 2026/08/04 4:47 p.m.8 views

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

6.3CVSS5.5AI score0.00313EPSS
SaveExploits1References7
CVE
CVE
added 2026/08/04 2:15 p.m.42 views

CVE-2026-18766

CVE-2026-18766 affects the chetans9 core-php-admin-panel (up to the commit 90d07ed5aac5e0f09b6a5828d7bb2eb83010763f). The issue is a SQL injection caused by manipulation of the argument filter_col in customers.php. It can be exploited remotely, and the exploit has been published and may be used. ...

6.5CVSS6.4AI score0.00192EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/08/04 1:3 p.m.9 views

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

6.3CVSS5.5AI score0.00313EPSS
SaveExploits1References7
OSV
OSV
added 2026/08/04 1:0 p.m.4 views

CVE-2026-70372 Koha - SQL Injection in reports/bor_issues_top.pl

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha databa...

8.8CVSS5.8AI score
SaveExploits0References7
Vulnrichment
Vulnrichment
added 2026/08/04 1:0 p.m.10 views

CVE-2026-70370 Koha - SQL Injection in reports/catalogue_stats.pl

Koha's reports/cataloguestats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query SELECT DISTINCTROW, GROUP BY, ORDER BY with no whitelist validation...

8.8CVSS5.5AI score0.00306EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/08/04 12:45 p.m.8 views

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

6.3CVSS5.5AI score0.00313EPSS
SaveExploits1References7
Cvelist
Cvelist
added 2026/08/04 11:45 a.m.45 views

CVE-2026-66884 Oidcc.Plug.AuthorizationCallback accepts callbacks with no authorize session or no state parameter, defeating CSRF protection

Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidccplug Oidcc.Plug.AuthorizationCallback module allows an attacker to make a victim's browser complete an authorization flow the victim never initiated. This vulnerability is associated with program file...

2.1CVSS0.00214EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/04 7:16 a.m.8 views

CVE-2026-64564

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctprcv. For an ASCONF located...

9.8CVSS0.00476EPSS
SaveExploits1References12
NVD
NVD
added 2026/08/04 7:16 a.m.10 views

CVE-2026-14872

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by users granted a specific capability which is limited to administrators by default...

6.8CVSS0.00231EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/04 6:23 a.m.11 views

EUVD-2026-52605

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctpprocessasconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctprcv. For an ASCONF located...

5.4AI score0.00476EPSS
SaveExploits1References5
CVE
CVE
added 2026/08/04 6:0 a.m.45 views

CVE-2026-14872

The CVE affects the Database for Contact Form 7, WPforms, Elementor Forms WordPress plugin, specifically versions before 1.5.5. The root cause is improper sanitisation/escaping of a parameter before use in a SQL statement, enabling a SQL Injection. The vulnerability is exploitable by users with a...

6.8CVSS5.8AI score0.00231EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/04 12:34 a.m.9 views

EUVD-2026-52506

A stack-based buffer overflow vulnerability exists in the cmdedl function of OreSat Firmware v1.0. The vulnerability is triggered when processing the edl fwflash command, where the argument is copied to a 64-byte stack buffer via memcpy without proper length validation. An attacker with physical...

5.9AI score0.00152EPSS
SaveExploits0References2
Packet Storm News
Packet Storm News
added 2026/08/04 12:0 a.m.13 views

Breaking ACDGV MinRank Gabidulin Encryption Schemes over Matrix Codes

Enhanced Gabidulin Matrix Codes EGMC, introduced by Aragon, Couvreur, Dyseryn, Gaborit, and Vincotte at Asiacrypt 2024, were designed to hide the algebraic structure of Gabidulin matrix codes while enabling very compact McEliece- and Niederreiter-type encryption schemes, with ciphertexts as small...

5.5AI score
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/08/04 12:0 a.m.21 views

PT-2026-67671

In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp process asconf caches the transport the ASCONF chunk is processed against in asconf-transport == chunk-transport, set once in sctp rcv. For an ASCONF located...

5.4AI score0.00476EPSS
SaveExploits1References6
NVD
NVD
added 2026/08/03 10:16 p.m.8 views

CVE-2026-67617

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

4.8CVSS0.00161EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/03 9:53 p.m.37 views

CVE-2026-67617

CVE-2026-67617 (Microweber CMS 2.0.20) describes a stored XSS in the content tagging system. An admin-authenticated attacker can inject arbitrary JavaScript by submitting payloads to the tag_names parameter of the GET /api/save_content_admin endpoint. The vulnerability allegedly bypasses three sa...

4.8CVSS5.5AI score0.00161EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/03 9:53 p.m.43 views

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

4.8CVSS0.00161EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/03 9:53 p.m.5 views

CVE-2026-67617 Microweber CMS 2.0.20 Stored XSS via tag_names Parameter

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

4.8CVSS5.5AI score
SaveExploits0References5
NVD
NVD
added 2026/08/03 9:16 p.m.9 views

CVE-2026-18737

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...

7.1CVSS0.00241EPSS
SaveExploits0References3
Rows per page
Query Builder