Lucene search
+L

22643 matches found

Nuclei
Nuclei
added 2026/08/25 6:03 a.m.101 views

Apache Solr <= 7.1 - XML Entity Injection

Apache Solr with Apache Lucene before 7.1 is susceptible to remote code execution by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulnerable to this. Note that the XML external...

9.8CVSS9.2AI score0.91896EPSS
SaveExploits12References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.200 views

Apache CouchDB 1.7.0 / 2.x < 2.1.1 - Remote Privilege Escalation

Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit users documents with duplicate keysfor 'roles' used for access control within the database, including the special case 'admin' role, th...

10CVSS8.3AI score0.99838EPSS
SaveExploits23References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.76 views

Navigate CMS 2.9.4 - Server-Side Request Forgery

Navigate CMS 2.9.4 is susceptible to server-side request forgery via feedparser class. This can allow a remote attacker to force the application to make arbitrary requests via injection of arbitrary URLs into the feed parameter, thus enabling possible theft of sensitive information, data...

4.9CVSS5.4AI score0.22903EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.213 views

Mongo-Express - Remote Code Execution

Mongo-Express before 1.0.0 is susceptible to remote code execution because it uses safer-eval to validate user supplied javascript. Unfortunately safer-eval sandboxing capabilities are easily bypassed leading to remote code execution in the context of the node server. id: CVE-2020-24391 info: nam...

9.8CVSS9.5AI score0.74519EPSS
SaveExploits0References5
Nuclei
Nuclei
added 2026/08/25 6:03 a.m.195 views

GitLab CE/EE - Remote Code Execution

GitLab CE/EE starting from 11.9 does not properly validate image files that were passed to a file parser, resulting in a remote command execution vulnerability. This template attempts to passively identify vulnerable versions of GitLab without the need for an exploit by matching unique hashes for...

10CVSS9.1AI score0.99731EPSS
SaveExploits29
NVD
NVD
added 2026/08/24 8:17 p.m.4 views

CVE-2026-76098

Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tokens. HTML rendering creates deeply nested emphasis tokens from consecutive asterisk characters, and recursive rendering in HTMLRenderer.rendertoken can excee...

7.5CVSS
SaveExploits0References2
CVE
CVE
added 2026/08/24 8:05 p.m.8 views

CVE-2026-76098

Mistune (Python Markdown parser) versions 3.3.0 through 3.3.2 are vulnerable to Denial of Service via deeply nested emphasis tokens. When HTML rendering processes consecutive asterisk characters, recursive calls in HTMLRenderer.render_token() can exceed Python's recursion limit, raising a Recursi...

7.5CVSS5.3AI score
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/24 4:39 p.m.3 views

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

6.3CVSS5.5AI score0.00431EPSS
SaveExploits1References8
RedHat Linux
RedHat Linux
added 2026/08/24 4:39 p.m.5 views

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

7.1CVSS5.6AI score0.003EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/08/24 4:36 p.m.5 views

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

7.1CVSS5.6AI score0.003EPSS
SaveExploits0References8
RedhatCVE
RedhatCVE
added 2026/08/24 3:22 p.m.6 views

CVE-2026-68552

A flaw was found in Coturn. An unauthenticated remote client can send a specially crafted STUN message over TCP or TLS. This message, with a specific body-length field, causes an integer truncation overflow, leading to the desynchronization of the stream parser. Consequently, the attacking client...

5.3CVSS5.1AI score0.00315EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/08/24 2:20 p.m.8 views

CVE-2026-50142

A flaw was found in libheif, a HEIF and AVIF file format decoder and encoder. A remote attacker can provide a specially crafted HEIF sequence that triggers an unbounded heap allocation. This occurs because the HEIF sequence parser's fixed-size mode is missing a bound check, and an integer...

7.5CVSS4.4AI score0.00556EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 10:16 a.m.8 views

CVE-2026-75931

fast-uri is a URI parser for Node.js. It canonicalizes a host to its ASCII form only when the input carries an explicit scheme, so a scheme-relative reference such as a host preceded by two slashes is returned with its host verbatim and no error set. As a result fast-uri's own entry points disagr...

7.5CVSS0.00425EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/24 10:16 a.m.11 views

CVE-2026-75975

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...

7.5CVSS0.00402EPSS
SaveExploits0References2
Debian CVE
Debian CVE
added 2026/08/24 10:07 a.m.4 views

CVE-2026-76172

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

7.5CVSS5.5AI score
SaveExploits0
EUVD
EUVD
added 2026/08/24 10:07 a.m.8 views

EUVD-2026-64773

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

7.5CVSS5.5AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/24 10:07 a.m.28 views

CVE-2026-76172 fast-uri vulnerable to host confusion via percent-encoded scheme normalization

fast-uri is a URI parser for Node.js. During parsing it runs a legacy decoding pass over the scheme component and never re-escapes the result, and serialization writes the scheme back out verbatim, unlike the host component which is re-escaped. As a result an input whose scheme carries...

7.5CVSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/24 9:58 a.m.8 views

EUVD-2026-64772

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...

7.5CVSS5.6AI score0.00402EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/24 9:58 a.m.18 views

CVE-2026-75975

fast-uri is a URI parser for Node.js whose custom bracketed IPv6 literal parser fails to validate the full IPv6 grammar. Invalid trailing text in an authority is silently discarded, causing a malformed attacker-controlled host to normalize to a different valid IPv6 destination (e.g., the unspecif...

7.5CVSS5.5AI score0.00402EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/24 9:58 a.m.23 views

CVE-2026-75975 fast-uri vulnerable to server-side request forgery via malformed IPv6 normalization

fast-uri is a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not validate the complete IPv6 grammar, so invalid trailing text in an authority can be silently discarded and a malformed attacker-controlled host is turned into a different valid IPv6 destination. For...

7.5CVSS0.00402EPSS
SaveExploits0References2
Rows per page
Query Builder