Lucene search
+L

7895 matches found

OSV
OSV
added 2026/07/08 11:36 a.m.13 views

BIT-PYTHON-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module Python 3.15+ and "asyncio introspection capabilities" 3.14+, "python -m asyncio ps" and "python -m asyncio pstree" features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via t...

5.3CVSS5.7AI score0.00132EPSS
SaveExploits0References7
OSV
OSV
added 2026/07/08 11:31 a.m.22 views

BIT-LIBPYTHON-2026-5713 Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target

The "profiling.sampling" module Python 3.15+ and "asyncio introspection capabilities" 3.14+, "python -m asyncio ps" and "python -m asyncio pstree" features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via t...

5.3CVSS5.7AI score0.00132EPSS
SaveExploits0References7
NVD
NVD
added 2026/07/07 5:16 p.m.22 views

CVE-2026-23698

Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager import function, which extracts contents...

8.6CVSS0.00867EPSS
SaveExploits2References3
OSV
OSV
added 2026/07/07 3:26 p.m.9 views

GO-2026-5820 Mattermost doesn't archive the channel before removing persistent notifications in github.com/mattermost/mattermost-server

Mattermost doesn't archive the channel before removing persistent notifications in github.com/mattermost/mattermost-server...

6.5CVSS6.6AI score0.00172EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/07 4:17 a.m.17 views

CVE-2026-34168

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allowing an authenticated user to set a...

8.8CVSS0.00403EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/07 3:15 a.m.34 views

CVE-2026-42143 Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, user-controlled persistent volume names are interpolated into shell commands executed on managed servers without escaping or validation, allowing an authenticated member to...

8.8CVSS0.00435EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/07 3:5 a.m.36 views

CVE-2026-34168 Coolify: Command injection via unsanitized persistent storage name in docker volume commands

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allowing an authenticated user to set a...

8.8CVSS0.00403EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/07 3:5 a.m.53 views

EUVD-2026-41986

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allowing an authenticated user to set a...

8.8CVSS6AI score0.00403EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/07 3:5 a.m.8 views

CVE-2026-34168

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the LocalPersistentVolume.name field is interpolated directly into docker volume shell commands without shell argument escaping, allowing an authenticated user to set a...

8.8CVSS6AI score0.00403EPSS
SaveExploits0References4Affected Software1
CVE
CVE
added 2026/07/07 3:5 a.m.31 views

CVE-2026-34168

CVE-2026-34168 affects Coolify prior to 4.0.0-beta.471. The vulnerability arises from the LocalPersistentVolume.name field being interpolated directly into docker volume commands without shell-escaping, enabling an authenticated user to inject and execute commands on managed servers when the reso...

8.8CVSS6AI score0.00403EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/07 12:0 a.m.24 views

PT-2026-56136

Name of the Vulnerable Software and Affected Versions Coolify versions prior to 4.0.0-beta.471 Description Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. An authenticated user can execute commands on managed servers when a resource is deleted...

8.8CVSS6AI score0.00403EPSS
SaveExploits0References7
NVD
NVD
added 2026/07/06 9:16 p.m.14 views

CVE-2025-59615

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization...

7.8CVSS0.00064EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/06 8:9 p.m.11 views

EUVD-2025-210436

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization...

6.6CVSS6AI score0.00064EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/07/06 8:9 p.m.11 views

CVE-2025-59615

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization...

6.6CVSS6AI score0.00064EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/06 6:53 p.m.13 views

MAL-2026-6851 Malicious code in metrica-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acc9d835dca527dc5e6db2124ca93898cd3f4f8bf0b6589a60c0eceed23314d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.9AI score
SaveExploits0References1
OSV
OSV
added 2026/07/06 6:53 p.m.15 views

MAL-2026-6821 Malicious code in express-guardrail (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40e91ddac990897c8c43891c5abf64696a0e9d9d4b168e7a6e5f4a827e4f040d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.9AI score
SaveExploits0References1
OSV
OSV
added 2026/07/06 6:52 p.m.12 views

MAL-2026-6811 Malicious code in chalks-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 869473c144b82d7a8d2b10aee4e19061c20e777604902932a3c14632aea446b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

5.9AI score
SaveExploits0References1
RedHat Linux
RedHat Linux
added 2026/07/06 3:2 p.m.6 views

RabbitMQ: RabbitMQ: Persistent foreign bindings allow unauthorized message routing

A flaw was found in RabbitMQ, a messaging and streaming broker. This vulnerability allows an attacker to establish persistent foreign bindings to reply-to destinations. This occurs because temporary queues are not properly removed, leaving behind active routing entries. This can lead to...

8.8CVSS5.8AI score0.00382EPSS
SaveExploits1References10
NVD
NVD
added 2026/07/06 11:16 a.m.16 views

CVE-2026-4249

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service conditio...

8.6CVSS0.00339EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/06 10:16 a.m.66 views

CVE-2026-4249 Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Products Causing Persistent Service Disruption

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service conditio...

8.6CVSS0.00339EPSS
SaveExploits0References1
Rows per page
Query Builder