Lucene search
+L

8 matches found

Kitploit
Kitploit
added 2026/09/18 1:16 p.m.11 views

CVE-2026-66754-Remote-Denial-of-Service-via-Reachable-Assertion-in-URL-Prefix-Handling-rouille-

보안 권고: URL 접두사 처리의 도달 가능한 단언을 통한 원격 서비스 거부 rouille 지정된 CVE ID: CVE-2026-66754 요약 Request::removeprefix는 퍼센트 디코딩된 URL을 검사하지만 원시raw URL에 대해 단언assert합니다. 디코딩된 경로가 접두사로 시작하지만 원시 경로는 그렇지 않은 요청은 검사를 통과한 뒤 단언에 실패합니다. 접두사의 한 문자만 퍼센트 인코딩하면 충분합니다. 기본 빌드에서는 패닉이 포착되어 500으로 처리됩니다. panic = "abort"로 빌드한 경우에는 이를...

8.2CVSS5.9AI score0.00401EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/06/30 12:48 p.m.20 views

EUVD-2026-40309

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argument is a string. Non-string mount paths arrays of paths and regular expressions are left unprefixed inside prefixed plugin scopes, so middleware registered with those forms doe...

9.1CVSS5.8AI score0.00522EPSS
SaveExploits0References2
NVD
NVD
added 2026/05/07 4:16 a.m.31 views

CVE-2026-42216

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init reconstructs strings from a prefix-compressed...

9.1CVSS0.00465EPSS
SaveExploits1References10
AlpineLinux
AlpineLinux
added 2026/05/07 4:01 a.m.71 views

CVE-2026-42216

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init reconstructs strings from a prefix-compressed...

9.1CVSS5.8AI score0.00465EPSS
SaveExploits1
OSV
OSV
added 2026/02/18 10:30 p.m.18 views

GHSA-H3RV-Q4RQ-PQCV LibreNMS: SQL Injection in ajax_table.php spreads through a covert data stream.

Summary SQL Injection in IPv6 Address Search functionality via address parameter A SQL injection vulnerability exists in the ajaxtable.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is...

9.3CVSS6.6AI score0.07723EPSS
SaveExploits2References4
CNNVD
CNNVD
added 2026/02/11 12:00 a.m.17 views

Chevereto 代码注入漏洞

Chevereto is a graph-based program. The Chevereto 3.13.4 Core version has a code injection vulnerability, which stems from improper handling of database table prefix parameters. This vulnerability may lead to remote code execution...

9.8CVSS6.1AI score0.01006EPSS
SaveExploits0References4
RedHat Linux
RedHat Linux
added 2024/09/03 10:32 a.m.16 views

ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths

A flaw was found in Ghostscript. When the gpvalidatepathlen function validates a path, it distinguishes between absolute and relative paths. In the case of relative paths, it will check the path with and without the current-directory-prefix "foo" and "./foo". This does not take into account paths...

6.3CVSS5.8AI score0.00515EPSS
SaveExploits0References4
Redos
Redos
added 2023/04/06 12:00 a.m.8 views

ROS-20230406-21

A vulnerability in the curl program is related to data exchange using the TELNET protocol, which could allow an attacker to pass a specially crafted username and "telnet parameters" during a server negotiation. Exploitation of the vulnerability could allow an attacker acting remotely, to send...

9.8CVSS7.8AI score0.02195EPSS
SaveExploits2
Rows per page
Query Builder