Lucene search
+L

123748 matches found

SUSE CVE
SUSE CVE
added 2026/08/11 12:03 a.m.12 views

SUSE CVE-2026-58427

Private org member list leaked via /members API endpoint - incomplete fix for PR 38145...

7.5CVSS5.6AI score0.00342EPSS
SaveExploits0References2
SUSE CVE
SUSE CVE
added 2026/08/11 12:03 a.m.9 views

SUSE CVE-2026-58443

Public-only repository tokens can update private PR head branches...

9.1CVSS5.6AI score0.00578EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/08/11 12:00 a.m.19 views

PT-2026-70823

Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request body. Attackers can inject comments into private video...

5.4CVSS5.5AI score0.00223EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/08/11 12:00 a.m.25 views

PT-2026-70141

Name of the Vulnerable Software and Affected Versions Friendica versions prior to 2026.08-dev Description An authenticated user with a self-registered account can perform a server-side request forgery SSRF through the link-preview endpoint. This occurs because the endpoint fetches user-supplied...

6.5CVSS5.2AI score0.00201EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/08/11 12:00 a.m.11 views

PT-2026-70938

Kestra is an open-source, event-driven orchestration platform. Prior to 2.0.0, Kestra's core/src/main/java/io/kestra/core/runners/pebble/functions/HttpFunction.java passes the user-controlled http uri argument to URI.create and the server-side HTTP client without restricting private, loopback, or...

8.6CVSS5.4AI score0.00368EPSS
SaveExploits0References2
NVD
NVD
added 2026/08/10 10:17 p.m.15 views

CVE-2026-72916

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...

6.3CVSS0.00359EPSS
SaveExploits0References9
CVE
CVE
added 2026/08/10 9:19 p.m.83 views

CVE-2026-72916

Mastodon CVE-2026-72916 affects PrivateAddressCheck.private_address? in app/lib/private_address_check.rb, which incorrectly normalized IPv4-mapped IPv6 addresses and did not recognize IPv4-compatible IPv6 addresses with IPAddr#ipv4_compat?. This allowed an attacker to bypass ALLOWED_PRIVATE_ADDRE...

6.3CVSS5.3AI score0.00359EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/08/10 9:19 p.m.17 views

EUVD-2026-55839

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...

6.3CVSS5.3AI score0.00359EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/08/10 9:19 p.m.34 views

CVE-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...

6.3CVSS0.00359EPSS
SaveExploits0References9
NVD
NVD
added 2026/08/10 7:17 p.m.13 views

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

8.7CVSS0.00687EPSS
SaveExploits1References3
CVE
CVE
added 2026/08/10 6:26 p.m.76 views

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 expose a missing authorization vulnerability in POST /api/v1/openai-assistants-file/download. An unauthenticated attacker can bypass the global authentication whitelist to bypass session and API key verification and retrieve private files by supplying valid ch...

8.7CVSS5.5AI score0.00687EPSS
SaveExploits1References3Affected Software1
Vulnrichment
Vulnrichment
added 2026/08/10 6:26 p.m.15 views

CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

8.7CVSS5.5AI score0.00687EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2026/08/10 6:26 p.m.15 views

CVE-2026-71962

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

8.7CVSS5.5AI score0.00687EPSS
SaveExploits1References4Affected Software1
Cvelist
Cvelist
added 2026/08/10 6:26 p.m.38 views

CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

8.7CVSS0.00687EPSS
SaveExploits1References3
NVD
NVD
added 2026/08/10 4:19 p.m.15 views

CVE-2026-72724

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/oneboxhandler.rb resolves Chat::Thread by route threadid independently of the route channelid before checking whether the user can preview the selected chat channel. An...

4.3CVSS0.00458EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/08/10 4:05 p.m.13 views

EUVD-2026-55665

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply stream. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...

6.5CVSS5.3AI score0.00332EPSS
SaveExploits0References5
CVE
CVE
added 2026/08/10 3:59 p.m.57 views

CVE-2026-72724

Discourse vulnerability CVE-2026-72724 affects the chat onebox flow. Prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/onebox_handler.rb resolves Chat::Thread by route thread_id independently of the route channel_id before verifying preview permissions, allowing ...

4.3CVSS5.3AI score0.00458EPSS
SaveExploits0References9
OSV
OSV
added 2026/08/10 3:59 p.m.16 views

CVE-2026-72724 Discourse: Private Chat Threat Message Disclosure via Chat Onebox Channel/Threat ID Mismatch

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, plugins/chat/lib/chat/oneboxhandler.rb resolves Chat::Thread by route threadid independently of the route channelid before checking whether the user can preview the selected chat channel. An...

4.3CVSS5.4AI score
SaveExploits0References11
OSV
OSV
added 2026/08/10 3:54 p.m.22 views

CVE-2026-72722 Discourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extractfrom, TopicLink.ensureentryfor, and TopicLink.duplicatelookup do not consistently enforce Guardian.cansee? checks when processing internal links. An authenticated user can submit...

4.3CVSS5.4AI score
SaveExploits0References11
CVE
CVE
added 2026/08/10 3:54 p.m.170 views

CVE-2026-72722

Discourse (open‑source discussion platform) contains a vulnerability in TopicLink processing prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. The affected components are TopicLink.extract_from, TopicLink.ensure_entry_for, and TopicLink.duplicate_lookup. The root cause is that Guardia...

4.3CVSS5.3AI score0.00324EPSS
SaveExploits0References9
Rows per page
Query Builder