Lucene search
+L

215264 matches found

Nuclei
Nuclei
added 2026/09/17 2:05 a.m.10 views

N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing

A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4 id: CVE-2026-86206 info: name: N-able N-central - Access Control Bypass via Path Confusion and Forwarded Header Spoofing author:...

7.7CVSS6AI score0.00734EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.4 views

GEO my WP <=4.5.5.3 - Unauthenticated Local File Inclusion

GEO my WP WordPress plugin = 4.5.5.3 contains a local file inclusion caused by improper handling in gmwpostslocatorajaxinfowindowloader function, letting unauthenticated attackers execute arbitrary PHP code remotely. id: CVE-2026-85200 info: name: GEO my WP =4.5.5.3 - Unauthenticated Local File...

7.5CVSS6.1AI score0.01903EPSS
SaveExploits0References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.20 views

Lyrion Music Server <= 9.2.0 - Cross-Site Scripting

Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...

6.1CVSS6.1AI score0.00406EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.38 views

Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Privilege Escalation via Authorization Bypass in all versions up to, and including, 3.3.9. The vulnerability exists because the podsadmin AJAX router funnels every access check — including the method allowlist, nonce...

9.8CVSS5.9AI score0.02791EPSS
SaveExploits4References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.15 views

Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE

iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges. id: CVE-2026-48939 info: name: Joomla iCagenda 3.9.10 - Unauthenticated Arbitrary File...

10CVSS6.4AI score0.20069EPSS
SaveExploits5References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.14 views

WPZOOM Portfolio <= 1.4.21 - Reflected Cross-Site Scripting

WPZOOM Portfolio = 1.4.21 contains a reflected XSS caused by improper neutralization of input during web page generation, letting attackers execute scripts in victim's browser, exploit requires crafted request. id: CVE-2026-49069 info: name: WPZOOM Portfolio = 1.4.21 - Reflected Cross-Site...

7.1CVSS5.8AI score0.01171EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.33 views

vLLM 0.8.3 - 0.14.0 - Information Disclosure

vLLM 0.8.3 to - 0.14.1 contains an information disclosure caused by leaking a heap address in error messages from the multimodal endpoint when processing invalid images, letting remote attackers reduce ASLR entropy, exploit requires sending invalid images. id: CVE-2026-22778 info: name: vLLM 0.8....

9.8CVSS7AI score0.03723EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.29 views

OpenCATS - Command Injection

OpenCATS prior to commit 3002a29 contains a command injection caused by injection of PHP statements into the installer AJAX endpoint's databaseConnectivity action parameter, letting unauthenticated attackers execute arbitrary code, exploit requires incomplete installation wizard. id: CVE-2026-277...

9.2CVSS6.2AI score0.34629EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.13 views

Podlove Podcast Publisher <= 4.5.1 - Arbitrary File Upload

Podlove Podcast Publisher plugin for WordPress through 4.5.1 is vulnerable to arbitrary file uploads due to missing file type validation in the podlovehandlecachefiles function. The image cache derives the stored file extension from the path of the attacker supplied source URL, while the image...

9.8CVSS5.9AI score0.03757EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.37 views

Hippoo Mobile App for WooCommerce <= 1.9.4 - Authentication Bypass to Admin Account Takeover

Hippoo Mobile App for WooCommerce WordPress plugin = 1.9.4 contains an authentication bypass caused by logic conflation in user permission checks, letting unauthenticated attackers take over administrator accounts via REST API password reset. id: CVE-2026-10580 info: name: Hippoo Mobile App for...

9.8CVSS5.8AI score0.02948EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.10 views

InvoicePlane <= 1.6.3 - Arbitrary File Read

InvoicePlane through 1.6.3 is vulnerable to an unauthenticated path traversal in the guest "Get::getfile" controller. The supplied filename is passed to readfile after a single urldecode with no directory-traversal validation, allowing an unauthenticated attacker to read files outside the...

9.3CVSS5.8AI score0.04108EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.33 views

OpenBullet2 <= 0.3.2 - Authentication Bypass

OpenBullet2 = 0.3.2 contains an authentication bypass caused by improper API key authentication middleware handling empty X-Api-Key header, letting unauthenticated attackers gain admin access, exploit requires sending empty X-Api-Key header. id: CVE-2026-25555 info: name: OpenBullet2 = 0.3.2 -...

9.8CVSS5.7AI score0.01824EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.45 views

Glances - Information Disclosure

Glances 4.5.2 contains an information disclosure vulnerability caused by the web server running without authentication by default, letting remote attackers access sensitive system information including credentials, exploit requires no special privileges. id: CVE-2026-32596 info: name: Glances -...

8.7CVSS7.6AI score0.0155EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.13 views

parisneo/lollms < 2.2.0 - Authenticated Stored XSS

parisneo/lollms 2.2.0 contains a stored XSS caused by unsanitized user input in createpost function in backend/routers/social/init.py, letting attackers inject malicious scripts executed in user browsers, exploit requires crafted post submission. id: CVE-2026-1115 info: name: parisneo/lollms 2.2....

9.6CVSS8.1AI score0.0121EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.38 views

Dashy <= 4.3.6 - Reflected XSS via Workspace

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...

3.9CVSS5.8AI score0.00284EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.12 views

Crawl4AI < 0.8.0 - Local File Inclusion

The Crawl4AI Docker API endpoints accepted arbitrary URL schemes without an allow-list. An unauthenticated request with a file:// URL could read local files. Fixed in 0.8.0, which restricts accepted URL schemes. id: CVE-2026-26217 info: name: Crawl4AI 0.8.0 - Local File Inclusion author:...

9.2CVSS5.9AI score0.01914EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.15 views

Arcane < 1.18.0 - Unauthenticated Template and Env Disclosure

Arcane 1.18.0 contains an information disclosure caused by missing authorization on /api/templates GET endpoints, letting unauthenticated network clients read sensitive Compose YAML and .env content, exploit requires network access id: CVE-2026-42461 info: name: Arcane 1.18.0 - Unauthenticated...

8.7CVSS8.1AI score0.01283EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.5 views

DB-GPT <= 0.8.1 - Arbitrary File Write

DB-GPT through 0.8.1 allows unauthenticated arbitrary file writes via a path traversal in the userid HTTP header of the POST /api/v1/python/file/upload endpoint, letting attackers escape the intended upload directory and write files anywhere, as confirmed by the reflected upload path in the JSON...

9.8CVSS5.8AI score0.05122EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.13 views

New API < v0.12.10 - Stripe Webhook Bypass

New API v0.12.10 contains a broken authentication caused by unauthenticated attacker forging Stripe webhook events, letting attackers credit arbitrary quota without payment, exploit requires no authentication. id: CVE-2026-41432 info: name: New API v0.12.10 - Stripe Webhook Bypass author: str4k3r...

8.2CVSS8.2AI score0.0085EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/17 2:05 a.m.21 views

OneUptime < 10.0.21 - Path Traversal

OneUptime 10.0.21 contains a path traversal caused by unsanitized componentName parameter in /workflow/docs/:componentName endpoint, letting unauthenticated attackers read arbitrary files from the server filesystem. id: CVE-2026-30958 info: name: OneUptime 10.0.21 - Path Traversal author:...

8.6CVSS8.2AI score0.01139EPSS
SaveExploits1References3
Rows per page
Query Builder