Lucene search
+L

124305 matches found

CVE
CVE
added 3 days ago20 views

CVE-2026-58047

Technical details (affected product/version, root cause, exploitability) are not publicly provided in the supplied documents. Monitor for updates from CVE sources to obtain concrete impact, remediation, and affected configurations.

5.6CVSS5.4AI score0.00445EPSS
SaveExploits0References2
Github Security Blog
Github Security Blog
added 3 days ago10 views

OnionShare Receive mode writes uploaded files even when file uploads are disabled

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...

5.4CVSS5.7AI score0.0023EPSS
SaveExploits0References4Affected Software1
OSV
OSV
added 3 days ago6 views

GHSA-V833-3823-CMHP OnionShare Receive mode writes uploaded files even when file uploads are disabled

Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...

5.4CVSS5.7AI score0.0023EPSS
SaveExploits0References4
NVD
NVD
added 3 days ago10 views

CVE-2026-56568

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

3.7CVSS0.00195EPSS
SaveExploits0References1
EUVD
EUVD
added 3 days ago8 views

EUVD-2026-51545

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

5.3CVSS5.6AI score0.00259EPSS
SaveExploits0References3
Cvelist
Cvelist
added 3 days ago31 views

CVE-2026-59231 Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

5.3CVSS0.00259EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 3 days ago6 views

CVE-2026-59231

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

5.3CVSS5.6AI score0.00259EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 3 days ago6 views

CVE-2026-56568

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

3.7CVSS5.5AI score0.00195EPSS
SaveExploits0References2
EUVD
EUVD
added 3 days ago10 views

EUVD-2026-51542

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

3.7CVSS5.5AI score0.00195EPSS
SaveExploits0References1
Cvelist
Cvelist
added 3 days ago37 views

CVE-2026-56568 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

3.7CVSS0.00195EPSS
SaveExploits0References1
Veracode
Veracode
added 3 days ago7 views

Server-Side Request Forgery (SSRF)

datamodel-code-generator is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to http.getbody in src/datamodelcodegenerator/http.py accepting --url targets and redirect chain targets without proper host/IP validation, which allows an attacker to perform server-side request...

8.2CVSS5.5AI score0.00209EPSS
SaveExploits0References3Affected Software1
EUVD
EUVD
added 3 days ago11 views

EUVD-2026-51509

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

7.5CVSS5.8AI score0.0051EPSS
SaveExploits0References2
Cvelist
Cvelist
added 3 days ago36 views

CVE-2026-15722 389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

A stack buffer overflow flaw was found in 389 Directory Server 389-ds-base. The getruvelementfromberval function in repl5ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP...

7.5CVSS0.0051EPSS
SaveExploits0References2
CVE
CVE
added 3 days ago11 views

CVE-2026-15722

The CVE-2026-15722 entry concerns a pre-authentication stack buffer overflow in 389-ds-base. The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking, allowing a remote unauthentic...

7.5CVSS5.8AI score0.0051EPSS
SaveExploits0References2
NVD
NVD
added 3 days ago7 views

CVE-2026-12721

The Kirki WordPress plugin before 6.0.13 does not properly sanitise and escape a value taken from the request before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...

8.6CVSS0.00262EPSS
SaveExploits0References1
NVD
NVD
added 3 days ago7 views

CVE-2026-14317

The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled...

5.3CVSS0.00221EPSS
SaveExploits0References1
Nuclei
Nuclei
added 3 days ago91 views

Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)

Keycloak 12.0.1 and below allows an attacker to force the server to request an unverified URL using the OIDC parameter requesturi. This allows an attacker to execute a server-side request forgery SSRF attack. id: CVE-2020-10770 info: name: Keycloak = 12.0.1 - requesturi Blind Server-Side Request...

5.3CVSS6.3AI score0.69724EPSS
SaveExploits5References5
Nuclei
Nuclei
added 3 days ago167 views

GeoServer WPS - Server Side Request Forgery

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing Service WPS specification is designed to process information from any server using GET and POST requests. This presents the opportunity for Server Side Request...

9.8CVSS7.5AI score0.67715EPSS
SaveExploits0References4
Nuclei
Nuclei
added 3 days ago24 views

Spring Data REST < 2.6.9 (Ingalls SR9) / 3.0.1 (Kay SR1) - PATCH Request Remote Code Execution

Spring Data REST 2.6.9 and 3.0.1, Spring Boot 1.5.9 and 2.0 M6 contain a remote code execution caused by processing malicious PATCH requests with crafted JSON data, letting attackers execute arbitrary Java code, exploit requires sending malicious PATCH requests. id: CVE-2017-8046 info: name: Spri...

9.8CVSS8.7AI score0.74355EPSS
SaveExploits8References5
Nuclei
Nuclei
added 3 days ago163 views

SAP NetWeaver Development Infrastructure - Server Side Request Forgery

Server-Side Request Forgery SSRF vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who has access to the...

9.9CVSS7.5AI score0.67699EPSS
SaveExploits0References5
Rows per page
Query Builder