Lucene search
+L

125388 matches found

EUVD
EUVD
added 2026/06/15 9:55 p.m.14 views

EUVD-2026-37013

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body. In...

7.6CVSS5.3AI score0.00273EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/06/15 9:55 p.m.12 views

CVE-2026-48599 Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding

Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc allows authenticated attackers to access or modify resources belonging to other users by smuggling a conflicting value for any path-bound field via the query string or request body. In...

7.6CVSS5.3AI score0.00273EPSS
SaveExploits0References4
CVE
CVE
added 2026/06/15 9:55 p.m.30 views

CVE-2026-48854

The CVE-2026-48854 affects the elixir-grpc/grpc project. The vulnerability resides in Elixir.GRPC.Server.Adapters.Cowboy.Handler:read_full_body/3, which accumulates every received chunk into a growing binary with no size cap. If the grpc-timeout header is omitted, per-chunk read timeouts resolve ...

8.7CVSS5.4AI score0.00344EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/06/15 9:55 p.m.44 views

CVE-2026-48854 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':readfullbody/3...

8.7CVSS0.00344EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/06/15 9:55 p.m.11 views

CVE-2026-48854 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':readfullbody/3...

8.7CVSS5.3AI score0.00344EPSS
SaveExploits0References4
OSV
OSV
added 2026/06/15 9:55 p.m.8 views

CVE-2026-48854 Unbounded request body accumulation causes memory exhaustion in elixir-grpc/grpc

Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc allows unauthenticated attackers to exhaust the BEAM's memory and crash the server by streaming a large or slow-trickle unary request body. 'Elixir.GRPC.Server.Adapters.Cowboy.Handler':readfullbody/3...

8.7CVSS6AI score0.00344EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/06/15 9:30 p.m.12 views

EUVD-2025-210158

Administrator Server Side Request Forgery SSRF in PopAd = 1.0.4 versions...

4.4CVSS5.2AI score0.00168EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/15 9:30 p.m.13 views

EUVD-2026-36784

Incorrect access control in the webhook management component of Project Firefly III v6.5.9 allows attackers to scan internal resources via a crafted POST request...

5.3AI score0.00312EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/15 9:30 p.m.13 views

EUVD-2026-36778

An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request...

5.8AI score0.00476EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/15 9:30 p.m.18 views

EUVD-2026-36777

An issue in the uploadPostHandler component of Andrei Marcu linx-server v2.3.8 allows attackers to cause a Denial of Service DoS via a crafted POST request...

5.3AI score0.00324EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/15 9:30 p.m.17 views

EUVD-2026-36768

An information disclosure vulnerability in the configuration endpoint of Ben Busby whoogle-search v1.2.3 allows attackers to obtain sensitive information via a crafted GET request...

5.2AI score0.00308EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/06/15 9:30 p.m.17 views

EUVD-2026-36776

An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service DoS via a crafted request...

5.3AI score0.00441EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/15 9:17 p.m.14 views

CVE-2026-49043

Unauthenticated Cross Site Request Forgery CSRF in WP Migrate Lite = 2.7.8 versions...

4.7CVSS0.00153EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/06/15 8:54 p.m.3 views

CVE-2026-48017

DbGate is cross-platform database manager. In versions 7.1.8 and prior, the POST /runners/load-reader endpoint in DbGate accepts a functionName parameter that is directly interpolated into a JavaScript code template without any sanitization or validation. An authenticated user with basic access, ...

8.8CVSS6AI score0.00511EPSS
SaveExploits1References3Affected Software1
OSV
OSV
added 2026/06/15 8:46 p.m.16 views

GHSA-HVCG-QMG6-JM4C Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

Summary Before reading the first request-line, HttpObjectDecoder skips every byte for which Character.isISOControlb is true 0x00–0x1F and 0x7F as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance...

5.3CVSS5.4AI score0.00232EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/06/15 8:46 p.m.15 views

EUVD-2026-36468

Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted...

5.3CVSS5.3AI score0.00232EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/06/15 8:46 p.m.16 views

Netty: HttpObjectDecoder skips arbitrary initial control characters when only initial CRLF characters are permitted

Summary Before reading the first request-line, HttpObjectDecoder skips every byte for which Character.isISOControlb is true 0x00–0x1F and 0x7F as well as all whitespace. RFC 9112 §2.2 only asks servers to ignore empty CRLF lines preceding the request-line — a carefully scoped robustness allowance...

5.3CVSS5.3AI score0.00232EPSS
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 2026/06/15 8:39 p.m.75 views

Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS

Summary request.form accepts maxfields and maxpartsize to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an...

7.5CVSS5.5AI score0.00397EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/06/15 8:38 p.m.9 views

GHSA-JP82-JPQV-5VV3 Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

Summary In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example @google.com moves the authority boundary...

3.7CVSS5.5AI score0.00187EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/06/15 8:38 p.m.45 views

Starlette: Unvalidated request path concatenated into authority poisons request.url.hostname

Summary In affected versions, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating scheme://hostpath and re-parsing the result, a path that does not begin with / for example @google.com moves the authority boundary...

5.3CVSS5.5AI score0.00187EPSS
SaveExploits0References4Affected Software1
Rows per page
Query Builder