Lucene search
+L

125470 matches found

Github Security Blog
Github Security Blog
added 2026/06/10 12:31 a.m.7 views

Spring Security OAuth2 Authorization Server: Authorization endpoint performs insufficient validation of the request_uri parameter

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

6.1CVSS5.3AI score0.00172EPSS
SaveExploits0References4Affected Software1
NVD
NVD
added 2026/06/10 12:16 a.m.20 views

CVE-2026-46543

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.5.0, a remote peer can crash any full node by sending a RequestBatchSet message containing the genesis block's hash. The handler calls getepochchunks which iterates...

5.3CVSS0.00291EPSS
SaveExploits0References3
NVD
NVD
added 2026/06/10 12:16 a.m.16 views

CVE-2026-41837

Spring Data REST's Querydsl integration accepts arbitrary persistent property paths as request-parameter filter keys and does not consider Jackson customizations before handing them to Querydsl. Affected versions: Spring Data REST 3.7.0 through 3.7.19; 4.3.0 through 4.3.16; 4.4.0 through 4.4.14;...

5.3CVSS0.00191EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/10 12:16 a.m.38 views

CVE-2026-41706

Spring Security's CookieRequestCache and CookieServerRequestCache store the pre-authentication request URL in a browser cookie so that users can be redirected back to their intended destination after a successful login. In affected versions, the full absolute URL is stored in the cookie and is us...

6.1CVSS0.00211EPSS
SaveExploits0References1
NVD
NVD
added 2026/06/10 12:16 a.m.22 views

CVE-2026-41008

Spring Security Authorization Server's authorization endpoint performs insufficient validation of the requesturi parameter. An attacker can craft a malicious authorization request containing an invalid requesturi and an arbitrary, unvalidated redirecturi, which can lead to an Open Redirect...

6.1CVSS0.00172EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.29 views

PT-2026-48540

Due to the combination of checking out PR head branches attacker-controlled, reading .mcp.json from the working directory via default setting sources, and unconditionally enabling all project MCP servers via enableAllProjectMcpServers, it was possible for an attacker who opened a PR containing a...

5.3CVSS6.3AI score0.00561EPSS
SaveExploits0References8
BDU FSTEC
BDU FSTEC
added 2026/06/10 12:0 a.m.6 views

The vulnerability of the formAddWebAuthUser() function in the Tenda W15E router software allows a hacker to trigger a service failure.

The vulnerability of the formAddWebAuthUser function in the Tenda W15E router’s microprogramming software is related to the issue of the operation going beyond the buffer in memory when processing the webAuthUserPwd parameter. Exploiting this vulnerability could allow a malicious actor to cause...

9CVSS6AI score0.00309EPSS
SaveExploits0References2Affected Software1
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.26 views

PT-2026-48386

Name of the Vulnerable Software and Affected Versions Xstore WordPress theme versions prior to 9.7.3 Description An issue exists where a parameter is not properly sanitized and escaped before being used in a SQL statement. This occurs via an AJAX action that is accessible to unauthenticated users...

8.6CVSS6.1AI score0.01866EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.31 views

PT-2026-48500

In Splunk SOAR Security Orchestration, Automation, and Response versions below 8.5.0, an unauthenticated attacker could inject American National Standards Institute ANSI escape codes into SOAR application log files through specially crafted HTTP request paths, which a terminal emulator might...

4.3CVSS5.5AI score0.00199EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.44 views

PT-2026-48553

Yoast Duplicate Post through 4.6 contains a cross-site request forgery vulnerability in the duplicate post dismiss notice handler, which verifies no nonce or capability. Attackers can trick any authenticated user into sending a request that sets the duplicate post show notice site option,...

5.1CVSS5.2AI score0.00104EPSS
SaveExploits0References3
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.35 views

Splunk SOAR 安全漏洞

Splunk SOAR is a security orchestration, automation, and response platform provided by Splunk Inc. Versions of Splunk SOAR prior to 8.5.0 contained a security vulnerability. This vulnerability stemmed from SOAR failing to strip control characters from the HTTP request path before writing...

4.3CVSS5.3AI score0.00199EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.19 views

WordPress plugin Easy Twitter Feeds 跨站请求伪造漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

5.1CVSS5.2AI score0.00104EPSS
SaveExploits0References1
Snyk
Snyk
added 2026/06/10 12:0 a.m.8 views

Server-side Request Forgery (SSRF)

Overview org.springframework.ws:spring-ws-core is a product of the Spring community focused on creating document-driven Web services. Spring Web Services aims to facilitate contract-first SOAP service development, allowing for the creation of flexible web services using one of the many ways to...

8.9CVSS5.5AI score0.00383EPSS
SaveExploits0References2
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.22 views

Roxy-WI 操作系统命令注入漏洞

Roxy-WI is an open-source web interface designed for managing Haproxy, Nginx, and Keepalived servers. Versions of Roxy-WI 8.2.6.4 and earlier contained a vulnerability related to operating system command injection. This vulnerability stemmed from the POST /config/versions/route request, which...

8.8CVSS5.6AI score0.00304EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/10 12:0 a.m.23 views

PT-2026-48442

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, POST /config/versions////save interpolates the URL-path configver parameter directly into a config-version path that ends up at os.systemf"dos2unix -q cfg". configver is not run...

8.8CVSS5.5AI score0.00304EPSS
SaveExploits0References2
BDU FSTEC
BDU FSTEC
added 2026/06/10 12:0 a.m.9 views

The vulnerability in the built-in reverse proxy server of the Go programming language allows a hacker to perform an SSRF attack.

The vulnerability of the built-in reverse proxy server in the Go programming language is related to insufficient checking of requests on the server side. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack...

5.3CVSS5.8AI score0.0039EPSS
SaveExploits0References6Affected Software2
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.30 views

Nimiq 安全漏洞

Nimiq is an open-source implementation of the Albatross protocol in Rust. Versions of Nimiq prior to 1.5.0 contained a security vulnerability. This vulnerability occurred when processing RequestBatchSet messages that contained the hash of the genesis block, causing Policy::macroblockbefore to cra...

5.3CVSS5.3AI score0.00291EPSS
SaveExploits0References2
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.21 views

Roxy-WI 输入验证错误漏洞

Roxy-WI is an open-source web interface designed for managing Haproxy, Nginx, and Keepalived servers. Versions of Roxy-WI 8.2.6.4 and earlier contain a vulnerability related to input validation errors. This vulnerability stems from the POST /waf///rule//save endpoint accepting the configfilename...

9.9CVSS5.5AI score0.00372EPSS
SaveExploits0References2
CNNVD
CNNVD
added 2026/06/10 12:0 a.m.27 views

WordPress plugin Yoast Duplicate Post 跨站请求伪造漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

5.1CVSS5.2AI score0.00104EPSS
SaveExploits0References1
Tenable Nessus
Tenable Nessus
added 2026/06/10 12:0 a.m.10 views

EulerOS 2.0 SP13 : busybox (EulerOS-SA-2026-2281)

According to the versions of the busybox package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request- target path/query, allowing the request line ...

6.5CVSS7.2AI score0.00291EPSS
SaveExploits1References2
Rows per page
Query Builder