Lucene search
+L

124410 matches found

ATTACKERKB
ATTACKERKB
added 6 days ago7 views

CVE-2026-24033

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the iss...

7.2CVSS5.8AI score0.00168EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 6 days ago7 views

EUVD-2026-50170

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.3, from 9.0.0 through 9.2.14. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the iss...

7.2CVSS5.8AI score0.00168EPSS
SaveExploits0References1
CVE
CVE
added 6 days ago10 views

CVE-2026-14234

This entry describes a stored XSS vulnerability in the WOLF WordPress plugin before version 1.1.0. The issue arises because an AJAX action does not perform a nonce or capability check, allowing an unauthenticated attacker to trick a logged-in administrator into posting arbitrary content, includin...

7.1CVSS5.9AI score0.00099EPSS
SaveExploits0References1
EUVD
EUVD
added 6 days ago6 views

EUVD-2026-50115

The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which invokes an attacker-supplied PHP function with an attacker-supplied argument array, allowing unauthenticated attackers to call arbitrary functions f...

9.8CVSS6.3AI score0.00536EPSS
SaveExploits0References1
Cvelist
Cvelist
added 6 days ago30 views

CVE-2026-11974 Media folder Addon <= 4.1.6 - Unauthenticated Arbitrary File Download

The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

0.00489EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 6 days ago7 views

CVE-2026-11974

The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

5.8AI score0.00489EPSS
SaveExploits0References1
Nuclei
Nuclei
added 6 days ago90 views

Cisco VPN Routers - Unauthenticated Arbitrary File Upload

A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to insufficient authorization enforcement...

9.8CVSS6.9AI score0.88874EPSS
SaveExploits0References5
Nuclei
Nuclei
added 6 days ago111 views

SPIP BigUp Plugin - Remote Code Execution

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. id: CVE-2024-8517 info: name: SPIP BigUp Plugin - Remote Code Execution...

9.8CVSS7.5AI score0.94614EPSS
SaveExploits7References5
Positive Technologies
Positive Technologies
added 6 days ago8 views

PT-2026-65732

Apache Traffic Server truncates over-long header names, allowing header aliasing, request smuggling, and policy bypass. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

9.3CVSS5.8AI score0.00261EPSS
SaveExploits0References2
OSV
OSV
added 6 days ago4 views

UBUNTU-CVE-2026-66752

tiny-http through 0.12.0 contains an HTTP request smuggling vulnerabil...

6.3CVSS5.8AI score0.00237EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 6 days ago10 views

Linux Distros Unpatched Vulnerability : CVE-2026-58222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller AD DC. When processing...

8.8CVSS5.6AI score0.00839EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 6 days ago9 views

PT-2026-65870

V through 0.5.2, fixed in commit 85859f0, contains a server-side request forgery SSRF bypass vulnerability that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. Attackers can craft a URL containing a backslash in the authori...

8.6CVSS5.9AI score0.00391EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 6 days ago8 views

PT-2026-65915

undici does not validate the type property of a duck-typed blob-like request body before using it as the Content-Type header on the HTTP/1.1 dispatcher. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, an application that passes a hand-rolled blob-like...

4.2CVSS5.9AI score0.00142EPSS
SaveExploits0References13
Tenable Nessus
Tenable Nessus
added 6 days ago5 views

Linux Distros Unpatched Vulnerability : CVE-2026-64648

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a...

6CVSS5.8AI score0.00336EPSS
SaveExploits0References2
Tenable Nessus
Tenable Nessus
added 6 days ago7 views

NewStart CGSL MAIN 6.06 : ipv6nat-selinux Multiple Vulnerabilities (NS-SA-2026-0054)

The remote NewStart CGSL host, running version MAIN 6.06, has ipv6nat-selinux packages installed that are affected by multiple vulnerabilities: - net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization bypass in some applications. This...

9.8CVSS7.3AI score0.08359EPSS
SaveExploits1References13
Tenable Nessus
Tenable Nessus
added 6 days ago8 views

Linux Distros Unpatched Vulnerability : CVE-2026-67182

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed...

7.5CVSS5.9AI score0.00415EPSS
SaveExploits1References2
Tenable Nessus
Tenable Nessus
added 6 days ago10 views

Linux Distros Unpatched Vulnerability : CVE-2026-58150

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server does not reject Transfer-Encoding in HTTP/2 requests, allowing downgrade request smuggling. This issue affects Apache Traffic Server: from...

10CVSS5.8AI score0.00245EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
added 6 days ago8 views

Linux Distros Unpatched Vulnerability : CVE-2026-57834

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0...

10CVSS5.8AI score0.00262EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 6 days ago8 views

PT-2026-65723

Apache Traffic Server allows request smuggling if chunked messages are malformed. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue...

10CVSS5.8AI score0.00262EPSS
SaveExploits0References2
EUVD
EUVD
added 6 days ago6 views

EUVD-2025-210526

An Insecure Direct Object Reference IDOR in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request...

7.5CVSS5.9AI score0.00232EPSS
SaveExploits0References1
Rows per page
Query Builder