Lucene search
+L

4580 matches found

NVD
NVD
added 2026/07/14 8:17 p.m.12 views

CVE-2026-48784

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate used strtr dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters...

6.1CVSS0.00348EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/14 7:04 p.m.9 views

CVE-2026-48784 Symfony: UrlGenerator Dot-Segment Encoding Skips Every Other Chained `../` or `./` → Generated URL Collapses Off-Route Under RFC 3986 Normalization

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.53, 6.4.41, 7.4.13, and 8.0.13, UrlGenerator::doGenerate used strtr dot-segment encoding that skipped every other chained ../ or ./ segment, allowing attacker-controlled route parameters...

5.1CVSS6.1AI score
SaveExploits0References7
CVE
CVE
added 2026/07/14 5:43 p.m.162 views

CVE-2026-45065

CVE-2026-45065 affects Symfony’s UrlGenerator in the Symfony PHP framework. Prior to versions 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters with a pattern built as ^ + raw requirement + $, and ungrouped alternations can cause middle alternatives to match as unanchore...

6.1CVSS6.1AI score0.00348EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/07/14 5:43 p.m.16 views

CVE-2026-45065 Symfony: UrlGenerator Route-Requirement Bypass via Unanchored Regex Alternation → Off-Site //host URL Injection

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 5.4.52, 6.4.40, 7.4.12, and 8.0.12, UrlGenerator validates route parameters against a pattern built as ^ plus the raw requirement plus $; with ungrouped alternations, middle alternatives mat...

2.3CVSS6.1AI score
SaveExploits0References7
OSV
OSV
added 2026/07/14 3:47 p.m.12 views

BIT-NATS-2026-58253 NATS Server: Route API Auth Bypass

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when noauthuser was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

8.8CVSS6.1AI score0.00368EPSS
SaveExploits0References8
OSV
OSV
added 2026/07/14 8:45 a.m.9 views

BIT-GRAFANA-2026-8609 Pre-authentication denial of service via the OAuth login route

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance denial of service...

7.5CVSS6.1AI score0.00397EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 12:03 a.m.10 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the activity creation process when a user with the createactivity permission accesses the preset project creation route directly. An attacker can create new activities under unauthorized projects by specifying ...

5.3CVSS6.1AI score0.00257EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/14 12:03 a.m.26 views

GHSA-3Q6Q-26VG-V97X Kimai: Improper Authorization Through Activity Creation with Preset Project Allows Creation Under Unauthorized Projects

Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic createactivity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...

5.3CVSS6.1AI score0.00257EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/14 12:00 a.m.12 views

PT-2026-60088

Summary Kimai 2.56.0 contains an authenticated improper authorization vulnerability in the preset-project activity creation flow. A user with the generic create activity permission, but without access to a target project, can still create a new Activity under that unauthorized project by visiting...

5.3CVSS6.1AI score0.00257EPSS
SaveExploits0References8
Positive Technologies
Positive Technologies
added 2026/07/14 12:00 a.m.21 views

PT-2026-58922

NATS Server is a high-performance server for NATS.io, the cloud and edge native messaging system. Prior to 2.14.0, 2.12.7, and 2.11.16, when no auth user was configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an...

8.8CVSS6.1AI score0.00368EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/07/14 12:00 a.m.20 views

PT-2026-60095

Summary The ExportController web routes for creating and editing export templates are gated only by the class-level create export permission, which is granted to ROLE TEAMLEAD by default. The corresponding API routes and UI button visibility correctly require the stricter create export template...

5.3CVSS6.1AI score0.00356EPSS
SaveExploits0References8
NVD
NVD
added 2026/07/13 10:16 p.m.21 views

CVE-2026-62327

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

9.3CVSS0.00641EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/13 9:37 p.m.22 views

CVE-2026-62327

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

9.3CVSS6.1AI score0.00641EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/13 9:37 p.m.20 views

CVE-2026-62327 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

9.3CVSS6.1AI score0.02908EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/13 9:16 p.m.19 views

CVE-2026-58409

ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...

9.1CVSS0.00761EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/13 7:46 p.m.17 views

MAL-2026-10483 Malicious code in route-processor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 430b2eaa9fcc780c6e6a20639c32767b24ca2d47ba708c056c68bc78fb03e425 The package's default export builds a URL from split constants protocol/separator/domain/path/token resolving to https://svganchordev.net/icons/107,...

6AI score
SaveExploits0References2
OSV
OSV
added 2026/07/13 4:51 p.m.10 views

GHSA-VQ6J-HJ8W-7V39 Decidim: Forms admin question editor lacks authorization

Description A participant can load the demographics questionnaire admin editor and make changes. Technical description The demographics questionnaire editor should require admin access, but the route under /admin/demographics/questions renders the editor interface without checking whether the...

5.4CVSS6.1AI score0.00171EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/13 4:51 p.m.20 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the demographics questionnaire admin editor interface due to missing authorization checks on the /admin/demographics/questions route. An attacker can gain unauthorized access to administrative question-managemen...

5.4CVSS6.1AI score0.00171EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/13 4:51 p.m.15 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the demographics questionnaire admin editor interface due to missing authorization checks on the /admin/demographics/questions route. An attacker can gain unauthorized access to administrative question-managemen...

5.4CVSS6.1AI score0.00171EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/13 3:46 p.m.15 views

PYSEC-2026-3399 Vantage6: No limit on emails sent for password/MFA reset

Impact Users can reset their MFA token via API routes that send them an email. Currently the number of emails that is sent is not limited. This gives attackers the option to flood someones mailbox with a lot of emails, and would have adverse effects on the SMTP server which may be seen as spam...

2.1CVSS6.1AI score0.00278EPSS
SaveExploits0References7
Rows per page
Query Builder