Lucene search
+L

9109 matches found

OSV
OSV
added 2026/07/13 9:24 p.m.12 views

MGASA-2026-0242 Updated firefox, firefox-l10n, rootcerts, nss packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Privilege escalation in the Graphics: WebRender component. CVE-2026-12289 Memory safety bug fixed in Firefox ESR 140.12. CVE-2026-12290 Use-after-free in the Networking: HTTP component. CVE-2026-12291 Incorrect boundary conditions in the Web Audi...

9.6CVSS6.1AI score0.00493EPSS
SaveExploits0References5
Mageia
Mageia
added 2026/07/13 9:24 p.m.11 views

Updated thunderbird thunderbird-l10n packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Privilege escalation in the Graphics: WebRender component. CVE-2026-12289 Memory safety bug fixed in Thunderbird ESR 140.12. CVE-2026-12290 Use-after-free in the Networking: HTTP component. CVE-2026-12291 Incorrect boundary conditions in the Web...

9.6CVSS6.1AI score0.00493EPSS
SaveExploits0References5
RedHat Linux
RedHat Linux
added 2026/07/13 5:2 p.m.13 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS6AI score0.00189EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/13 3:19 p.m.9 views

PYSEC-2026-2678 OpenStack Neutron has an Incorrect Authorization issue

In OpenStack Neutron before 28.0.1, the tagging controller enforces plural policy action names on single-tag write operations while the defined policy rules use singular names. The mismatched names evaluate as allowed under the default policy, permitting a project reader to create and update tags...

5.3CVSS6.1AI score0.00295EPSS
SaveExploits0References8
RedHat Linux
RedHat Linux
added 2026/07/13 8:28 a.m.11 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS6AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/13 8:17 a.m.7 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS6AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/13 7:54 a.m.13 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS6AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/13 3:41 a.m.9 views

firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Networking: Cookies component...

9.1CVSS6AI score0.00189EPSS
SaveExploits0References6
RedHat Linux
RedHat Linux
added 2026/07/11 4:58 a.m.7 views

undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header

A flaw was found in undici. When undici processes Set-Cookie headers, it incorrectly interprets the SameSite attribute, accepting partial matches instead of exact ones. This allows a malicious server to downgrade a cookie's SameSite policy to a less secure setting, potentially leading to unintend...

3.7CVSS6.9AI score0.00238EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/10 11:16 p.m.12 views

CVE-2026-44383

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend...

8.7CVSS0.00448EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/10 10:28 p.m.10 views

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the UploadFileRequest process, which fails to properly sanitize SVG content unless PHP finfo reports image/svg+xml, and the...

8.7CVSS6.2AI score0.00347EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2026/07/10 10:11 p.m.11 views

CVE-2026-44383

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend...

8.7CVSS6.1AI score0.00448EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/07/10 10:11 p.m.36 views

CVE-2026-44383 Hydro-Québec Le Circuit Electrique charging station backend Insufficient Session Expiration

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend...

8.7CVSS0.00448EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/10 3:16 p.m.12 views

CVE-2026-38057

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an...

8.1CVSS0.00226EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/10 2:11 p.m.18 views

EUVD-2026-42907

The iDirect iQ200 does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie that lacks the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an...

8.1CVSS6.1AI score0.00226EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/07/10 11:34 a.m.10 views

CVE-2026-59930

A flaw was found in Mistune, a Python Markdown parser. The table of contents toc plugin and TableOfContents directive generate heading identifiers IDs as predictable values e.g., tocN without properly processing the heading text. This allows an attacker to control content with a colliding ID, whi...

4.3CVSS6AI score0.00138EPSS
SaveExploits1References6
RedHat Linux
RedHat Linux
added 2026/07/10 5:14 a.m.4 views

decompress: Decompress: File disclosure and corruption via arbitrary hardlink creation

A flaw was found in decompress. An attacker can craft a malicious archive that, when extracted, allows for arbitrary hardlink creation. This vulnerability occurs because the x.linkname field from hardlink entries in the archive is processed without proper validation, enabling an attacker to creat...

5.5CVSS5.9AI score0.00328EPSS
SaveExploits1References7
RedHat Linux
RedHat Linux
added 2026/07/10 3:39 a.m.4 views

js-yaml: js-yaml: Denial of Service via crafted YAML merge keys

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker can exploit this vulnerability by providing a specially crafted YAML document that repeatedly uses the same alias in a merge sequence. This can lead to algorithmic CPU exhaustion, causing the Node.js worker or eve...

5.3CVSS6.2AI score0.00378EPSS
SaveExploits1References5
EUVD
EUVD
added 2026/07/10 12:31 a.m.13 views

EUVD-2026-42768

decompress before 4.2.2 allows arbitrary hardlink creation during archive extraction, enabling file read disclosure and file corruption. When processing hardlink entries type === 'link', the x.linkname field from the archive is passed directly to fs.link without validation index.js line 113. An...

5.5CVSS6.1AI score0.00328EPSS
SaveExploits1References4
Snyk
Snyk
added 2026/07/10 12:30 a.m.16 views

Symlink Attack

Overview decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Symlink Attack via the fs.link process. An attacker can gain unauthorized access to sensitive files or corrupt file contents by crafting an archive containing a hardlink...

6.9CVSS6.1AI score0.00328EPSS
SaveExploits1References2
Rows per page
Query Builder