4jfinder.github.io

Searchable Log4j database Searchable page for CISA Log4j CVE-2021-44228 Affected Vendor & Software List, maintained by the US Cybersecurity and Infrastructure Security Agency CISA. How to use Download the index.html and cisalist.css files and run from your local computer. Hosted version at...

CVE-2026-89267

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-89267

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when it is configured as an empty list. As a result, authenticated users can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on columns ...

CVE-2026-89267 starlette-admin 0.16.1 through 0.17.1 Searchable Fields Allowlist Bypass

starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchablefields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality an...

CVE-2026-79770

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

CVE-2026-79770: Inefficient Regular Expression Complexity

Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Nodecss, Nodeatcss, and Searchablesearch to cause...

EUVD-2026-45214

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards %...

Improved Leakage Abuse Attacks in Searchable Symmetric Encryption with EBPF Monitoring

Searchable Symmetric Encryption SSE allows users to search over encrypted data stored on untrusted servers, like cloud providers. While SSE hides the content of queries and documents, it still leaks patterns, such as how often a query is made. These leakages have been shown to enable leakage abus...

EUVD-2002-1650

Malware in sbrugna...

EUVD-2006-2748

Malware in sbrugna...

EUVD-2006-2750

Malware in sbrugna...

EUVD-2006-2747

Malware in sbrugna...

EUVD-2006-2749

Malware in sbrugna...

EUVD-2021-1968

Malware in sbrugna...

EUVD-2024-35229

Malicious code in bioql PyPI...

WordPress Custom Searchable Data Entry System plugin <= 1.7.1 - Unauthenticated Database Wiping vulnerability

Unauthenticated Database Wiping vulnerability discovered by Sean Murphy in WordPress Plugin Custom Searchable Data Entry System versions = 1.7.1...

CVE-2020-36852: Missing Authorization

The Custom Searchable Data Entry System plugin for WordPress is vulnerable to unauthenticated database wiping in versions up to, and including 1.7.1, due to a missing capability check and lack of sufficient validation on the ghazalesdsdeleteentriestablerow function. This makes it possible for...

Linux Distros Unpatched Vulnerability : CVE-2021-22147

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Elasticsearch before 7.14.0 did not apply document and field level security to searchable snapshots. This could lead to an authenticated user gaining access to...