Lucene search
+L

6719 matches found

Github Security Blog
Github Security Blog
added yesterday4 views

rclone: Verbose Stack Trace Disclosure in RC API Error Responses

Summary When an RC API call triggers a panic recovered by the job runner, the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. Details The panic recovery in...

5.7AI score
SaveExploits0References4Affected Software1
CVE
CVE
added yesterday13 views

CVE-2026-12762

CVE-2026-12762 affects IBM Cloud Pak for Business Automation versions 24.0.0, 24.0.1, 25.0.0, and 26.0.0. The issue could allow a remote attacker to obtain sensitive information exposed in manifest files. The available documents do not specify the exact root cause, vulnerable component, or exploi...

5.3CVSS5.5AI score
SaveExploits0References1
NVD
NVD
added yesterday4 views

CVE-2026-6639

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

7.5CVSS0.00367EPSS
SaveExploits0References6
EUVD
EUVD
added yesterday5 views

EUVD-2026-53171

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6. This is due to the getCurrentTaskResults method in modules/workspace/controller.php being accessible without authentication or authorizati...

7.5CVSS5.5AI score0.00367EPSS
SaveExploits0References6
CVE
CVE
added yesterday15 views

CVE-2026-6639

The CVE concerns the AI Chatbot & Workflow Automation by AIWU WordPress plugin (

7.5CVSS5.5AI score0.00367EPSS
SaveExploits0References6
Nuclei
Nuclei
added yesterday120 views

TrakSYS 11.x.x - Sensitive Data Exposure

A vulnerability was found in Parsec Automation TrackSYS 11.x.x and classified as problematic. This issue affects some unknown processing of the file /TS/export/pagedefinition. The manipulation of the argument ID leads to direct request. The attack may be initiated remotely. The exploit has been...

6.9CVSS5AI score0.02053EPSS
SaveExploits0References4
Nuclei
Nuclei
added yesterday26 views

ListingPro < 2.6.1 - Sensitive Data Disclosure

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...

5.3CVSS5.9AI score0.01608EPSS
SaveExploits1References2
Nuclei
Nuclei
added yesterday56 views

Joomla! Component Music Manager - Local File Inclusion

A directory traversal vulnerability in the Music Manager component for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the cid parameter to album.html. id: CVE-2010-2857 info: name: Joomla! Component Music Manager - Local Fil...

6.8CVSS5.9AI score0.04848EPSS
SaveExploits2References5
Nuclei
Nuclei
added yesterday67 views

DedeCMS 5.7.109 - Server-Side Request Forgery

Manipulation of the rssurl parameter in codo.php leads to server-side request forgery in DedeCMS version 5.7.109. id: CVE-2023-3578 info: name: DedeCMS 5.7.109 - Server-Side Request Forgery author: ritikchaddha severity: critical description: | Manipulation of the rssurl parameter in codo.php lea...

9.8CVSS6.3AI score0.0357EPSS
SaveExploits1References2
Nuclei
Nuclei
added yesterday31 views

Easy Appointments <= 3.12.21 - Information Disclosure

Easy Appointments WordPress plugin = 3.12.21 contains a sensitive information exposure caused by an unauthenticated REST API endpoint /wp-json/wp/v2/eablocks/eaappointments/ registered with permissioncallback allowing unrestricted access, letting unauthenticated attackers extract sensitive custom...

7.5CVSS7.4AI score0.0239EPSS
SaveExploits1References2
Nuclei
Nuclei
added yesterday21 views

Scoold < 1.64.0 - Authentication Bypass

Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT...

8.7CVSS5.4AI score0.01035EPSS
SaveExploits0References3
Nuclei
Nuclei
added yesterday38 views

WordPress JobWP Plugin <= 2.3.9 - SQL Injection

The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

7.5CVSS7.9AI score0.01677EPSS
SaveExploits0References2
Nuclei
Nuclei
added yesterday53 views

Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure

The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code id: CVE-2023-6065 info: name: Quttera Web Malware Scanner = 3.4.1.48 - Sensitive Data Exposure...

5.3CVSS6.7AI score0.18697EPSS
SaveExploits2References3
Nuclei
Nuclei
added yesterday25 views

PraisonAI AgentOS - Information Disclosure

PraisonAI's AgentOS FastAPI application server exposes an unauthenticated GET /api/agents endpoint that lists every registered agent's name, role and the opening of its instructions system prompt. No authentication is enforced on the route, allowing a remote attacker to enumerate agent...

7.3CVSS7.5AI score0.28571EPSS
SaveExploits4
Nuclei
Nuclei
added yesterday33 views

Netgear R6850 - Information Disclosure

Netgear R6850 router firmware version V1.1.0.88 contains an information leakage vulnerability in the currentsetting.htm page.This hidden interface is not protected by authentication, allowing unauthenticated attackers to access sensitive informationsuch as firmware version, model details,...

7.5CVSS5.5AI score0.01923EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2 days ago5 views

CVE-2026-63456

Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...

9.8CVSS5.6AI score0.00428EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2 days ago41 views

CVE-2026-63456

The CVE-2026-63456 entry describes multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator that allow an unauthenticated remote attacker to bypass web authentication and access system functions. The attacker could view and modify potentially sensitive information ...

9.8CVSS5.6AI score0.00428EPSS
SaveExploits0References1
Nuclei
Nuclei
added 2 days ago68 views

Palo Alto Networks Expedition - OS Command Injection

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...

9.8CVSS7.8AI score0.78532EPSS
SaveExploits0References3
OSV
OSV
added 2 days ago2 views

CVE-2026-70372 Koha: SQL Injection in reports/bor_issues_top.pl

Koha's reports/borissuestop.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Criteria parameter is only normalized by a table-name prefix and is never whitelisted, landing verbatim in identifier positions SELECT...

8.8CVSS5.8AI score
SaveExploits0References7
RedHat Linux
RedHat Linux
added 3 days ago3 views

axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection

A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker...

6.3CVSS5.5AI score0.00258EPSS
SaveExploits0References6
Rows per page
Query Builder