Lucene search
+L

298197 matches found

NVD
NVD
added yesterday6 views

CVE-2026-10526

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

5.8CVSS0.00142EPSS
SaveExploits0References1
CVE
CVE
added yesterday24 views

CVE-2026-18754

CVE-2026-18754 affects GV-AS1620 Controller Firmware (GV-Cloud). The firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. The exposed private key can compromise HTTPS confidentiality and integrity, enabling traffic decryption and potential ser...

9.1CVSS5.5AI score0.00313EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday41 views

CVE-2026-18754 Hardcoded Cryptographic Key on GV-AS1620 Controller Firmware (GV-Cloud)

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS0.00313EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday6 views

EUVD-2026-52638

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score0.00313EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday4 views

CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score0.00313EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added yesterday6 views

EUVD-2026-52637

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score0.00313EPSS
SaveExploits0References1
CVE
CVE
added yesterday25 views

CVE-2026-18753

CVE-2026-18753 concerns GV-AS1620 Controller Firmware (GV-ASManager). The firmware contains an embedded, static RSA private key used by the Lighttpd web server for TLS termination. Exposure of this private key allows attackers to decrypt HTTPS traffic and spoof the server, compromising confidenti...

9.1CVSS5.5AI score0.00313EPSS
SaveExploits0References1
NVD
NVD
added yesterday6 views

CVE-2026-16881

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profi...

8.7CVSS0.00262EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added yesterday4 views

Security Bulletin: IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability (CVE-2026-14529)

Summary IBM WebSphere Application Server and WebSphere Application Server Liberty, which are bundled with IBM WebSphere Hybrid Edition, are affected by a server-side request forgery vulnerability when sipServlet-1.1 is enabled. Vulnerability Details Refer to the security bulletins listed in the...

9.8CVSS5.5AI score0.00333EPSS
SaveExploits0Affected Software1
IBM Security Bulletins
IBM Security Bulletins
added yesterday5 views

Security Bulletin: Multiple Vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and WebSphere Application Server Liberty due to the July 2026 CPU

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

8.1CVSS7.8AI score0.00463EPSS
SaveExploits1Affected Software1
CVE
CVE
added yesterday14 views

CVE-2026-14939

The Visualizer WordPress plugin is affected: versions before 4.0.6 expose a vulnerability where an attacker with Contributor-level access can supply a URL that is not validated to safe address ranges, enabling server-side requests (SSRF) to link-local instance-metadata endpoints. The fetched resp...

6.8CVSS5.5AI score0.00135EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday10 views

EUVD-2026-52588

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

6.8CVSS5.5AI score0.00135EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday43 views

CVE-2026-14939 Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched...

0.00135EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday43 views

CVE-2026-10526 EmbedPress < 4.6.1 - Unauthenticated Blind SSRF

The EmbedPress WordPress plugin before 4.6.1 does not validate user-supplied URLs before making server-side requests through unauthenticated endpoints, allowing unauthenticated attackers to induce the site to send HTTP requests to internal hosts and services that WordPress core URL validation doe...

0.00142EPSS
SaveExploits0References1
CVE
CVE
added yesterday11 views

CVE-2026-10526

CVE-2026-10526 : The EmbedPress WordPress plugin (pre-4.6.1) does not validate user-supplied URLs before making server-side requests via unauthenticated endpoints, enabling a blind Server-Side Request Forgery (SSRF) that can force the site to issue HTTP requests to internal hosts and services not...

5.8CVSS5.3AI score0.00142EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday9 views

EUVD-2026-52580

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

5.3CVSS5.5AI score0.00137EPSS
SaveExploits0References1
CVE
CVE
added yesterday17 views

CVE-2026-16536

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 is affected by an unauthenticated Server-Side Request Forgery (SSRF) due to not validating a user-supplied URL before performing a server-side request (via the calendar_id flow). Root cause: absence of URL validation i...

5.3CVSS5.5AI score0.00137EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday37 views

CVE-2026-16536 Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id

The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal...

0.00137EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday41 views

CVE-2026-16623 Create Block Theme < 2.10.0 - Admin+ PHP Code Injection via Pattern Save (Multisite)

The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator who holds the capability gating this action but is denied the capability that normally gates PHP file editin...

0.00153EPSS
SaveExploits0References1
CVE
CVE
added yesterday24 views

CVE-2026-16881

The LINE Android app (before 26.7.2) contains a vulnerability in the profile rendering component where externally supplied script content embedded in profile templates is not adequately validated or sandboxed. This can allow crafted profile content to execute arbitrary code with the app’s privile...

8.7CVSS5.7AI score0.00262EPSS
SaveExploits0References1
Rows per page
Query Builder