CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

29165 matches found

Snyk•added 2026/05/18 9:0 p.m.•22 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score

SaveExploits0References2

Krebs on Security•added 2026/05/18 8:48 p.m.•23 views

CISA Admin Leaked AWS GovCloud Keys on Github

Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency CISA maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive...

5.8AI score

SaveExploits0

Cvelist•added 2026/05/18 6:40 p.m.•46 views

CVE-2026-45231 DumbAssets 1.0.11 Stored Cross-Site Scripting via Asset Fields

DumbAssets through 1.0.11 contains a stored cross-site scripting vulnerability in asset fields including name, description, modelNumber, serialNumber, and tags that are stored without server-side sanitization and rendered using innerHTML without client-side escaping. Attackers can create or updat...

6.1CVSS0.00186EPSS

SaveExploits0References2

OSV•added 2026/05/18 2:0 p.m.•12 views

CLEANSTART-2026-SW24654 Security fixes for CVE-2026-32280, CVE-2026-32281, CVE-2026-32282, CVE-2026-32283 applied in versions: 3.2.1-r0

Multiple security vulnerabilities affect the aws-load-balancer-controller package. These issues are resolved in later releases. See references for individual vulnerability details...

7.5CVSS7.4AI score0.00621EPSS

SaveExploits0References9

RedhatCVE•added 2026/05/18 1:57 a.m.•17 views

CVE-2024-13971

Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobsterpro prior to version 4.12.6-GA. This allows them to obtain read access to files on the application server and adjacent network shares, and perform HTTP GET requests to arbitrary services...

7.7CVSS6AI score0.0047EPSS

SaveExploits2References1

Positive Technologies•added 2026/05/18 12:0 a.m.•17 views

PT-2026-41718

Name of the Vulnerable Software and Affected Versions DumbAssets versions 1.0 through 1.0.11 Description A stored cross-site scripting issue exists in asset fields, specifically name, description, modelNumber, serialNumber, and tags. These fields are stored without server-side sanitization and...

6.1CVSS5.9AI score0.00186EPSS

SaveExploits0References5

CNNVD•added 2026/05/18 12:0 a.m.•16 views

DumbAssets 跨站脚本漏洞

DumbAssets is a physical asset tracking and management tool developed by DumbWare. Versions of DumbAssets 1.0.11 and earlier contained a cross-site scripting vulnerability. This vulnerability stemmed from a storage-based cross-site scripting issue in asset fields. It allowed attackers to create o...

6.1CVSS5.9AI score0.00186EPSS

SaveExploits0References1

BDU FSTEC•added 2026/05/18 12:0 a.m.•8 views

The vulnerability of the NSS component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to gain unauthorized access to protected information.

The vulnerability of the NSS component in Mozilla Firefox, Firefox ESR, and the email client Thunderbird is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected informatio...

7.8CVSS5.8AI score0.00269EPSS

SaveExploits0References12Affected Software4

Microsoft CVE•added 2026/05/16 8:4 a.m.•29 views

PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

...

7.5CVSS5.8AI score0.00471EPSS

SaveExploits0

Veracode•added 2026/05/16 5:32 a.m.•36 views

Server-Side Request Forgery

esm.sh is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation in the /https fetch route, where localhost and internal network protections rely on hostname string checks that can be bypassed using DNS alias domains, allowing attackers to induce...

8.6CVSS7.2AI score0.00339EPSS

SaveExploits1References4Affected Software1