Lucene search
+L

51508 matches found

NVD
NVD
added 2026/08/06 10:18 p.m.8 views

CVE-2026-5336

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

6.8CVSS0.00395EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/06 10:17 p.m.11 views

CVE-2026-48079

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

7.4CVSS0.00386EPSS
SaveExploits0References3
OSV
OSV
added 2026/08/06 9:33 p.m.7 views

GHSA-2RP4-X2J7-QMCC Craft CMS: Stored XSS in the control panel via unescaped draft name

The control-panel helper that renders element chip/card labels writes an element's draftName into the page without HTML-encoding it, while the surrounding path segments are encoded. A low-privilege control-panel user who can create a draft of an element for example, an entry controls the draft...

5.1CVSS5.6AI score0.0019EPSS
SaveExploits0References4
Snyk
Snyk
added 2026/08/06 9:33 p.m.29 views

Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the draftName field in the control panel rendering process. An attacker can execute arbitrary JavaScript in the session of higher-privileged users by crafting a...

6.4CVSS5.3AI score0.0019EPSS
SaveExploits0References2
OSV
OSV
added 2026/08/06 9:00 p.m.9 views

CVE-2026-48079 OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

7.4CVSS5.4AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/08/06 9:00 p.m.28 views

CVE-2026-48079 OpenReception's logout page clears local access_token before server-side revocation, leaving duplicated tokens valid until expiry

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, when a user navigates to the /logout page, the page's server-side load handler deletes the accesstoken cookie before calling /api/auth/logout via an internal...

7.4CVSS0.00386EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/06 9:00 p.m.69 views

CVE-2026-48079

OpenReception’s OpenReception appointment-booking software before v1.0.2 suffers a logout-order flaw: the logout page deletes the access_token cookie before invoking the server-side logout. As a result, internal fetches for /api/auth/logout run without the auth cookie, so apiAuthHandle rejects th...

7.4CVSS5.5AI score0.00386EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/08/06 8:45 p.m.11 views

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the condition.config process. An attacker can execute arbitrary operating system commands, read sensitive...

8.8CVSS5.6AI score0.00447EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/06 8:33 p.m.13 views

crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption

A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security TLS session resumption when certificate authority CA settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing ...

10CVSS5.5AI score0.00765EPSS
SaveExploits1References8
RedhatCVE
RedhatCVE
added 2026/08/06 4:36 p.m.15 views

CVE-2026-56846

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system. Mitigation ...

7.5CVSS7.2AI score0.00623EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/06 4:36 p.m.28 views

CVE-2026-5336 Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

6.8CVSS0.00395EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/06 3:36 p.m.45 views

CVE-2026-7867 Udisks2: udisks2: local privilege escalation via as-user option spoofing

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

7.8CVSS0.00175EPSS
SaveExploits0References5
NVD
NVD
added 2026/08/06 3:16 p.m.9 views

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

9.8CVSS0.00424EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/06 3:16 p.m.18 views

CVE-2026-53976

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

9.3CVSS0.01899EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/06 2:24 p.m.10 views

EUVD-2026-53936

OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...

9.3CVSS5.7AI score0.01899EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/06 1:54 p.m.30 views

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

9.1CVSS0.00424EPSS
SaveExploits0References1
CVE
CVE
added 2026/08/06 1:54 p.m.56 views

CVE-2026-54489

Dell Virtual Storage Integrator for VMware vSphere Client (pre-10.11.1.0) contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially disclose information and hijack active sessions, impersonating users (including admins). Dell recommends upgrad...

9.8CVSS5.6AI score0.00424EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/08/06 1:54 p.m.13 views

EUVD-2026-53931

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...

9.1CVSS5.6AI score0.00424EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/06 1:18 p.m.11 views

CVE-2026-66732

Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for...

8.3CVSS0.00122EPSS
SaveExploits0References2
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/06 1:04 p.m.21 views

Malicious code in agenttunnels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1 agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker agenttunnels-session.lakshman111.workers.dev...

5.8AI score
SaveExploits0References6
Rows per page
Query Builder