Lucene search
+L

10153 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added 5 days ago11 views

Malicious code in bigops-ui-themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f281ddf755708d180e0d2817df0e23c640fb1ab2d17441c7f35309bb37086bc1 index.js unconditionally requires./vendor at module load. vendor.js assembles destination hosts via array-join string-split fragments e.g...

5.6AI score
SaveExploits0References2
RedHat Linux
RedHat Linux
added 5 days ago11 views

postcss: PostCSS: Information disclosure via crafted sourceMappingURL

A flaw was found in PostCSS. A remote attacker can exploit this vulnerability by providing a specially crafted sourceMappingURL when a specific configuration the 'from' parameter is not set. This can cause the application to read and expose unintended source-map files, potentially revealing...

6.3CVSS5.5AI score0.00313EPSS
SaveExploits1References7
EUVD
EUVD
added 5 days ago9 views

EUVD-2026-53359

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

8.5CVSS5.5AI score0.0018EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 5 days ago3 views

CVE-2026-71274

OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...

8.5CVSS5.3AI score0.0018EPSS
SaveExploits0References2
EUVD
EUVD
added 5 days ago8 views

EUVD-2026-53358

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the webadminpasswordenabled parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click...

6.5CVSS5.5AI score0.00117EPSS
SaveExploits0References2
Cvelist
Cvelist
added 5 days ago38 views

CVE-2026-7726 Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action

The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the LayoutsWPBRemote::templatesync callback registered via wpajaxnoprivhandlesync in all versions up to, and including, 1.1.3. This makes it possible for unauthenticated...

6.5CVSS0.00267EPSS
SaveExploits0References6
EUVD
EUVD
added 5 days ago7 views

EUVD-2026-53045

A vulnerability was detected in H3C NX15 V100R017. Affected by this vulnerability is the function esps.wan.repeater.set/repeaterproc of the file /api/esps. Performing a manipulation of the argument my2P4key results in command injection. Remote exploitation of the attack is possible. The exploit i...

8.6CVSS5.3AI score0.02384EPSS
SaveExploits0References6
Snyk
Snyk
added 6 days ago7 views

Memory Allocation with Excessive Size Value

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the checkforlanguage function. An attacker can exhaust system memory by submittin...

7.5CVSS5.4AI score0.00521EPSS
SaveExploits0References2
NVD
NVD
added 6 days ago7 views

CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

6.9CVSS0.00521EPSS
SaveExploits0References7
OSV
OSV
added 6 days ago6 views

UBUNTU-CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

6.9CVSS5.4AI score0.00521EPSS
SaveExploits0References9
OSV
OSV
added 6 days ago6 views

CVE-2026-15337 Potential denial-of-service vulnerability in check_for_language()

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

6.9CVSS5.4AI score
SaveExploits0References11
ATTACKERKB
ATTACKERKB
added 6 days ago12 views

CVE-2026-15337

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

6.9CVSS5.4AI score0.00521EPSS
SaveExploits0References8Affected Software1
CVE
CVE
added 6 days ago53 views

CVE-2026-15337

Technical details are not publicly available in the provided documents. Monitor for updates.

6.9CVSS5.4AI score0.00521EPSS
SaveExploits0References7
Cvelist
Cvelist
added 6 days ago33 views

CVE-2026-15337 Potential denial-of-service vulnerability in check_for_language()

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.utils.translation.checkforlanguage is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory...

6.9CVSS0.00521EPSS
SaveExploits0References7
CVE
CVE
added 6 days ago57 views

CVE-2025-29296

H3C devices listed (BE18000 V200R007, NX400 V100R015, NX30 Pro V100R0011, R3010 V100R009, NX15 V100R017, R1510 V100R016, NE36 Pro V100R002) expose multiple command injection flaws in the /api/esps handler. Vulnerable interfaces include esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modi...

9.8CVSS6AI score0.0224EPSS
SaveExploits0References2
Amazon
Amazon
added 6 days ago6 views

Important: runfinch-finch

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...

7.8CVSS7.8AI score0.00447EPSS
SaveExploits0
ATTACKERKB
ATTACKERKB
added 6 days ago10 views

CVE-2025-29296

H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, H3C NE36 Pro V100R002 and H3C MC102G HM1A0V200R010 contain multiple command injection vulnerabilities in the /api/esps request handler. The...

9.8CVSS6AI score0.0224EPSS
SaveExploits0References3
CVE
CVE
added last week54 views

CVE-2026-18685

CVE-2026-18685 affects GL.iNet GL-MT3000 devices up to firmware 4.4.5, specifically the function set_upgrade in /cgi-bin/glc of the component modem.so. The issue enables remote command injection due to the underlying vulnerability; attack vector is network with no authentication and no user inter...

10CVSS7.2AI score0.01989EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added last week10 views

CVE-2026-18685

A security vulnerability has been detected in GL.iNet GL-MT3000 up to 4.4.5. Impacted is the function setupgrade of the file /cgi-bin/glc of the component modem.so. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly...

10CVSS7.2AI score0.01989EPSS
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added last week9 views

NPM: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields

NPM: undici vulnerable to cookie attribute injection via unsanitized domain and unparsed setCookie fields vulnerability discovered by ? in WordPress Npm undici versions 6.28.0...

6.5CVSS7.2AI score0.00167EPSS
SaveExploits0References10Affected Software1
Rows per page
Query Builder