Lucene search
+L

1759 matches found

OSSF Malicious Packages
OSSF Malicious Packages
added yesterday2 views

Malicious code in @onereach/step-conversation (npm)

npm/@onereach/step-conversation is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

5.6AI score
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added yesterday2 views

Malicious code in @onereach/step-run-snowflake-query (npm)

npm/@onereach/step-run-snowflake-query is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized...

5.8AI score
SaveExploits0References8
Nuclei
Nuclei
added yesterday14 views

WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting

Code for Recovery 12 Step Meeting List versions up to 3.14.33 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft a malicious URL. id:...

7.1CVSS5.3AI score0.0059EPSS
SaveExploits0References4
OSV
OSV
added 6 days ago6 views

BIT-SQLITE-2026-51296

SQLite 3.41 has a use-after-free vulnerability in jsonRemoveFunc of SQLite JSON module. The parsed JSON object is freed at line 3555, while line 3575 still calls jsonLookupStep with the released pointer. Remote attackers can exploit this flaw to crash the service and leak heap memory information...

7AI score0.00332EPSS
SaveExploits0References3
OSV
OSV
added 6 days ago4 views

CLEANSTART-2026-DP50592 Security fixes in step-issuer 0.10.2-r2

Package step-issuer version 0.10.2-r2 fixes 3 vulnerabilities: CVE-2026-42507, CVE-2026-42504, CVE-2026-27145...

7.5CVSS5.4AI score0.00591EPSS
SaveExploits0References1
OSV
OSV
added 6 days ago6 views

CLEANSTART-2026-IZ98962 Security fixes in step 0.30.2-r0

Package step version 0.30.2-r0 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, ghsa-mpwr-8vm7-h73f...

7.5CVSS7AI score0.00591EPSS
SaveExploits0References1
OSV
OSV
added 6 days ago5 views

CLEANSTART-2026-DE61610 Security fixes in step-issuer-fips 0.9.9-r2

Package step-issuer-fips version 0.9.9-r2 fixes 2 vulnerabilities: CVE-2025-61727, CVE-2025-61729...

7.5CVSS7.7AI score0.00464EPSS
SaveExploits2References1
OSV
OSV
added 6 days ago6 views

CLEANSTART-2026-YW87628 Security fixes in step 0.28.7-r2

Package step version 0.28.7-r2 fixes 6 vulnerabilities: CVE-2026-46600, CVE-2026-56852, CVE-2026-39822, CVE-2026-42505, CVE-2025-66406...

7.8CVSS7.4AI score0.00446EPSS
SaveExploits0References1
OSV
OSV
added 6 days ago4 views

CLEANSTART-2026-ID94434 Security fixes in step-issuer 0.10.2-r3

Package step-issuer version 0.10.2-r3 fixes 4 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-39822, CVE-2026-42505...

7.8CVSS5.4AI score0.00446EPSS
SaveExploits0References1
OSV
OSV
added 6 days ago5 views

CLEANSTART-2026-KO29814 Security fixes in step-issuer 0.9.10-r0

Package step-issuer version 0.9.10-r0 fixes 1 vulnerabilities: CVE-2025-61729...

7.5CVSS7.7AI score0.00464EPSS
SaveExploits2References1
OSV
OSV
added 6 days ago5 views

CLEANSTART-2026-LA03825 Security fixes in step-issuer 0.9.11-r1

Package step-issuer version 0.9.11-r1 fixes 60 vulnerabilities: CVE-2025-68121, CVE-2025-61726, CVE-2025-61728, CVE-2025-61730, CVE-2025-69725...

10CVSS7.4AI score0.01945EPSS
SaveExploits4References1
OSV
OSV
added 6 days ago5 views

CLEANSTART-2026-UR44491 Security fixes in step-issuer 0.10.1-r0

Package step-issuer version 0.10.1-r0 fixes 4 vulnerabilities: CVE-2026-30836, CVE-2026-33186, ghsa-q4r8-xm5f-56gw, ghsa-p77j-4mvh-x3m3...

10CVSS5.3AI score0.01557EPSS
SaveExploits1References1
OSV
OSV
added 6 days ago5 views

CLEANSTART-2026-XV94605 Security fixes in step-issuer 0.12.0-r0

Package step-issuer version 0.12.0-r0 fixes 4 vulnerabilities: CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-39822, CVE-2026-42505...

7.8CVSS5.8AI score0.00446EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/07/29 5:17 a.m.9 views

CVE-2026-64555

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for ARM64 architecture, specifically affecting nested virtualization. The kvmhyphandlemops function, responsible for handling certain virtualization operations, incorrectly restored the SPSREL2 register. This occurred because...

8.8CVSS5.8AI score0.00128EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/28 9:45 p.m.5 views

GHSA-VX7X-VCC2-C44G datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

Summary datamodel-code-generator's anti-SSRF guard validates the resolved IP of a fetch target once and then lets httpx perform its own independent DNS resolution to connect, so the validated address is never pinned. A hostname that resolves to a public IP at validation time and a private IP at...

7.5CVSS6AI score0.00197EPSS
SaveExploits0References4
Github Security Blog
Github Security Blog
added 2026/07/28 2:25 p.m.16 views

Pocket ID has a reauthentication bypass via one-time access token login — passkey step-up requirement defeated by JWT freshness check that accepts any login method

Reauthentication Bypass via One-Time Access Token Login Summary A weaker authentication method OTA token or signup token is accepted as passkey step-up proof, yielding unauthorized renewable 30-day OIDC refresh tokens for clients explicitly configured with RequiresReauthentication: true. The POST...

6AI score
SaveExploits0References4Affected Software1
NVD
NVD
added 2026/07/28 9:16 a.m.8 views

CVE-2026-14516

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

7.5CVSS0.0029EPSS
SaveExploits0References5
EUVD
EUVD
added 2026/07/28 8:34 a.m.4 views

EUVD-2026-49720

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

7.5CVSS6AI score0.0029EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/28 8:34 a.m.32 views

CVE-2026-14516 Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staffids' parameter in all versions up to, and including, 27.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

7.5CVSS0.0029EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/28 7:16 a.m.9 views

CVE-2026-15012

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...

5.3CVSS0.00317EPSS
SaveExploits0References12
Rows per page
Query Builder