Lucene search
+L

95 matches found

Github Security Blog
Github Security Blog
added 2026/09/10 3:11 p.m.3 views

n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint

Impact The OAuth Dynamic Client Registration endpoints validated field sizes only for redirecturis, leaving clientname and granttypes bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database...

8.7CVSS0.00291EPSS
SaveExploits0References5Affected Software1
Kitploit
Kitploit
added 2026/09/10 8:50 a.m.3 views

IFA

IFA Ataque de Inundación de Disco mediante IndexedDB IFA es una Prueba de Concepto PoC que demuestra cómo un atacante puede explotar la API IndexedDB en navegadores web populares para llevar a cabo un ataque de inundación de disco. Este ataque aprovecha específicamente la falta de restricciones e...

5.9AI score
SaveExploits0
Nuclei
Nuclei
added 2026/09/09 2:52 a.m.14 views

Langflow < 1.9.1 - Unauthenticated File Upload

Langflow 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access. id: CVE-2026-55450 info: name: Langflow 1.9.1 - Unauthenticated File Upload author: xtr0n...

9.3CVSS5.7AI score0.0119EPSS
SaveExploits1References1
CVE
CVE
added 2026/09/08 9:29 p.m.11 views

CVE-2026-86075

n8n , an open-source workflow automation platform, contains an unauthenticated storage exhaustion vulnerability in its OAuth Dynamic Client Registration endpoint. Prior to versions 2.37.7 and 2.38.2 , the endpoint properly bounded redirect_uris but accepted arbitrarily large client_name and grant...

8.7CVSS0.00291EPSS
SaveExploits0References3
OSV
OSV
added 2026/09/08 9:29 p.m.6 views

CVE-2026-86075 n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...

8.7CVSS5.7AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/08 9:29 p.m.26 views

CVE-2026-86075 n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirecturis but accepted arbitrarily large clientname and granttypes values. An unauthenticated remote caller could repeatedly persist oversized values in...

8.7CVSS0.00291EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/09/08 12:00 a.m.5 views

PT-2026-88506

Impact The OAuth Dynamic Client Registration endpoints validated field sizes only for redirect uris, leaving client name and grant types bounded by presence checks alone. An unauthenticated remote caller could submit arbitrarily large values in either field and have them persisted to the database...

8.7CVSS0.00291EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/09/07 10:23 p.m.8 views

EUVD-2026-72535

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...

8.2CVSS5.9AI score0.00401EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/06 1:22 p.m.6 views

CVE-2020-14065

Icewarp Email Server 12.3.0.1 unlimitedfileupload https://nvd.nist.gov/vuln/detail/CVE-2020-14065...

6.5CVSS6.5AI score0.01462EPSS
SaveExploits0
NVD
NVD
added 2026/08/31 9:17 p.m.14 views

CVE-2026-71415

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

7.1CVSS0.00246EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/31 8:46 p.m.10 views

CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

7.1CVSS5.8AI score
SaveExploits0References6
CVE
CVE
added 2026/08/31 8:46 p.m.22 views

CVE-2026-71415

Kirby CMS (versions 5.0.0–5.5.2) contains a flaw in its REST API chunk upload handler (src/Api/Upload.php). The method Kirby\Api\Upload::process() failed to execute the relevant upload authorization preflight before processChunk() persisted chunk data. An authenticated user holding the access.pan...

7.1CVSS5.8AI score0.00246EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/31 8:46 p.m.36 views

CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

7.1CVSS0.00246EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/31 8:46 p.m.12 views

EUVD-2026-68808

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

7.1CVSS5.8AI score0.00246EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/08/31 8:46 p.m.10 views

CVE-2026-71415 Kirby: File upload permissions are not checked during processing of chunk data

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

7.1CVSS5.2AI score0.00246EPSS
SaveExploits0References4
NVD
NVD
added 2026/08/29 5:17 p.m.12 views

CVE-2026-82472

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

8.7CVSS0.00406EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2026/08/29 4:35 p.m.39 views

CVE-2026-82472 Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

8.7CVSS0.00406EPSS
SaveExploits0References4
CVE
CVE
added 2026/08/29 4:35 p.m.25 views

CVE-2026-82472

Documenso before 2.13.0 exposes the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. This allows unauthenticated attackers to upload arbitrary PDF files indefinitely, potentially exhausting storage resources or filling the database with unlinked...

8.7CVSS6AI score0.00406EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/08/29 4:35 p.m.12 views

EUVD-2026-68128

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

8.7CVSS6AI score0.00406EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/29 4:35 p.m.18 views

CVE-2026-82472 Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf

Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked docume...

8.7CVSS6AI score
SaveExploits0References6
Rows per page
Query Builder