Lucene search
+L

20879 matches found

Tenable Nessus
Tenable Nessus
added 2026/05/14 12:0 a.m.11 views

Unity Linux 20.1050a / 20.1060a / 20.1070a Security Update: git-lfs (UTSA-2026-021350)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-021350 advisory. Within HostnameError.Error, when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is...

7.5CVSS7.1AI score0.00464EPSS
SaveExploits2References4
CNNVD
CNNVD
added 2026/05/14 12:0 a.m.10 views

PostgreSQL 格式化字符串错误漏洞

PostgreSQL is a set of free object-relational database management systems developed by the PostgreSQL organization. This system supports most SQL standards and offers many other features, such as foreign keys, triggers, views, etc. Versions of PostgreSQL prior to 18.4, 17.10, 16.14, 15.18, and...

4.3CVSS5.9AI score0.00214EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/05/13 8:12 p.m.7 views

CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...

8.1CVSS5.8AI score0.00222EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2026/05/13 11:14 a.m.13 views

CLSA-2026-1778670864 php: Fix of CVE-2026-6735

CVE-2026-6735: HTML-encode proc.requesturi and tighten querystring entity flags in sapi/fpm/fpm/fpmstatus.c to fix XSS in PHP-FPM status endpoint...

8.8CVSS5.8AI score0.0021EPSS
SaveExploits1References1
UbuntuCve
UbuntuCve
added 2026/05/13 4:17 a.m.14 views

CVE-2026-8202

Using a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim, an authenticated user with aggregation permissions can pin CPU utilization at 100% for an extended period of time. This issue impacts MongoDB Server v7.0 versions prior to...

6.5CVSS5.8AI score0.00263EPSS
SaveExploits0References1
CNNVD
CNNVD
added 2026/05/13 12:0 a.m.13 views

Flight SQL注入漏洞

Flight is a PHP microframework developed by Mike Cao. Versions of Flight prior to 3.18.1 contained an SQL injection vulnerability. This vulnerability occurred because the methods SimplePdo::insert, SimplePdo::update, and SimplePdo::delete directly concatenated the $table parameter and the keys fr...

8.8CVSS5.8AI score0.00397EPSS
SaveExploits0References2
OSV
OSV
added 2026/05/12 8:34 p.m.14 views

CLSA-2026-1778618041 freeipmi: Fix of CVE-2026-33554

CVE-2026-33554: fix buffer overflows in ipmi-oem response handling for dell get-last-post-code, supermicro extra-firmware-info, and wistron read-proprietary-string subcommands...

7.5CVSS5.9AI score0.00403EPSS
SaveExploits0References1
OSV
OSV
added 2026/05/12 8:19 p.m.13 views

CLSA-2026-1778617167 freeipmi: Fix of CVE-2026-33554

CVE-2026-33554: fix buffer overflows in ipmi-oem response handling for dell get-last-post-code, supermicro extra-firmware-info, and wistron read-proprietary-string subcommands...

7.5CVSS5.9AI score0.00403EPSS
SaveExploits0References1
OSV
OSV
added 2026/05/12 3:0 p.m.6 views

GHSA-Q6X5-8V7M-XCRF protobufjs has overlong UTF-8 decoding

Summary protobufjs includes a minimal UTF-8 decoder used in non-Node and fallback decoding paths. The affected decoder accepted overlong UTF-8 byte sequences and decoded them to their canonical characters instead of replacing them. The issue concerns overlong encodings and code points outside the...

5.3CVSS5.8AI score0.00301EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/05/12 12:0 a.m.15 views

PT-2026-40311

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the metaphone function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed...

7.5CVSS5.8AI score0.00455EPSS
SaveExploits0References3
Redos
Redos
added 2026/05/12 12:0 a.m.17 views

ROS-20260512-73-0008

A vulnerability in the escapebytestring function of the gio/gfileattribute.c component of the GLib library set is related to integer overflow. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service...

6.5CVSS6.7AI score0.00536EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/05/12 12:0 a.m.19 views

PT-2026-40293

In PHP versions 8.4. before 8.4.21 and 8.5. before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb convert encoding or related mbstring functions, the code incorrectly assumes that when strncasecmp returns 0 it means the strings have the same length. This can lead to...

9.1CVSS5.9AI score0.00469EPSS
SaveExploits0References3
OSV
OSV
added 2026/05/11 9:45 p.m.16 views

CLSA-2026-1778535928 python: Fix of 2 CVEs

CVE-2021-3733: fix ReDoS in urllib2 AbstractBasicAuthHandler regex; the legacy '?:.,' prefix is replaced with the upstream-3.x form '?:^|,' and the scheme charset excludes ',' to prevent quadratic backtracking on crafted WWW-Authenticate headers - CVE-2021-23336: stop accepting ';' as a default...

6.5CVSS5.8AI score0.35717EPSS
SaveExploits2References1
OSV
OSV
added 2026/05/11 8:35 p.m.8 views

CVE-2026-43878 WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a block. An attacker who sends a victim to a crafted URL can bre...

6.1CVSS6.1AI score
SaveExploits0References4
Vulnrichment
Vulnrichment
added 2026/05/11 8:35 p.m.11 views

CVE-2026-43878 WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a block. An attacker who sends a victim to a crafted URL can bre...

6.1CVSS6AI score0.00225EPSS
SaveExploits0References2
OSV
OSV
added 2026/05/11 9:15 a.m.11 views

CLSA-2026-1778490923 httpd: Fix of 9 CVEs

CVE-2026-33857: fix length checks in AJP msgget functions - CVE-2026-34032: fix ajpmsggetstring buffer checks - CVE-2026-34059: fix ajpparsedata message len check - CVE-2026-24072: use APEXPRFLAGRESTRICTED in htaccess - CVE-2026-29169: moddavlock: use the right davlockdiscovery - CVE-2026-33006:...

9.8CVSS5.9AI score0.01376EPSS
SaveExploits2References1
OSV
OSV
added 2026/05/11 5:44 a.m.8 views

BIT-GOLANG-2026-42499 Quadratic string concatenation in consumePhrase in net/mail

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322...

7.5CVSS5.8AI score0.00798EPSS
SaveExploits0References31
ATTACKERKB
ATTACKERKB
added 2026/05/11 12:45 a.m.6 views

CVE-2026-8258

A flaw has been found in Squirrel up to 3.2. Impacted is the function validateformat in the library sqstdlib/sqstdstring.cpp. Executing a manipulation can lead to stack-based buffer overflow. The attack can only be executed locally. The exploit has been published and may be used. The project was...

5.3CVSS6.2AI score0.00123EPSS
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/05/10 3:42 a.m.8 views

CVE-2026-7568

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, the metaphone function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 bytes is passed, a signed...

6.3CVSS5.8AI score0.00455EPSS
SaveExploits0References2Affected Software1
VulnCheck KEV
VulnCheck KEV
added 2026/05/10 12:0 a.m.23 views

VulnCheck KEV: CVE-2025-40600

Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption...

9.8CVSS6.3AI score0.00875EPSS
SaveIn wildExploits0References2
Rows per page
Query Builder