Lucene search
+L

20841 matches found

OSV
OSV
added 2026/06/24 12:5 p.m.10 views

RLSA-2026:28235 Low: libtasn1 security update

A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and Distinguished Encoding Rules DER, as per X.690 encoding and decoding functions. Security Fixes: libtasn1: libtasn1: Denial of Service via stack-based...

5.9CVSS6.3AI score0.01109EPSS
SaveExploits0References2
OSV
OSV
added 2026/06/24 12:3 p.m.7 views

RLSA-2026:28253 Low: libtasn1 security update

A library that provides Abstract Syntax Notation One ASN.1, as specified by the X.680 ITU-T recommendation parsing and structures management, and Distinguished Encoding Rules DER, as per X.690 encoding and decoding functions. Security Fixes: libtasn1: libtasn1: Denial of Service via stack-based...

5.9CVSS7.7AI score0.01109EPSS
SaveExploits0References2
SUSE Linux
SUSE Linux
added 2026/06/24 9:2 a.m.6 views

Security update for openssl-1_1

This update for openssl-11 fixes the following issues: CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7verify bsc1266357. CVE-2026-42766: Possible NULL Dereference in Password-Based CMS Decryption bsc1266349. CVE-2026-9076: Out-of-Bounds Read in CMS Password-Based Decryption bsc1266341...

8.2CVSS5.8AI score0.05236EPSS
SaveExploits0References20
OSV
OSV
added 2026/06/24 8:19 a.m.10 views

SUSE-SU-2026:22441-1 Security update for sg3_utils

This update for sg3utils fixes the following issue - sginq: --export output conformance for SCSI name string and ATA fields bsc1267823...

5.9AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.23 views

PT-2026-52151

Name of the Vulnerable Software and Affected Versions Quest NetVault Backup affected versions not specified Description A flaw in the processing of NVBUDashboard JSON-RPC messages allows remote attackers to execute arbitrary code in the context of NETWORK SERVICE. The issue stems from insufficien...

8.8CVSS7.7AI score0.00689EPSS
SaveExploits0References8
Tenable Nessus
Tenable Nessus
added 2026/06/24 12:0 a.m.8 views

RockyLinux 9 : libtasn1 (RLSA-2026:28253)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:28253 advisory. libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1expendoctetstring CVE-2025-13151 Tenable has extracted the preceding description blo...

7.5CVSS6.6AI score0.01109EPSS
SaveExploits0References3
RedHat Linux
RedHat Linux
added 2026/06/23 11:58 p.m.16 views

Low: Red Hat Security Advisory: libtasn1 security update

An update for libtasn1 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

7.5CVSS7.9AI score0.01109EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/23 9:16 p.m.18 views

CVE-2026-47376

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or...

5.1CVSS0.00262EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/06/23 9:0 p.m.10 views

CVE-2026-50193

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if and only if the service reads deeply nested 1000s of levels JSON as JsonNode...

6.3CVSS5.9AI score0.00459EPSS
SaveExploits1References4Affected Software1
EUVD
EUVD
added 2026/06/23 9:0 p.m.14 views

EUVD-2026-38597

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends deeply nested JSON if and only if the service reads deeply nested 1000s of levels JSON as JsonNode...

6.3CVSS5.9AI score0.00459EPSS
SaveExploits1References3
CVE
CVE
added 2026/06/23 8:35 p.m.29 views

CVE-2026-47376

CVE-2026-47376 (NocoDB) describes a reflected XSS on the password-reset flow. Before 2026.04.1, the token from the password-reset URL was directly embedded into a JavaScript string in a server-rendered EJS template, which does not escape single quotes or backslashes. This allowed an attacker-cont...

5.1CVSS5.9AI score0.00262EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/06/23 8:35 p.m.8 views

CVE-2026-47376

NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the password-reset page rendered the URL token directly into a JavaScript string literal in a server-rendered EJS template. EJS HTML-entity-encodes a fixed set of characters but does not escape single quotes or...

5.1CVSS5.9AI score0.00262EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added 2026/06/23 7:53 p.m.15 views

EUVD-2026-38605

Module: plugins/modules/nexmo.py CVSS 3.1: 6.5 MEDIUM — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: apikey and apisecret are declared nolog=True at the input level, but both credentials are immediately URL-encoded into a GET request as query parameters, bypassing all nolog protection. Vulnerable...

6.5CVSS6AI score0.00287EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/23 7:53 p.m.28 views

CVE-2026-11820

CVE-2026-11820 affects the community.general nexmo module. Credentials api_key and api_secret are declared no_log but are URL-encoded into a GET request, exposing them in the query string (e.g., .../sms/json?api_key=...&api_secret=...). The vulnerability arises because the code constructs the URL...

6.5CVSS5.8AI score0.00287EPSS
SaveExploits0References2Affected Software1
Vulnrichment
Vulnrichment
added 2026/06/23 7:53 p.m.7 views

CVE-2026-11820 Community.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query string

Module: plugins/modules/nexmo.py CVSS 3.1: 6.5 MEDIUM — AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Issue: apikey and apisecret are declared nolog=True at the input level, but both credentials are immediately URL-encoded into a GET request as query parameters, bypassing all nolog protection. Vulnerable...

6.5CVSS5.9AI score0.00287EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/06/23 7:53 p.m.62 views

CVE-2026-11820 Community.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query string

A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding API credentials apikey and apisecret into URL query parameters and sending them via GET requests. This causes credentials to be exposed in web...

6.5CVSS0.00287EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/06/23 7:53 p.m.6 views

CVE-2026-11820

A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding API credentials apikey and apisecret into URL query parameters and sending them via GET requests. This causes credentials to be exposed in web...

6.5CVSS5.8AI score0.00287EPSS
SaveExploits0References3
RedhatCVE
RedhatCVE
added 2026/06/23 7:53 p.m.18 views

CVE-2026-11820

A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding API credentials apikey and apisecret into URL query parameters and sending them via GET requests. This causes credentials to be exposed in web...

6.5CVSS5.8AI score0.00287EPSS
SaveExploits0References3
Metasploit
Metasploit
added 2026/06/23 7:6 p.m.225 views

Audiobookshelf Unauthenticated API Authentication Bypass Scanner

This module detects Audiobookshelf servers affected by CVE-2025-25205, an unauthenticated authentication bypass. Affected versions 2.17.0 through 2.19.0 decide whether a GET request may skip authentication by testing an unanchored regular expression against the request's full original URL,...

8.2CVSS5.9AI score0.04219EPSS
SaveExploits2
UbuntuCve
UbuntuCve
added 2026/06/23 6:17 p.m.6 views

CVE-2026-45692

Caddy is an extensible server platform that uses TLS by default. From 2.4.0 until 2.11.3, the authorization layer and the /config traversal layer do not agree on what object the path refers to. In this case, a path authorized for one config object is accepted, but then resolves to a different...

5.4CVSS6.1AI score0.00167EPSS
SaveExploits1References1
Rows per page
Query Builder