CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

19633 matches found

NVD•added 2026/04/20 6:16 p.m.•26 views

CVE-2026-23752

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality that allows authenticated administrators to inject arbitrary JavaScript by manipulating the companyname POST parameter without HTML sanitization. Attackers can...

4.8CVSS0.00151EPSS

SaveExploits0References2

Cvelist•added 2026/04/20 5:33 p.m.•71 views

CVE-2026-23752 GFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter

4.8CVSS0.00151EPSS

SaveExploits0References2

CVE•added 2026/04/20 5:33 p.m.•44 views

CVE-2026-23752

CVE-2026-23752 affects GFI HelpDesk prior to 4.99.9. The vulnerability is a stored XSS in the template group creation/editing flow, exploitable via the companyname POST parameter without HTML sanitization. When an authenticated administrator views the Templates > Groups page, the injected scri...

4.8CVSS6AI score0.00151EPSS

SaveExploits0References2Affected Software1

Vulnrichment•added 2026/04/20 5:33 p.m.•16 views

CVE-2026-23752 GFI HelpDesk < 4.99.9 Stored XSS via companyname Parameter

4.8CVSS6AI score0.00151EPSS

SaveExploits0References2

attackerkb•added 2026/04/20 5:33 p.m.•12 views

CVE-2026-23752

4.8CVSS5.8AI score0.00151EPSS

SaveExploits0References3

Snyk•added 2026/04/20 3:49 p.m.•22 views

Arbitrary Code Injection

Overview sglang is a SGLang is a fast serving framework for large language models and vision language models. Affected versions of this package are vulnerable to Arbitrary Code Injection via the reranking endpoint when a model file containing a malicious tokenizer.chattemplate is loaded, due to...

9.8CVSS8.8AI score0.00852EPSS

SaveExploits2References2

EUVD•added 2026/04/20 3:31 p.m.•59 views

EUVD-2026-23860

SGLang's reranking endpoint /v1/rerank achieves Remote Code Execution RCE when a model file containing a malcious tokenizer.chattemplate is loaded, as the Jinja2 chat templates are rendered using an unsandboxed jinja2.Environment...

9.8CVSS8.5AI score0.00852EPSS

SaveExploits2References2

Cvelist•added 2026/04/20 3:00 p.m.•62 views

CVE-2026-6652 Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection

A weakness has been identified in Pagekit CMS up to 1.0.18. This issue affects the function evaluate of the file app/modules/view/src/PhpEngine.php of the component StringStorage Template Handler. This manipulation causes improper neutralization of directives in dynamically evaluated code. Remote...

5.8CVSS0.00244EPSS

SaveExploits0References4

Mend•added 2026/04/20 3:00 p.m.•8 views

CVE-2026-6652

5.8CVSS5.1AI score0.00244EPSS

SaveExploits0References4

Vulnrichment•added 2026/04/20 3:00 p.m.•12 views

CVE-2026-6652 Pagekit CMS StringStorage Template PhpEngine.php evaluate eval injection

5.8CVSS5.1AI score0.00244EPSS

SaveExploits0References4

NVD•added 2026/04/20 2:16 p.m.•24 views

CVE-2026-5760

9.8CVSS0.00852EPSS

SaveExploits2References3

osv_opensuse•added 2026/04/20 2:07 p.m.•168 views

OPENSUSE-SU-2026:20571-1 Security update for go1.26

This update for go1.26 fixes the following issues: - Update to version go1.26.2 bsc1255111. - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination bsc1261654. - CVE-2026-27144:...

9.8CVSS6.9AI score0.00658EPSS

SaveExploits0References21

osv_opensuse•added 2026/04/20 2:02 p.m.•22 views

OPENSUSE-SU-2026:20570-1 Security update for go1.25

This update for go1.25 fixes the following issues: - Update to version go1.25.9 bsc1244485. - CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG bsc1261653. - CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination bsc1261654. - CVE-2026-27144:...

9.8CVSS6.9AI score0.00658EPSS

SaveExploits0References19

osv_suse•added 2026/04/20 2:00 p.m.•35 views

SUSE-SU-2026:21356-1 Security update for go1.26

9.8CVSS6.9AI score0.00658EPSS

SaveExploits0References22

osv_suse•added 2026/04/20 1:54 p.m.•52 views

SUSE-SU-2026:21355-1 Security update for go1.25

9.8CVSS6.9AI score0.00658EPSS

SaveExploits0References20

Cvelist•added 2026/04/20 1:46 p.m.•88 views

CVE-2026-5760 CVE-2026-5760

0.00852EPSS

SaveExploits2References2

Vulnrichment•added 2026/04/20 1:46 p.m.•11 views

CVE-2026-5760 CVE-2026-5760

8.4AI score0.00852EPSS

SaveExploits2References2

CVE•added 2026/04/20 1:46 p.m.•240 views

CVE-2026-5760

The SGLang high-performance LLM service framework is vulnerable to Remote Code Execution (RCE) via its reranking endpoint (/v1/rerank). The root cause is the use of an unsandboxed jinja2.Environment() within the _get_jinja_env() function in serving_rerank.py. An attacker can achieve RCE by loadin...

9.8CVSS8.4AI score0.00852EPSS

SaveExploits2References3Affected Software1

RedhatCVE•added 2026/04/20 1:39 p.m.•20 views

CVE-2026-40478

A flaw was found in Thymeleaf, a server-side Java template engine. An unauthenticated remote attacker can exploit this vulnerability by providing unvalidated user input to the template engine. This bypasses existing security mechanisms, allowing for the execution of unauthorized expressions and...

9CVSS8AI score0.01102EPSS

SaveExploits0References4

RedhatCVE•added 2026/04/20 1:39 p.m.•24 views

CVE-2026-40477

A flaw was found in Thymeleaf, a server-side Java template engine. An unauthenticated remote attacker can exploit a security bypass vulnerability in the expression execution mechanisms. By providing unvalidated user input directly to the template engine, the attacker can bypass the library's...

9CVSS8AI score0.00851EPSS

SaveExploits0References4

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by