Lucene search
+L

27808 matches found

Cvelist
Cvelist
added 2026/08/25 11:33 a.m.31 views

CVE-2026-79662 Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass

Ech0 through 4.5.6 contains an OAuth redirect URI validation vulnerability in parseAndValidateClientRedirect internal/service/auth/auth.go that compares only the scheme and host of the client-supplied redirecturi against the admin-configured allowlist, ignoring path, query, and fragment component...

8.8CVSS0.00192EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/08/25 7:35 a.m.10 views

webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data

A flaw was found in WebKitGTK. A malicious website can silently hijack clipboard data due to improper state management...

6.5CVSS5.3AI score0.00437EPSS
SaveExploits0References6
Kitploit
Kitploit
added 2026/08/25 6:23 a.m.6 views

CVE-2024-24919-Check-Point-Remote-Access-VPN

CVE-2024-24919-Check-Point-Remote-Access-VPN CVE-2024-24919 è una vulnerabilità di lettura arbitraria di file non autenticata che può essere considerata niente di meno che una RCE completa non autenticata. Un attaccante può leggere qualsiasi file sensibile situato sull'appliance interessata con...

8.6CVSS7.3AI score0.99978EPSS
SaveExploits53
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/25 5:33 a.m.12 views

Malicious code in desmosisfire (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0679b40ac71c7b8ce0dc0557c8779a85ad10fac03ff678128ec4aa687c5e243 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

5.6AI score
SaveExploits0References2
NVD
NVD
added 2026/08/24 8:17 p.m.13 views

CVE-2026-78555

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

9.4CVSS0.00357EPSS
SaveExploits0References1
NVD
NVD
added 2026/08/24 5:17 p.m.11 views

CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

9.8CVSS0.00136EPSS
SaveExploits0References5
Malwarebytes
Malwarebytes
added 2026/08/24 4:51 p.m.33 views

Fake GTA 6 Extended Look and demo sites deliver an infostealer

GTA 6 footage really has leaked online, and Rockstar has an official Extended Look coming to Netflix on August 27. But cybercriminals are exploiting the hype with fake Rockstar sites that lead visitors to password-stealing malware. We identified a network of sites appearing in searches for a GTA ...

5.9AI score
SaveExploits0
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/24 4:44 p.m.20 views

Malicious code in auth-otp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e72292101c6b448dbaea5dc1e2af91cc55b35b32ee1e722c4f5b21dfb91e032d Package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script...

5.5AI score
SaveExploits0References6
CVE
CVE
added 2026/08/24 4:12 p.m.72 views

CVE-2026-19685

NetworkManager failed to enforce the private_user restriction on the 802-1x.ca-path and phase2-ca-path directory-valued connection properties—an incomplete fix for CVE-2025-9615. An unprivileged local user can point a private WPA-Enterprise (802.1X) profile's CA path at an attacker-controlled dir...

9.8CVSS5.2AI score0.00158EPSS
SaveExploits0References5
OSV
OSV
added 2026/08/24 4:12 p.m.27 views

CVE-2026-19685 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

7.1CVSS5.5AI score
SaveExploits0References8
EUVD
EUVD
added 2026/08/24 4:12 p.m.13 views

EUVD-2026-64957

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

7.1CVSS5.4AI score0.00136EPSS
SaveExploits0References5
Vulnrichment
Vulnrichment
added 2026/08/24 4:12 p.m.11 views

CVE-2026-19685 Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

7.1CVSS5.3AI score0.00158EPSS
SaveExploits0References5
RedhatCVE
RedhatCVE
added 2026/08/24 3:59 p.m.11 views

CVE-2026-19685

NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...

9.8CVSS5.3AI score0.00136EPSS
SaveExploits0References6
OSSF Malicious Packages
OSSF Malicious Packages
added 2026/08/24 3:53 p.m.20 views

Malicious code in dims-hydration-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a85d660f6cc363a81624c7383318958bb46f2d6958fdad71e595692420d805d On any import 'dims-hydration-ui', index.mjs chmods 0755 and spawns a bundled Linux x8664 ELF at dist/internal/calc.dat as a detached child, describe...

6AI score
SaveExploits0References2
CVE
CVE
added 2026/08/24 2:51 p.m.37 views

CVE-2026-78414

A cross-site scripting (XSS) vulnerability exists in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 (Linux, Windows, macOS). An adjacent-network attacker who controls a rogue Nx server on the same network segment can set that server's site name to a script p...

8CVSS5.7AI score0.00216EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/08/24 2:51 p.m.11 views

EUVD-2026-64898

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

8CVSS5.9AI score0.00216EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/24 2:14 p.m.29 views

CVE-2026-39915 TIM Flow < 26.0.6 CRLF Injection via rt Parameter

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...

8.5CVSS0.00269EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/24 2:14 p.m.11 views

EUVD-2026-64892

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter, which is reflected into Set-Cookie response headers...

8.5CVSS5.8AI score0.00269EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/24 2:14 p.m.30 views

CVE-2026-39915

TIM Flow before 26.0.6 is affected by a CRLF injection vulnerability in the rt URL parameter (and access token cookie), where unsanitized carriage return and line feed sequences are reflected into Set-Cookie response headers. Remote attackers can inject arbitrary HTTP headers and response body co...

8.5CVSS5.8AI score0.00269EPSS
SaveExploits0References2
AstraLinux
AstraLinux
added 2026/08/24 10:19 a.m.7 views

Astra Linux – Vulnerability in git-lfs

Git LFS is an extension of Git for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host’s URL to the git-credential1 command without checking for embedded line-ending control characters. It then sends any credentials it receives back...

8.5CVSS7.2AI score0.01079EPSS
SaveExploits0References2
Rows per page
Query Builder