32761 matches found
CVE-2026-73640 Time-based SQL Injection in Dayforce Payroll
Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based...
Important: Red Hat Security Advisory: kernel-rt security update
An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
WordPress SPS-Suite plugin <= 1.4.0 - Unauthenticated Time-Based SQLi vulnerability
Unauthenticated Time-Based SQLi vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin SPS-Suite versions = 1.4.0...
BIT-MONGODB-2026-18711 Use-After-Free in MongoDB Query Execution Engine Leads to Denial of Service and Potential Memory Disclosure
An issue in MongoDB Server's query execution engine could allow an authenticated user with read and write privileges to cause an internal reference to be used after the underlying memory has been freed, when running certain queries against time-series collections. This could result in a server...
CVE-2026-93000 SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-93000 SPS-Suite <= 1.4.0 - Unauthenticated Time-Based SQLi via Search
The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search feature is enabled, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-93000
The SPS-Suite WordPress plugin (versions
CVE-2026-101075: Improper Neutralization of Special Elements used in an OS Command
A security vulnerability has been detected in Netcore NR289-GE 1.4.5102. The impacted element is the function system of the file /locationtime.cgi of the component Location Time Handler. The manipulation of the argument mac leads to os command injection. Remote exploitation of the attack is...
PT-2026-99907
Name of the Vulnerable Software and Affected Versions Netcore NR289-GE version 1.4.5102 Description An OS command injection flaw exists in the Location Time Handler component. The issue occurs when the mac argument is manipulated within the system function of the '/location time.cgi' endpoint,...
PT-2026-102376
Name of the Vulnerable Software and Affected Versions brace-expansion versions prior to 1.1.21 brace-expansion versions prior to 2.1.7 brace-expansion versions prior to 3.0.9 brace-expansion versions prior to 5.0.12 Description The expand function improperly handles untrusted patterns containing...
CVE-2026-73640: Improper Neutralization of Special Elements used in an SQL Command
Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based...
CVE-2026-101044
The pacquet Rust package-manager component, included in pnpm versions >=12.0.0-alpha.0 and
CVE-2026-100597
The OpenClaw npm package (openclaw ) prior to version 2026.7.1 is vulnerable to a time-of-check time-of-use (TOCTOU) race condition within OpenShell local mirror filesystem mutation operations. Specifically, the remove, mkdir, and rename operations may target a different filesystem path if the pa...
CVE-2026-100597 OpenClaw before 2026.7.1 Path Traversal via Filesystem Race
OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...
CVE-2026-100597 OpenClaw before 2026.7.1 Path Traversal via Filesystem Race
OpenClaw npm package 'openclaw' before 2026.7.1 is vulnerable to a time-of-check time-of-use race condition in OpenShell local mirror filesystem mutation operations. The remove, mkdir, and rename operations could act on a different filesystem target after OpenClaw completed its sandbox path-safet...
CLEANSTART-2026-MN47589 Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service
CVE-2026-25680 affects multiple packages. Parsing arbitrary HTML can consume excessive CPU time, possibly leading to denial of service. See references for individual vulnerability details...
CVE-2024-9465
CVE-2024-9465 Checkpoint 基于时间的 SQL 注入攻击（CVE-2024-9465） SHODAN 搜索 https://www.shodan.io/search?query=html%3A%22Expedition+Project%22 html:"Expedition Project" FOFA 搜索 https://en.fofa.info/ body="Expedition Project" || title="Expedition Project" 使用方法 python3 CVE-2024-9465.py -u https://domain.com...
Exploit for CVE-2026-96512
SudoTimeWarp — CVE-2026-96512 sudo: the caller's TZ decid...
CVE-2026-62262
Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...
EUVD-2026-87136
Piwigo is a full featured open source photo gallery application for the web. In 17.0.0beta1 and earlier, when rating is enabled, an unauthenticated guest can call pwg.images.filteredSearch.create with a crafted ratings value and then open the returned search URL. include/wsfunctions/pwg.images.ph...