Lucene search
+L

39442 matches found

NVD
NVD
added 2026/08/13 6:18 p.m.12 views

CVE-2026-73648

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVGALLOWLOCALHREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applicatio...

5.1CVSS0.00396EPSS
SaveExploits0References4
OSV
OSV
added 2026/08/13 5:35 p.m.29 views

CVE-2026-73564 frp: Unauthenticated Remote Denial of Service in the frp SSH Tunnel Gateway via Integer Overflow

frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bound...

8.7CVSS5.5AI score
SaveExploits0References6
NVD
NVD
added 2026/08/13 5:17 p.m.15 views

CVE-2026-58510

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

4.3CVSS0.00209EPSS
SaveExploits0References3
CVE
CVE
added 2026/08/13 4:44 p.m.46 views

CVE-2026-58510

The CVE-2026-58510 entry relates to Gitea: the ClearRepoWatches fix was not applied to the API EditRepo path, leaving a secondary code path with stale watches when a repository’s visibility changes from public to private. Affected software: Gitea; vulnerable component: the API EditRepo/watch hand...

4.3CVSS5.8AI score0.00209EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/08/13 4:44 p.m.36 views

CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

0.00209EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/08/13 4:44 p.m.14 views

EUVD-2026-58123

GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private...

4.3CVSS5.8AI score0.00209EPSS
SaveExploits0References3
NVD
NVD
added 2026/08/13 2:17 p.m.8 views

CVE-2026-61967

Unauthenticated Privilege Escalation in miniorange otp verification = 5.5.1 versions...

9.8CVSS0.00328EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/08/13 1:42 p.m.35 views

CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

8.5CVSS0.00253EPSS
SaveExploits0References1
OSV
OSV
added 2026/08/13 12:17 p.m.8 views

DEBIAN-CVE-2026-73620

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout and TagReference.create, allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band...

7.2CVSS5.5AI score0.00358EPSS
SaveExploits1References1
Cvelist
Cvelist
added 2026/08/13 11:28 a.m.44 views

CVE-2026-73603 Flowise before 3.1.4 Credential Abuse via Text-to-Speech

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a...

6.3CVSS0.00338EPSS
SaveExploits1References2
CVE
CVE
added 2026/08/13 11:28 a.m.40 views

CVE-2026-73603

Flowise before 3.1.4 exposes an unauthenticated text-to-speech endpoint that does not validate chatflow visibility, allowing unauthenticated attackers to abuse private chatflow TTS credentials and generate unlimited TTS audio using stored OpenAI or ElevenLabs keys by providing a valid chatflow UU...

6.3CVSS5.3AI score0.00338EPSS
SaveExploits1References2Affected Software1
OSV
OSV
added 2026/08/13 11:28 a.m.15 views

CVE-2026-73603 Flowise before 3.1.4 Credential Abuse via Text-to-Speech

Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API keys by providing a...

6.3CVSS5.5AI score
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/08/13 10:48 a.m.8 views

CVE-2026-16455

In Teltonika Networks RUTOS devices running versions 7.07.1 through 7.24.1 and TSWOS devices running versions 1.03 through 1.10, a vulnerability exists whereby a lower privileged user can escalate privileges to administrative level due to unsafe calls to an execl function...

6.9CVSS5.2AI score0.00196EPSS
SaveExploits0References2Affected Software2
OSV
OSV
added 2026/08/13 9:17 a.m.9 views

UBUNTU-CVE-2026-19695

Gammu DCT3 trace file parser crash in 4.6.0 to 4.6.7 allows denial of service...

5.5CVSS5.3AI score0.00118EPSS
SaveExploits1References4
OSV
OSV
added 2026/08/13 8:31 a.m.15 views

CVE-2026-19481 @fastify/busboy vulnerable to Denial of Service via prototype-named multipart part header

@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as proto or constructor. The internal header parser stores headers in a...

7.5CVSS5.4AI score
SaveExploits0References4
EUVD
EUVD
added 2026/08/13 8:04 a.m.13 views

EUVD-2026-57745

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service...

4.7CVSS5.2AI score0.00129EPSS
SaveExploits1References2
Debian CVE
Debian CVE
added 2026/08/13 8:04 a.m.9 views

CVE-2026-19694

TTX Logger file parser crash in 4.6.0 to 4.6.7 allows denial of service...

5.5CVSS5.3AI score0.00129EPSS
SaveExploits1
ATTACKERKB
ATTACKERKB
added 2026/08/13 8:04 a.m.13 views

CVE-2026-19696

Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows...

6.6CVSS5.2AI score0.00122EPSS
SaveExploits1References3Affected Software1
SUSE CVE
SUSE CVE
added 2026/08/13 1:33 a.m.10 views

SUSE CVE-2026-34501

Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...

8.2CVSS5.3AI score0.00508EPSS
SaveExploits0References3
UbuntuCve
UbuntuCve
added 2026/08/13 12:00 a.m.16 views

CVE-2026-19696

Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows...

6.6CVSS5.3AI score0.00122EPSS
SaveExploits1References3
Rows per page
Query Builder