Lucene search
+L

16614 matches found

EUVD
EUVD
added 1 hour ago4 views

EUVD-2026-52432

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

8.8CVSS
SaveExploits0References3
CVE
CVE
added 1 hour ago6 views

CVE-2026-18733

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the noninteractive parameter to true, bypassing the human consent gate. To...

8.8CVSS
SaveExploits0References3
Nuclei
Nuclei
added 18 hours ago110 views

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-42071 info: name: Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection author: gy741 severity: critical description: Visual...

10CVSS8.1AI score0.69882EPSS
SaveExploits2References5
Nuclei
Nuclei
added 18 hours ago95 views

WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting

The SEO Tools WordPress plugin through version 4.0.7 contains a reflected cross-site scripting vulnerability. The plugin does not properly sanitize and escape the 'src' parameter in the rssread.php file before outputting it back in the page, which could allow attackers to execute arbitrary...

6.1CVSS7.9AI score0.00594EPSS
SaveExploits1References2
Nuclei
Nuclei
added 18 hours ago98 views

Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect

Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 contain a reflected XSS and open redirect caused by insufficient sanitization of the redirect URI in the LTI authorization endpoint, letting attackers execute scripts or redirect users maliciously, exploit requires crafted URL with...

6.1CVSS6.9AI score0.01128EPSS
SaveExploits0References3
Nuclei
Nuclei
added 18 hours ago15 views

9Router <= 0.4.36 - Unauthenticated RCE

9Router = 0.4.36 middleware only guards 8 explicitly listed routes, leaving /api/cli-tools/ and /api/mcp/ entirely unauthenticated. An attacker can POST to /api/cli-tools/cowork-settings to register a custom MCP plugin with attacker-controlled command and args stored verbatim into globalThis, the...

10CVSS5.9AI score0.02395EPSS
SaveExploits0References2
GithubExploit
GithubExploit
added yesterday28 views

offensive-security-labs

Offensive Security Labs A collection of hands-on offensive cy...

5.4AI score
SaveExploits0
Wired Threat Level
Wired Threat Level
added 2 days ago9 views

7 States’ Water Systems Hit by Cyberattacks Likely Tied to Iran

Plus: The FBI eyes AI-powered tech to detect future crimes, Russia charges Telegram’s founder, xAI sues to stop a state’s “nudification” ban, and the Democrats learn a lesson about getting scammed...

5.5AI score
SaveExploits0
NVD
NVD
added 3 days ago6 views

CVE-2026-18394

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

7.4CVSS0.00294EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 3 days ago7 views

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

7.4CVSS5.6AI score0.00294EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 3 days ago7 views

CVE-2026-18394

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

7.4CVSS5.6AI score0.00294EPSS
SaveExploits0References4
OSV
OSV
added 3 days ago5 views

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

6.9CVSS5.6AI score0.00294EPSS
SaveExploits0References5
CVE
CVE
added 3 days ago50 views

CVE-2026-18394

CVE-2026-18394 affects Strands Agents Tools’ http_request tool prior to v0.8.2, where incorrect authorization could allow an attacker to exfiltrate credentials configured via HTTP_REQUEST_TOKEN_CONFIG by routing requests through proxy infrastructure under attacker control. Root cause: insufficien...

7.4CVSS5.6AI score0.00294EPSS
SaveExploits0References3
Cvelist
Cvelist
added 3 days ago34 views

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

7.4CVSS0.00294EPSS
SaveExploits0References3
Nuclei
Nuclei
added 3 days ago313 views

Vite - Arbitrary File Read

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it...

7.5CVSS6.6AI score0.74998EPSS
SaveExploits28References2
NVD
NVD
added 3 days ago5 views

CVE-2026-14537

Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-a...

9.3CVSS0.00207EPSS
SaveExploits0References1
NVD
NVD
added 4 days ago10 views

CVE-2026-59326

The Spring Boot language server logs the raw value of the httpsproxy/HTTPSPROXY/httpproxy/HTTPPROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth credentia...

3.3CVSS0.00095EPSS
SaveExploits0References1
NVD
NVD
added 4 days ago9 views

CVE-2026-59328

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser SWT Browser with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded...

4.2CVSS0.00162EPSS
SaveExploits0References1
NVD
NVD
added 4 days ago10 views

CVE-2026-59327

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret spring.devtools.remote.secret as a plain string attribute on the "Spring Boot DevTools Client" launch configuration. Eclipse persists launch configuration attributes as cleartext XML, either to workspace metadata or, if the us...

4.4CVSS0.00085EPSS
SaveExploits0References1
NVD
NVD
added 4 days ago11 views

CVE-2026-47873

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces 0.0.0.0 rather than restricting them to loopback. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier...

8CVSS0.00184EPSS
SaveExploits0References1
Rows per page
Query Builder