7457 matches found
Exploit for Server-Side Request Forgery in Lfprojects Mlflow
Laboratorio de Seguridad — Explotación de SSRF en MLflow Webho...
SUSE CVE-2026-34031
Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images, which could expose users to...
CVE-2026-80875
In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in TCP state lookup TCP state handling reparses the skb to find the TCP header. For IPv6 it uses sizeofstruct ipv6hdr, while the surrounding IPVS code already parsed the packet with ipvsfilliphsk...
CVE-2026-85663
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...
EUVD-2026-71119
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...
CVE-2026-85663 Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...
CVE-2026-85663 Aim 3.29.1 Remote Code Execution via Unauthenticated Method Dispatch
Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validation. Unauthenticated attackers can register clients, instantiate Repo resources, and invoke arbitrary methods to read experiments or delete runs...
CVE-2020-26867
creationtimestamp| type| source ---|---|--- 2026-09-04 08:00:05+00:00| seen| https://t.me/timcorehacking/1025 2026-09-05 01:00:36+00:00| seen| https://t.me/timcorehacking/1025...
CVE-2026-85449 MOOS-IvP through 24.8.1 pMarineViewer Unbounded Memory Consumption via NODE_REPORT
MOOS-IvP pMarineViewer through 24.8.1 fails to limit the number of tracked node identities from NODEREPORT messages, allowing attackers to exhaust memory by supplying unbounded distinct node names. Attackers can publish crafted NODEREPORT data to cause memory exhaustion and stall the operator...
CVE-2026-73711
creationtimestamp| type| source ---|---|--- 2026-09-03 19:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mun75in5hb23...
CVE-2026-77764
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...
CVE-2026-77764
The GamiPress WordPress plugin versions before 7.9.9.6 contain a vulnerability where the video watch-tracking functionality lacks proper restrictions. This flaw allows users with permissions as low as Subscriber to award configured gamification points, achievements, and ranks to arbitrary users, ...
CVE-2026-77764 GamiPress < 7.9.9.6 - Subscriber+ Arbitrary User Points and Achievement Award via Watch-Video Listeners
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...
EUVD-2026-69836
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...
PT-2026-84616
The GamiPress WordPress plugin before 7.9.9.6 does not properly restrict its video watch-tracking functionality, allowing users with a role as low as Subscriber to award the configured gamification points, achievements and ranks to arbitrary users including administrators, and to accrue them...
CVE-2017-7521
creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:52+00:00| seen| Telegram/tQYQZqhyuY0qEc0EIMW1bi06b2xW0YmxNUvpyPlREzxjSw 2026-09-02 01:03:29+00:00| seen| Telegram/tQYQZqhyuY0qEc0EIMW1bi06b2xW0YmxNUvpyPlREzxjSw 2026-09-08 20:00:04+00:00| published-proof-of-concept|...
missing-cve-nuclei-templates v2026-08-10
Weekly updated list of missing CVEs in nuclei templates official repository Note This repository is 100% automated so there can be errors, but in general is pretty accurate. Go to section "How it works" to understand how data is collected. Stats 📊 CVEs analyzed : 172424 CVEs missing : 68205...
CVE-2026-51764
Incorrect access control in the recvSlaveCloudCheckStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite cloud-result tracking files via sending a crafted MQTT message to the csbroker component...
Important: postgresql15
Issue Overview: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the...
CVE-2026-77831 Algorithmic-complexity denial of service in AshPaperTrail full-diff list tracking
Inefficient Algorithmic Complexity vulnerability in ash-project ashpapertrail allows a user who can submit a large array attribute to a paper-trailed create or update action to cause a denial of service through excessive CPU and memory use. With full-diff change tracking,...