Lucene search
+L

3352 matches found

Cvelist
Cvelist
added 2026/07/17 4:14 a.m.44 views

CVE-2026-58317

Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...

6.3CVSS0.00181EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/17 12:0 a.m.15 views

PT-2026-60715

Unsigned to Signed Conversion Error CWE-196 vulnerability exists in TTSSH2 plugin of Tera Term provided by TeraTerm Project. When Tera Term attempts to establish an SSH connection to a server set up by an attacker, out-of-bounds read/write may occur. As a result, the contents of adjacent memory...

6.3CVSS6.6AI score0.00181EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/17 12:0 a.m.16 views

PT-2026-60798

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned...

5.4CVSS5.4AI score0.00193EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/16 6:42 p.m.7 views

MAL-2026-10718 Malicious code in @sciagent/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 310123a94891174b8cfa55def38b6e916b89d43306a52793739f26289fe51e4d scripts/postinstall.js fetches a 10MB+ 'sciagent' executable over HTTPS from https://u250924-adc6-f977430f.westb.seetacloud.com:8443 a rented...

6.2AI score
SaveExploits0References2
OSV
OSV
added 2026/07/16 6:41 p.m.13 views

MAL-2026-10732 Malicious code in hehehe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 588dd776720f805d7d84a58c93ffcd21ed860e3fc21a48787d732eb6180b974d Package is published as an 'enterprise Windows Diagnostic Utility' but is an anti-proctoring cheating tool that also steals the installer's browser...

6.1AI score
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/16 4:35 p.m.9 views

CVE-2026-45795

The Janssen Project is an open-source identity and access management IAM platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload returns null, and...

5.3CVSS6.1AI score0.00159EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/07/16 4:35 p.m.10 views

EUVD-2026-44969

The Janssen Project is an open-source identity and access management IAM platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload returns null, and...

5.3CVSS6.1AI score0.00159EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/16 4:35 p.m.17 views

CVE-2026-45795

The Janssen Project's Jans-auth-server had a JWE request object signature verification bypass prior to version 2.0.0: unsigned JWE were accepted because JwtAuthorizationRequest skipped inner signature validation when jwe.getSignedJWTPayload() was null, and AuthzRequestService.processRequestObject...

5.3CVSS6.1AI score0.00159EPSS
SaveExploits0References4
OSV
OSV
added 2026/07/16 4:35 p.m.10 views

CVE-2026-45795 Janssen Project: JWE Request Object Signature Verification Bypass in jans-auth-server

The Janssen Project is an open-source identity and access management IAM platform. Prior to 2.0.0, jans-auth-server accepts unsigned JWE request objects because JwtAuthorizationRequest skips inner signature validation when jwe.getSignedJWTPayload returns null, and...

5.3CVSS6.1AI score
SaveExploits0References6
CVE
CVE
added 2026/07/15 7:41 p.m.27 views

CVE-2026-46684

CVE-2026-46684 (DataEase) : Open-source data visualization tool DataEase prior to 2.10.23 is affected by an unauthorized command execution vulnerability. The issue stems from enterprise token handling where TokenFilter#doFilter() may pass X-DE-TOKEN values to TokenUtils.validate(), which only che...

9.5CVSS6.1AI score0.00193EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/07/15 11:25 a.m.10 views

CVE-2026-61446

PraisonAI praisonaiagents before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python .py files from project-level and user-home .praisonai/plugins/ directories using importlib specfromfilelocation and execmodule without code...

8.6CVSS6.6AI score0.00221EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/15 11:25 a.m.39 views

CVE-2026-61446 PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery

PraisonAI praisonaiagents before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python .py files from project-level and user-home .praisonai/plugins/ directories using importlib specfromfilelocation and execmodule without code...

8.6CVSS0.00221EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/14 9:41 p.m.7 views

JLSEC-2026-726 wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the...

wolfSSL's ECCSI signature verifier wcVerifyEccsiHash decodes the r and s scalars from the signature blob via mpreadunsignedbin with no check that they lie in 1, q-1. A crafted forged signature could verify against any message for any identity, using only publicly-known constants...

8.1CVSS6.1AI score0.00147EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/13 2:36 p.m.5 views

PYSEC-2026-2507 ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle

Summary The ha-mcp OAuth consent form beta feature accepts a user-supplied haurl and makes a server-side HTTP request to haurl/api/config with no URL validation. An unauthenticated attacker can submit arbitrary URLs to perform internal network reconnaissance via an error oracle. Two additional co...

5.3CVSS6.3AI score0.00278EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/13 12:0 a.m.36 views

CVE-2026-51536

In OpENer 2.3.0 commit 76b95cf when parsing incoming CIP Common Industrial Protocol network packets, the length parameter is inconsistently typed across the call stack. Specifically, an upstream length calculated as an int is passed to a downstream function that expects an EipInt16 a 16-bit signe...

0.00472EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/12 9:14 p.m.5 views

MAL-2026-10209 Malicious code in auto-debug-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8dd31c11b5149d8dd2142c81cc066576dc799ba4dae4599a9569cb56256417ec package.json declares a postinstall hook node install.js that fires automatically on npm install. On Windows, install.js invokes hidden PowerShell -N...

6.1AI score
SaveExploits0References4
OSV
OSV
added 2026/07/09 5:53 a.m.7 views

MAL-2026-7028 Malicious code in calvuepro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9de2057a076c31ca107db2c3e8d330a7b4aa2d8d67896cecd6c7ebef21d07731 Package ships a 5.7MB prebuilt darwin-arm64 Mach-O at vendor/clavuepro-darwin-arm64 with no source tree, no hash/signature verification, and no...

6.2AI score
SaveExploits0References2
NVD
NVD
added 2026/07/08 11:16 p.m.12 views

CVE-2026-54782

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. Prior to 1.8.1 and 1.9.1, CoreWCF SAML 1.1 and SAML 2.0 token validation does not correctly resolve the issuer signing key or require signed tokens when IdentityConfiguration is used with federated binding...

10CVSS0.00246EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/08 2:17 p.m.15 views

CVE-2026-56360

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data...

6.3CVSS0.00186EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/08 1:49 p.m.11 views

CVE-2026-56360

n8n before versions 1.123.18 and 2.6.2 fails to verify HMAC-SHA256 signatures on Zendesk webhooks in the ZendeskTrigger node. Attackers who know the webhook URL can send unsigned POST requests to trigger workflows with arbitrary malicious data...

6.3CVSS6.1AI score0.00186EPSS
SaveExploits0References3Affected Software1
Rows per page
Query Builder