Lucene search
+L

4454097 matches found

Packet Storm News
Packet Storm News
added 2026/12/29 12:0 a.m.398 views

GNUnet P2P Framework 0.26.2

GNUnet is a peer-to-peer framework with focus on providing security. All peer-to-peer messages in the network are confidential and authenticated. The framework provides a transport abstraction layer and can currently encapsulate the network traffic in UDP IPv4 and IPv6, TCP IPv4 and IPv6, HTTP, o...

6.8AI score
SaveExploits0
Cvelist
Cvelist
added 7 minutes ago1 views

CVE-2026-63640 MagicMirror socket payload secret placeholder expansion can disclose SECRET_* environment variables

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/nodehelper.js passes every inbound object payload through replaceSecretPlaceholder in js/serverfunctions.js before invoking...

4.3CVSS
SaveExploits0References4
Cvelist
Cvelist
added 11 minutes ago1 views

CVE-2026-66780 Submariner-operator: submariner-operator: flat broker trust model grants every spoke full crud on all endpoints, secrets, and endpointslices in broker namespace

A flaw was found in the submariner-operator component. The submariner-k8s-broker-cluster Role, which is assigned to joined clusters, possesses excessive permissions. This allows a compromised cluster to alter network configurations, specifically by overwriting other clusters' endpoint information...

9.9CVSS
SaveExploits0References2
Cvelist
Cvelist
added 15 minutes ago1 views

CVE-2026-74046 Wazuh 4.4.0 < 4.14.7 DoS via fdecompress_files() Zip Bomb

Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompressfiles function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster...

6.9CVSS
SaveExploits0References3
Patchstack
Patchstack
added 16 minutes ago0 views

NPM: MagicMirror: ssrf calendar .js

NPM: MagicMirror: ssrf calendar .js vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

6.3CVSS5.2AI score
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 16 minutes ago0 views

MagicMirror: ssrf calendar .js

Vulnerability — SSRF via ADDCALENDAR MagicMirror² calendar Analysis of the PoC exploit-ssrf-calendar.js. Target: calendar/nodehelper.js of MagicMirror², socket.io namespace /calendar. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-calendar.js | | Endpoint |...

6.3CVSS5.5AI score
SaveExploits0References5Affected Software1
Cvelist
Cvelist
added 16 minutes ago1 views

CVE-2026-74044 Wazuh 4.0.0 < 4.14.6 Path Traversal Arbitrary Directory Deletion via Cluster Hello

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows authenticated cluster peers to delete arbitrary directory contents by supplying a traversal-shaped node name in the cluster hello payload without validation. Attackers holding a valid cluster Fernet key can craft a...

7CVSS
SaveExploits0References3
Github Security Blog
Github Security Blog
added 16 minutes ago0 views

MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

Vulnerability — Blind SSRF via CHECKARTICLEURL MagicMirror² newsfeed Analysis of the PoC exploit-ssrf-newsfeed.js. Target: newsfeed/nodehelper.js of MagicMirror², socket.io namespace /newsfeed. --- Identification | Field | Value | |-------|-------| | PoC file | exploit-ssrf-newsfeed.js | | Endpoi...

6.3CVSS5.5AI score
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added 16 minutes ago0 views

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

NPM: MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

6.3CVSS5.2AI score
SaveExploits0References5Affected Software1
Patchstack
Patchstack
added 16 minutes ago0 views

NPM: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

NPM: MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions vulnerability discovered by ? in WordPress Npm magicmirror versions 2.37.0...

2.3CVSS5.3AI score
SaveExploits0References5Affected Software1
Github Security Blog
Github Security Blog
added 16 minutes ago0 views

MagicMirror Socket.IO module namespaces bypass configured IP whitelist and allow unauthenticated server-side actions

Summary MagicMirror applies ipWhitelist only as Express middleware, but the Socket.IO server is attached directly to the HTTP server without equivalent IP allowlist, origin, or namespace authentication checks. In a documented common deployment where MagicMirror listens on a non-loopback interface...

2.3CVSS6.2AI score
SaveExploits0References5Affected Software1
Cvelist
Cvelist
added 17 minutes ago1 views

CVE-2026-74039 Wazuh 4.0.0 < 4.14.7 API DoS via Deeply Nested JSON auth_context

Wazuh 4.0.0 before 4.14.7 and 5.0.0-beta2 contain a denial of service vulnerability that allows authenticated attackers with allowrunas enabled to exhaust CPU resources by submitting arbitrarily deeply nested JSON structures to the POST /security/user/authenticate/runas endpoint. Attackers can...

7.1CVSS
SaveExploits0References3
Cvelist
Cvelist
added 18 minutes ago1 views

CVE-2026-74038 Wazuh 4.0.0 < 4.14.6 Path Traversal DoS via Agent Enrollment

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OSIsValidName and unsafe...

7.1CVSS
SaveExploits0References3
Cvelist
Cvelist
added 18 minutes ago1 views

CVE-2026-67262

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass...

8.1CVSS
SaveExploits0References1
Cvelist
Cvelist
added 21 minutes ago2 views

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

6.3CVSS
SaveExploits0References4
CVE
CVE
added 21 minutes ago2 views

CVE-2026-63642 MagicMirror newsfeed Socket.IO notification allows blind server-side request forgery

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/nodehelper.js accepts the CHECKARTICLEURL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetchurl, method: "HEAD" without validating the...

6.3CVSS5.3AI score
SaveExploits0References4
Cvelist
Cvelist
added 24 minutes ago2 views

CVE-2026-63643 MagicMirror: ssrf calendar .js

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADDCALENDAR handler in defaultmodules/calendar/nodehelper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handle...

6.3CVSS
SaveExploits0References4
CVE
CVE
added 24 minutes ago1 views

CVE-2026-63643 MagicMirror: ssrf calendar .js

MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADDCALENDAR handler in defaultmodules/calendar/nodehelper.js accepts an attacker-controlled URL, authentication data, and selfSignedCert setting through the unauthenticated Socket.IO namespace /calendar. The handle...

6.3CVSS5.4AI score
SaveExploits0References4
NVD
NVD
added 26 minutes ago0 views

CVE-2026-75897

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request...

8.7CVSS
SaveExploits0References2
NVD
NVD
added 26 minutes ago0 views

CVE-2026-75924

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests CSRs, which could lead to information disclosure and...

8.7CVSS
SaveExploits0References2
Rows per page
Query Builder