Lucene search
+L

13871 matches found

Positive Technologies
Positive Technologies
added 2026/07/15 12:0 a.m.19 views

PT-2026-60185

Name of the Vulnerable Software and Affected Versions F5 BIG-IP affected versions not specified Description When an HTTP/2 profile is configured on a virtual server, specific undisclosed requests can lead to increased memory resource utilization. This data plane issue allows a remote,...

8.7CVSS5.2AI score0.0046EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/14 11:58 p.m.9 views

MAL-2026-10644 Malicious code in proxy-checker-j (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4316f8f54acc92939cdf73074666eecab7d5e680c7c4ad572ad3164671aa19dc The package is published on PyPI as proxy-checker-j with the summary 'packaged command for running the bundled qsshd executable', but its actual...

6.5AI score
SaveExploits0References2
OSV
OSV
added 2026/07/14 9:41 p.m.11 views

JLSEC-2026-738 Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA

Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs WOLFSSLTEMPCA added while building a certificate path were previously exempt...

6.3CVSS5.9AI score0.00118EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/14 9:22 p.m.42 views

CVE-2026-46629 Twig: Unbounded formatter memoisation in twig/intl-extra keyed on template-controlled arguments

Twig is a template language for PHP. Prior to 3.26.0, twig/intl-extra memoises IntlDateFormatter and NumberFormatter instances in arrays keyed by template-controlled filter arguments such as locale, pattern, and attrs, allowing a template to allocate many ICU formatter objects that remain pinned...

5.3CVSS0.00302EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/14 8:29 p.m.7 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the serviceAccountName field in the Kubernetes backend configuration. An attacker can gain elevated privileges by specifying an arbitrary ServiceAccount, allowing access to sensitive resources and potential ful...

8.2CVSS6.2AI score
SaveExploits0References3
NVD
NVD
added 2026/07/14 8:17 p.m.12 views

CVE-2026-47736

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends...

7.5CVSS0.00346EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/14 8:16 p.m.8 views

CVE-2026-15709

A flaw was found in libsoup's WebSocket implementation when using the permessage-deflate extension. The extension's decompression loop inflate processes data in chunks without enforcing an upper boundary limit on the output buffer size. While libsoup limits the incoming compressed frame size via...

7.5CVSS0.00548EPSS
SaveExploits0References3
Debian CVE
Debian CVE
added 2026/07/14 7:54 p.m.8 views

CVE-2026-47736

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, when PROXY protocol v1 support is enabled, Puma reads incoming bytes into an internal buffer while waiting for CRLF to determine whether a PROXY v1 line is present, allowing an attacker that continuously sends...

7.5CVSS5.5AI score0.00346EPSS
SaveExploits0
PyPA
PyPA
added 2026/07/14 5:17 p.m.11 views

PYSEC-2026-3457

pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a very large exponent, causing float...

7.5CVSS5.2AI score0.00335EPSS
SaveExploits0References3Affected Software1
NVD
NVD
added 2026/07/14 5:16 p.m.10 views

CVE-2026-49799

Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service LSASS allows an authorized attacker to deny service over a network...

6.5CVSS0.00791EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/14 4:17 p.m.27 views

CVE-2026-59204

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and...

8.7CVSS0.00393EPSS
SaveExploits1References4
OSV
OSV
added 2026/07/14 4:17 p.m.6 views

DEBIAN-CVE-2026-59204

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and...

7.5CVSS6.1AI score0.00393EPSS
SaveExploits1References1
OSV
OSV
added 2026/07/14 4:17 p.m.5 views

UBUNTU-CVE-2026-59204

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and...

8.7CVSS6.1AI score0.00393EPSS
SaveExploits1References6
UbuntuCve
UbuntuCve
added 2026/07/14 4:17 p.m.15 views

CVE-2026-59204

Pillow is a Python imaging library. From 8.2.0 through 12.2.0, src/libImaging/Jpeg2KDecode.c accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile, allowing a crafted tiled JPEG2000 file to force substantially higher transient memory usage and...

8.7CVSS6.1AI score0.00393EPSS
SaveExploits1References5
EUVD
EUVD
added 2026/07/14 12:31 a.m.10 views

EUVD-2026-43547

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the...

9.3CVSS6.1AI score0.00371EPSS
SaveExploits0References3
OSV
OSV
added 2026/07/13 11:41 p.m.9 views

GHSA-XF7X-X43H-RPQH json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoS

Circular JSON Schema $ref causes unbounded CPU DoS in jsonrepair Summary SchemaRepairer.resolveschema in jsonrepair follows JSON Schema $ref pointers in an unbounded while loop without any cycle detection. An attacker who can supply a schema containing a self-referencing $ref e.g., via the demo...

7.5CVSS6.2AI score
SaveExploits0References3
NVD
NVD
added 2026/07/13 10:16 p.m.12 views

CVE-2026-62327

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

9.3CVSS0.00371EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/13 9:37 p.m.41 views

CVE-2026-62327 9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

9.3CVSS0.00371EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/13 9:37 p.m.9 views

CVE-2026-62327

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit th...

9.3CVSS6.1AI score0.00371EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/13 9:37 p.m.31 views

CVE-2026-62327

The vulnerability concerns 9Router up to version 0.4.41. An unauthenticated request to the Next.js API route /api/usage/stats is possible due to missing authentication middleware, leading to exposure of plaintext API keys for all connected AI provider accounts, along with token counts, costs and ...

9.3CVSS6.1AI score0.00371EPSS
SaveExploits0References2
Rows per page
Query Builder