Lucene search
+L

3322 matches found

Wolfi
Wolfi
added 2026/07/28 8:23 p.m.23 views

CVE-2026-59920 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0...

6.5CVSS5.8AI score0.00239EPSS
SaveExploits0
CVE
CVE
added 2026/07/28 8:21 p.m.45 views

CVE-2026-14996

IBM Aspera Faspex 5.0.0–5.0.15.4 contains a session-management vulnerability (CVE-2026-14996) with high impact on confidentiality and potential for unauthorized access. The issue affects Faspex 5 deployments prior to 5.0.16 and is addressed by upgrading to IBM Aspera Faspex 5.0.16. This bulletin ...

8.2CVSS5.8AI score0.00225EPSS
SaveExploits0References1Affected Software1
attackerkb
attackerkb
added 2026/07/28 2:25 p.m.13 views

CVE-2026-63727

Anchore Enterprise versions from 5.11.0 to 5.27.1 and 6.0.0 contain an improper privilege escalation vulnerability in the user management API. An authenticated attacker who is able to access the Anchore Enterprise API could issue an API call capable of modifying user permissions to gain access to...

8.8CVSS5.9AI score0.0026EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2026/07/27 10:44 p.m.62 views

CVE-2026-65443 WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...

7.1CVSS0.00142EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/27 7:17 p.m.28 views

CVE-2026-66031

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

5.4CVSS0.00165EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/27 6:17 p.m.20 views

CVE-2026-66029

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

5.4CVSS0.00165EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/27 6:09 p.m.38 views

EUVD-2026-49397

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/27 6:09 p.m.29 views

CVE-2026-66031

The vulnerability CVE-2026-66031 affects Ekushey Project Manager CRM version 5.0. It is a stored cross-site scripting (XSS) flaw triggered by malicious payloads entered into the Reply Ticket field, executable in the browser sessions of Staff or Administrator users when they view the Support Ticke...

5.4CVSS6AI score0.00165EPSS
SaveExploits0References3
Cvelist
Cvelist
added 2026/07/27 6:02 p.m.45 views

CVE-2026-66029 Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile page without sanitization. Attackers ca...

5.4CVSS0.00165EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2026/07/27 6:00 p.m.12 views

CVE-2026-66028 Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email

Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack of email field uniqueness enforcement t...

7.1CVSS5.9AI score0.00321EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/27 1:59 p.m.33 views

CVE-2026-65567

The vulnerability concerns the WordPress Event Tickets plugin for WordPress, affected in versions ≤ 5.29.0.1. It is described as an Unauthenticated Broken Access Control flaw, meaning unauthenticated users can access restricted functionality or data. The CVE-2026-65567 entry confirms the issue wi...

5.3CVSS5.8AI score0.00171EPSS
SaveExploits0References1
IBM Security Bulletins
IBM Security Bulletins
added 2026/07/27 7:41 a.m.15 views

Security Bulletin: IBM Sterling Control Center is affected by multiple vulnerabilities in activemq-all jar

Summary IBM Sterling Control Center is affected by multiple vulnerabilities CVE-2026-42253, CVE-2026-42588, CVE-2026-45505, CVE-2026-46605, CVE-2026-49157, CVE-2026-49270 reported for activemq-all-5.19.0.jar Vulnerability Details CVEID:CVE-2026-42253 DESCRIPTION: Improper Neutralization of Input...

8.8CVSS6.5AI score0.01107EPSS
SaveExploits2Affected Software1
attackerkb
attackerkb
added 2026/07/27 6:00 a.m.12 views

CVE-2026-12982

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...

5.9AI score0.00162EPSS
SaveExploits0References1
attackerkb
attackerkb
added 2026/07/27 12:00 a.m.8 views

CVE-2026-51077

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the syssqlquery.php component...

6AI score0.0031EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/27 12:00 a.m.52 views

PT-2026-65095

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...

5.4CVSS5.4AI score0.00165EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/07/27 12:00 a.m.29 views

PT-2026-64853

The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without authentication and allowing unauthenticated attackers to read customer booking data and modify other...

5.9AI score0.00367EPSS
SaveExploits2References1
NVD
NVD
added 2026/07/24 3:18 p.m.23 views

CVE-2026-55730

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

8.7CVSS0.00358EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/24 11:12 a.m.12 views

OESA-2026-3161 gawk security update

The gawk package is the GNU implementation of awk. The awk utility interprets a special-purpose programming language that makes it possible to handle simple data-reformatting jobs with just a few lines of code. Security Fixes: Use After Free vulnerability has been found in "io.c" program file of...

9.1CVSS5.4AI score0.00353EPSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/24 2:31 a.m.43 views

CVE-2026-15420 Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

4.3CVSS0.00586EPSS
SaveExploits0References10
OSV
OSV
added 2026/07/23 9:16 p.m.15 views

CVE-2025-71389 Cal.com before 5.9.9 Remote Code Execution via RSC

Cal.com calcom/cal.diy before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components RSC request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause...

10CVSS6.6AI score
SaveExploits0References6
Rows per page
Query Builder