CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

490206 matches found

EUVD•added 2026/08/17 9:01 p.m.•30 views

EUVD-2026-60467

JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...

5.4CVSS5.9AI score0.00341EPSS

SaveExploits0References3

EUVD•added 2026/08/17 8:51 p.m.•31 views

EUVD-2026-60457

FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...

7.8CVSS6.3AI score0.00224EPSS

SaveExploits0References5

Cvelist•added 2026/08/17 8:32 p.m.•50 views

CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

7.1CVSS0.00352EPSS

SaveExploits1References2

attackerkb•added 2026/08/17 8:27 p.m.•70 views

CVE-2026-73410

Budibase is an open-source low-code platform. Prior to 3.40.0, packages/backend-core/src/utils/outboundFetch.ts pinned a validated address through a Node agent, but the REST integration used getDispatcher from packages/backend-core/src/utils/fetch.ts, causing undici to ignore that agent and resol...

8.5CVSS6AI score0.0028EPSS

SaveExploits0References3Affected Software1

Vulnrichment•added 2026/08/17 8:24 p.m.•15 views

CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

8.4CVSS6.6AI score0.00446EPSS

SaveExploits0References2