Lucene search
+L

14143 matches found

Cvelist
Cvelist
•added 2026/07/29 8:53 p.m.•67 views

CVE-2026-67438 OliveTin OS Command Injection via Custom regex: Argument Type Bypassing Shell Safety Check

OliveTin gives access to predefined shell commands from a web interface. From 3000.2.0 until 3000.17.0, the service/internal/executor/arguments.go checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions, allowing values that pass...

6.6CVSS0.0159EPSS
SaveExploits0References3
attackerkb
attackerkb
•added 2026/07/29 7:39 p.m.•19 views

CVE-2026-67435

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 6.0.0, lib.url.fetch followed cross-origin redirects while forwarding caller-supplied credential headers other than Authorization and Cookie, allowing a malicious...

6CVSS5.9AI score0.00497EPSS
SaveExploits0References4Affected Software1
OSV
OSV
•added 2026/07/29 7:15 p.m.•19 views

CVE-2026-67431 MCP Ruby SDK: Ruby SSE Session Poisoning

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that...

8.3CVSS6AI score
SaveExploits0References5
EUVD
EUVD
•added 2026/07/29 7:01 p.m.•30 views

EUVD-2026-50485

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to access test report contents they were not authorized to...

4.3CVSS5.9AI score0.00389EPSS
SaveExploits0References3
OSV
OSV
•added 2026/07/29 9:16 a.m.•12 views

UBUNTU-CVE-2026-65325

Apache Traffic Server reuses multiplexed HTTP/2 origin connections without verifying the server certificate covers the new request hostname. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1....

6.3CVSS5.8AI score0.00282EPSS
SaveExploits0References3
Tenable Nessus
Tenable Nessus
•added 2026/07/29 12:00 a.m.•18 views

openSUSE 16 Security Update : perl-YAML-Syck (openSUSE-SU-2026:21452-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21452-1 advisory. Changes in perl-YAML-Syck: - updated to 1.470.0 1.47 Security - Fix four libsyck memory-safety CVEs reachable from the default YAML::Syck::Load...

9.1CVSS5.8AI score0.00632EPSS
SaveExploits0References14
EUVD
EUVD
•added 2026/07/28 9:22 p.m.•16 views

EUVD-2026-50067

datamodel-code-generator generates Python data models from schema definitions. From 0.14.1 until 0.60.2, the --extra-template-data comment field is rendered into Python comments in src/datamodelcodegenerator/model/template/TypeAliasAnnotation.jinja2,...

7.8CVSS5.9AI score0.0021EPSS
SaveExploits0References3
EUVD
EUVD
•added 2026/07/28 8:21 p.m.•15 views

EUVD-2026-50028

IBM Aspera Faspex 5 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management...

8.2CVSS5.8AI score0.00335EPSS
SaveExploits0References1
attackerkb
attackerkb
•added 2026/07/28 6:58 p.m.•11 views

CVE-2026-11391

Tanium addressed a SQL injection vulnerability in Patch...

6.3CVSS5.9AI score0.00256EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
•added 2026/07/28 5:59 p.m.•19 views

EUVD-2026-49952

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the Gnumeric reader reads attacker-supplied .gnumeric files into memory an...

7.5CVSS6.9AI score0.007EPSS
SaveExploits0References7
SUSE CVE
SUSE CVE
•added 2026/07/28 5:08 p.m.•14 views

SUSE CVE-2026-64538

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix null-ptr-deref in fib6nhmtuchange. fib6nhmtuchange re-fetches idev via in6devgetarg-dev and dereferences idev-cnf.mtu6 without a NULL check. addrconfifdown clears dev-ip6ptr with RCUINITPOINTER after rt6disableip has...

5.5CVSS5.7AI score0.00195EPSS
SaveExploits0References12
SUSE CVE
SUSE CVE
•added 2026/07/28 5:07 p.m.•11 views

SUSE CVE-2026-64551

In the Linux kernel, the following vulnerability has been resolved: sctp: validate STALECOOKIE cause length before reading staleness When an ERROR chunk with a STALECOOKIE cause is received in the COOKIEECHOED state, sctpsfdo526stale reads the 4-byte Measure of Staleness that follows the cause...

5.3CVSS5.8AI score0.00514EPSS
SaveExploits0References13
OSV
OSV
•added 2026/07/28 8:35 a.m.•13 views

ROOT-APP-NPM-CVE-2026-65900 CVE-2026-65900 in @rootio/dompurify - Patched by Root

Root has patched CVE-2026-65900 in the @rootio/dompurify package for Root:npm. Multiple fixed versions available...

6.1CVSS5.8AI score0.0031EPSS
SaveExploits1
Positive Technologies
Positive Technologies
•added 2026/07/28 12:00 a.m.•16 views

PT-2026-65622

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.1 Description The bulkDownload handler in httpserver/updown.go fails to call findEffectiveACL or applyCustomAuth when processing ZIP downloads via the ?bulk&file= parameter. This allows an unauthenticated network...

7.5CVSS5.5AI score0.00466EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
•added 2026/07/28 12:00 a.m.•22 views

PT-2026-65549

Name of the Vulnerable Software and Affected Versions terraform-mcp-server versions prior to 1.1.0 Description A server-side request forgery SSRF issue exists in the streamable-HTTP transport. This allows an unauthenticated remote client to redirect the server's Terraform API requests and the...

8.6CVSS5.7AI score0.00394EPSS
SaveExploits0References7
NVD
NVD
•added 2026/07/27 9:17 p.m.•14 views

CVE-2026-43799

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to cause unexpected system...

9.8CVSS0.00661EPSS
SaveExploits0References8
Vulnrichment
Vulnrichment
•added 2026/07/27 8:13 p.m.•14 views

CVE-2026-43814

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, watchOS 26.6. An app may be able to cause unexpected system termination...

5.8AI score0.00588EPSS
SaveExploits0References4
attackerkb
attackerkb
•added 2026/07/27 8:12 p.m.•11 views

CVE-2026-43763

A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to read files outside of its sandbox...

5.8AI score0.00155EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment
•added 2026/07/27 8:12 p.m.•13 views

CVE-2026-43774

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access sensitive user data...

5.8AI score0.00165EPSS
SaveExploits0References3
CVE
CVE
•added 2026/07/27 8:12 p.m.•75 views

CVE-2026-64734

A vulnerability in the Contacts component of Apple operating systems allows an attacker to leak sensitive data by processing a maliciously crafted contact . The issue was addressed with improved checks in the following versions: iOS 18.7.10 , iPadOS 18.7.10 , iOS 26.6 , iPadOS 26.6 , macOS Sequoi...

5.5CVSS5.1AI score0.00163EPSS
SaveExploits0References7Affected Software5
Rows per page
Query Builder