364500 matches found
EUVD-2026-54238
Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...
EUVD-2026-54169
Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-level permissions can send direct HTTP requests to the upsert...
EUVD-2026-54210
sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...
EUVD-2026-54209
The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful...
EUVD-2026-54274
A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71. This issue affects the function fileExists/readFile/writeFile/deleteFile of the file src/core/repository.ts of the component Repositories File API. Performing a manipulation of the argument...
EUVD-2026-54195
The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart through one of its public REST API endpoints, allowing unauthenticated users to set arbitrary product prices and complete WooCommerce orders at...
EUVD-2025-210645
The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these...
EUVD-2025-210644
The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the editposts capability from reading globally password-protected content through the WordPress core REST API when global protection is enabled, allowing any Contributor or higher to read the content of...
EUVD-2025-210647
In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publishe...
SUSE CVE-2026-64590
In the Linux kernel, the following vulnerability has been resolved: dma-buf/udmabuf: skip redundant cpu sync to fix cacheline EEXIST warning When CONFIGDMAAPIDEBUGSG is enabled, importing a udmabuf into a DRM driver e.g. amdgpu for video playback in GNOME Videos / Showtime triggers a spurious...
CVE-2026-19175
creationtimestamp| type| source ---|---|--- 2026-08-06 23:49:42+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117051240113170047...
CVE-2026-19145
creationtimestamp| type| source ---|---|--- 2026-08-06 23:36:33+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117051188055584250...
CVE-2026-71554
creationtimestamp| type| source ---|---|--- 2026-08-06 23:32:34+00:00| seen| https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b 2026-08-07 00:07:12+00:00| seen| https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b...
GHSA-6HR6-W5QG-QMWG
creationtimestamp| type| source ---|---|--- 2026-08-06 23:32:34+00:00| seen| https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b 2026-08-07 00:07:12+00:00| seen| https://gist.github.com/alon710/91251538851544e4ecb69dd2c9aa7a2b...
CVE-2026-19138
creationtimestamp| type| source ---|---|--- 2026-08-06 23:24:57+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117051134731540251...
CVE-2026-15918
creationtimestamp| type| source ---|---|--- 2026-08-06 23:15:08+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3msh6bkcefd2u...
CVE-2026-19137
creationtimestamp| type| source ---|---|--- 2026-08-06 23:09:54+00:00| seen| https://infosec.exchange/users/vuldb/statuses/117051083590682909...
CVE-2026-48088
creationtimestamp| type| source ---|---|--- 2026-08-06 23:08:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msh5uylias2a 2026-08-07 00:00:39+00:00| seen| https://infosec.exchange/users/offseq/statuses/117051283088575349 2026-08-07 00:00:40+00:00| seen|...