Lucene search
+L

63711 matches found

Vulnrichment
Vulnrichment
added 2026/07/07 4:2 p.m.23 views

CVE-2026-57851 MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

8.5CVSS6AI score0.0017EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/07 4:2 p.m.48 views

CVE-2026-57851 MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers

MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCTL handlers without administrator...

8.5CVSS0.0017EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/07 4:2 p.m.41 views

CVE-2026-57851

MSI Feature Manager contains a local privilege escalation via the KernCoreLib64.sys kernel driver. An attacker with local access can use exposed IOCTL handlers to perform arbitrary physical memory read/write and unrestricted I/O port operations without administrator privileges. This can enable ma...

8.5CVSS6AI score0.0017EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/07 3:26 p.m.9 views

GO-2026-5827 gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host in go.senan.xyz/gonic

gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-controlled path on the host in go.senan.xyz/gonic...

8.1CVSS6.1AI score0.00428EPSS
SaveExploits0References2
OSV
OSV
added 2026/07/07 2:34 p.m.11 views

PYSEC-2026-1719 Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint

In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the downloadmodel endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's...

6.5CVSS7.4AI score0.01125EPSS
SaveExploits0References5
PyPA
PyPA
added 2026/07/07 2:34 p.m.14 views

Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint

In open-webui version 0.3.8, the endpoint /models/upload is vulnerable to arbitrary file write due to improper handling of user-supplied filenames. The vulnerability arises from the usage of filepath = f"UPLOADDIR/file.filename" without proper input validation or sanitization. An attacker can...

6.5CVSS6.8AI score0.02458EPSS
SaveExploits0References5Affected Software1
PyPA
PyPA
added 2026/07/07 2:34 p.m.15 views

Open WebUI Allows Arbitrary File Write via the `download_model` Endpoint

In version 0.3.8 of open-webui/open-webui, an arbitrary file write vulnerability exists in the downloadmodel endpoint. When deployed on Windows, the application improperly handles file paths, allowing an attacker to manipulate the file path to write files to arbitrary locations on the server's...

6.5CVSS6.8AI score0.01125EPSS
SaveExploits0References5Affected Software1
OSV
OSV
added 2026/07/07 2:34 p.m.10 views

PYSEC-2026-1730 Open WebUI Allows Arbitrary File Write via the `/models/upload` Endpoint

In open-webui version 0.3.8, the endpoint /models/upload is vulnerable to arbitrary file write due to improper handling of user-supplied filenames. The vulnerability arises from the usage of filepath = f"UPLOADDIR/file.filename" without proper input validation or sanitization. An attacker can...

6.5CVSS6.2AI score0.02458EPSS
SaveExploits0References5
OSV
OSV
added 2026/07/07 2:34 p.m.13 views

PYSEC-2026-1406 GluonCV Arbitrary File Write via TarSlip

A vulnerability in the ImageClassificationDataset.fromcsv API of the dmlc/gluon-cv repository, version 0.10.0, allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it susceptible to a TarSlip vulnerability. Attackers can...

7.1CVSS7.1AI score0.00293EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/07 2:34 p.m.9 views

PYSEC-2026-1444 H2O Vulnerable to Denial of Service (DoS) and File Write

In h2oai/h2o-3 version 3.46.0.1, the runtool command exposes classes in the water.tools package through the ast parser. This includes the XGBoostLibExtractTool class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service...

7.5CVSS7.2AI score0.00636EPSS
SaveExploits1References6
OSV
OSV
added 2026/07/07 2:34 p.m.7 views

PYSEC-2026-1353 Exiv2 allows Use After Free

Impact A heap buffer overflow was found in Exiv2 versions v0.28.0 to v0.28.4. Versions prior to v0.28.0, such as v0.27.7, are not affected. Exiv2 is a command-line utility and C++ library for reading, writing, deleting, and modifying the metadata of image files. The heap overflow is triggered whe...

5.3CVSS6.2AI score0.00908EPSS
SaveExploits1References8
OSV
OSV
added 2026/07/07 2:34 p.m.6 views

PYSEC-2026-1162 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

7.1CVSS6.7AI score0.02562EPSS
SaveExploits0References6
OSV
OSV
added 2026/07/07 2:34 p.m.7 views

PYSEC-2026-1721 open-webui allows writing and deleting arbitrary files

In version v0.3.8 of open-webui/open-webui, the endpoint /api/pipelines/upload is vulnerable to arbitrary file write and delete due to unsanitized file.filename concatenation with CACHEDIR. This vulnerability allows attackers to overwrite and delete system files, potentially leading to remote cod...

7CVSS7AI score0.01062EPSS
SaveExploits1References6
OSV
OSV
added 2026/07/07 2:34 p.m.8 views

PYSEC-2026-1665 Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files

Summary Upon reviewing the MobSF source code, I identified a flaw in the Static Libraries analysis section. Specifically, during the extraction of .a extension files, the measure intended to prevent Zip Slip attacks is improperly implemented. Since the implemented measure can be bypassed, the...

8.6CVSS6AI score0.00956EPSS
SaveExploits1References6
OSV
OSV
added 2026/07/07 2:34 p.m.8 views

PYSEC-2026-1588 lollms vulnerable to path traversal due to unauthenticated root folder settings change

A path traversal vulnerability exists in the XTTS server included in the lollms package, version v9.6. This vulnerability arises from the ability to perform an unauthenticated root folder settings change. Although the read file endpoint is protected against path traversals, this protection can be...

8.6CVSS7.3AI score0.00644EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/07 2:16 p.m.13 views

CVE-2026-6101

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwpsavelocalfont function combined with inadequate cleanup that fails to remove nested directories and...

7.5CVSS0.00628EPSS
SaveExploits0References10
ATTACKERKB
ATTACKERKB
added 2026/07/07 1:32 p.m.15 views

CVE-2026-6101

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwpsavelocalfont function combined with inadequate cleanup that fails to remove nested directories and...

7.5CVSS6.7AI score0.00628EPSS
SaveExploits0References11
Cvelist
Cvelist
added 2026/07/07 1:32 p.m.39 views

CVE-2026-6101 AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwpsavelocalfont function combined with inadequate cleanup that fails to remove nested directories and...

7.5CVSS0.00628EPSS
SaveExploits0References10
EUVD
EUVD
added 2026/07/07 1:32 p.m.11 views

EUVD-2026-42041

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Arbitrary File Write in versions up to and including 1.1.12. This is due to unsafe ZIP file extraction in the ampforwpsavelocalfont function combined with inadequate cleanup that fails to remove nested directories and...

7.5CVSS6.7AI score0.00628EPSS
SaveExploits0References10
CVE
CVE
added 2026/07/07 1:32 p.m.27 views

CVE-2026-6101

The CVE-2026-6101 entry affects the AMP for WP – Accelerated Mobile Pages WordPress plugin (versions up to and including 1.1.12). The vulnerability arises from unsafe ZIP extraction in ampforwp_save_local_font() plus inadequate cleanup that omits removal of nested directories/files, enabling auth...

7.5CVSS6.7AI score0.00628EPSS
SaveExploits0References10
Rows per page
Query Builder