Lucene search
+L

54170 matches found

BDU FSTEC
BDU FSTEC
added 5 days ago5 views

The vulnerability of the XmlLayout() function in the Apache Log4j Core library allows attackers to compromise the integrity of the protected information.

The vulnerability of the XmlLayout function in the Apache Log4j Core logging library is related to improper encoding or escaping of output data. Exploiting this vulnerability allows an attacker to influence the integrity of the protected information from a remote location...

7.8CVSS5.5AI score0.0086EPSS
SaveExploits0References4Affected Software2
EUVD
EUVD
added 6 days ago11 views

EUVD-2025-210545

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

5.5CVSS5.8AI score0.00241EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
added 6 days ago9 views

CVE-2025-36374 IBM DataPower Gateway affected by XML external entity injection

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

5.5CVSS5.8AI score0.00241EPSS
SaveExploits0References1
SUSE CVE
SUSE CVE
added 6 days ago5 views

SUSE CVE-2026-55437

Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the AgentLogLine dashboard component instantiated ansi-to-html without escapeXML: true and inserted the result via dangerouslySetInnerHTML so HTML embedded...

5.4CVSS7.7AI score0.00179EPSS
SaveExploits0References2
OSV
OSV
added 6 days ago5 views

JLSEC-2026-958 ImageMagick: MSL - Stack overflow in ProcessMSLScript

Summary Magick fails to check for circular references between two MSLs, leading to a stack overflow. Details After reading a.msl using magick, the following is displayed: MSLStartElement - ReadImage - ReadMSLImage - ProcessMSLScript - xmlParseChunk - xmlParseTryOrFinish - MSLStartElement bash...

9.8CVSS6.9AI score0.00208EPSS
SaveExploits0References4
OSV
OSV
added 6 days ago5 views

JLSEC-2026-1045 ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark()...

ImageMagick before 7.1.2-13 contains a memory leak vulnerability in LoadOpenCLDeviceBenchmark function when parsing malformed OpenCL device profile XML files with unclosed device elements. Attackers with write access to the OpenCL cache directory can place malicious XML files to exhaust memory an...

1.9CVSS5.9AI score0.00169EPSS
SaveExploits1References5
NVD
NVD
added 6 days ago10 views

CVE-2026-54365

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

8.7CVSS0.00216EPSS
SaveExploits0References2
EUVD
EUVD
added 6 days ago11 views

EUVD-2026-51102

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

8.7CVSS5.9AI score0.00287EPSS
SaveExploits0References2
CVE
CVE
added 6 days ago12 views

CVE-2026-54366

CentreStack prior to 17.4 is affected by an XML External Entity (XXE) vulnerability in the SharePoint storage configuration handler. An unauthenticated attacker can exfiltrate arbitrary files by sending a crafted request to the StorageConfig endpoint, causing the server to fetch and parse attacke...

8.7CVSS5.9AI score0.00287EPSS
SaveExploits0References2
Cvelist
Cvelist
added 6 days ago32 views

CVE-2026-54366 CentreStack < 17.4 XXE via SharePoint Storage Configuration

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

8.7CVSS0.00287EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 6 days ago11 views

CVE-2026-54366 CentreStack < 17.4 XXE via SharePoint Storage Configuration

CentreStack before 17.4 contains an XML external entity XXE injection vulnerability that allows unauthenticated attackers to exfiltrate arbitrary files by supplying a malicious URL to the SharePoint storage configuration handler. Attackers can send a crafted request to the unauthenticated...

8.7CVSS5.9AI score0.00287EPSS
SaveExploits0References2
EUVD
EUVD
added 6 days ago11 views

EUVD-2026-51101

CentreStack before 17.3 contains an unauthenticated deserialization vulnerability in GSNamespace.dll that allows unauthenticated attackers to create arbitrary local OS user accounts by supplying a crafted base64-encoded XML string to exposed API endpoints. Attackers can send a malicious...

8.7CVSS6AI score0.00216EPSS
SaveExploits0References2
Nuclei
Nuclei
added 6 days ago136 views

Zoho ManageEngine - Remote Code Execution

Zoho ManageEngine Password Manager Pro, PAM 360, and Access Manager Plus are susceptible to unauthenticated remote code execution via XML-RPC. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary...

9.8CVSS8AI score0.9994EPSS
SaveExploits5References5
NVD
NVD
added 6 days ago10 views

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

9.9CVSS0.00343EPSS
SaveExploits0References1
Cvelist
Cvelist
added 6 days ago38 views

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

9.9CVSS0.00343EPSS
SaveExploits0References1
EUVD
EUVD
added 6 days ago10 views

EUVD-2026-51019

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

9.9CVSS6AI score0.00343EPSS
SaveExploits0References1
CVE
CVE
added 6 days ago72 views

CVE-2026-58046

CVE-2026-58046 affects Plesk, specifically the XML-RPC API. The root cause is improper neutralization, enabling a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, with potential full panel compromise. No remediation details are pro...

9.9CVSS6AI score0.00343EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 6 days ago13 views

PT-2026-66555

IBM DataPower Gateway is vulnerable to an XML external entity injection XXE attack when processing XML data. A privileged user could exploit this vulnerability to expose sensitive information or consume memory resources...

5.5CVSS5.8AI score0.00241EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 6 days ago10 views

PT-2026-66024

Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

9.6CVSS6.4AI score0.00464EPSS
SaveExploits0References376
Positive Technologies
Positive Technologies
added 6 days ago13 views

PT-2026-66412

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside...

9.8CVSS7.3AI score0.00244EPSS
SaveExploits0References3
Rows per page
Query Builder