Lucene search
+L
AttackerkbMost viewed

96138 matches found

ATTACKERKB
ATTACKERKB
added 2026/05/15 6:45 p.m.40 views

CVE-2026-46407

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, the backend admin/auth-token endpoint allows an authenticated administrator to load another administrator's REST API token list by supplying that user's adminid. This can...

8.1CVSS5.8AI score0.00218EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/05/12 2:18 p.m.40 views

CVE-2026-32687

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in elixir-ecto postgrex 'Elixir.Postgrex.Notifications' module allows SQL Injection. The channel argument passed to 'Elixir.Postgrex.Notifications':listen/3 and...

7.8CVSS5.9AI score0.00198EPSS
SaveExploits0References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/05/09 8:15 p.m.40 views

CVE-2026-8196

A flaw has been found in JeecgBoot 3.9.1. The impacted element is an unknown function of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/LoginController.java of the component mLogin Endpoint. This manipulation causes authorization bypass. The attack...

6.3CVSS5.2AI score0.00463EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/05/08 7:21 a.m.40 views

CVE-2026-43284

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSGSPLICEPAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFLSHAREDFRAG after skbsplicefromiter, so later paths that may modify packet data ca...

8.8CVSS5.7AI score0.93235EPSS
SaveExploits32References11Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/05/07 4:27 a.m.40 views

CVE-2026-7252

The WP-Optimize – Cache, Compress images, Minify & Clean database to boost page speed & performance plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the unscheduledoriginalfiledeletion function in all versions up to, and including, 4.5.2 Th...

8.1CVSS6.5AI score0.0095EPSS
SaveExploits0References10
ATTACKERKB
ATTACKERKB
added 2026/05/07 12:00 a.m.40 views

CVE-2025-63703

npm package parse-ini v1.0.6 is vulnerable to Prototype Pollution in index.js...

5.8AI score0.00416EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2026/05/06 6:57 p.m.40 views

CVE-2026-0300

A buffer overflow vulnerability in the User-ID™ Authentication Portal aka Captive Portal service of Palo Alto Networks PAN-OS software allows an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets. T...

9.3CVSS6.6AI score0.31725EPSS
SaveExploits7References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/05/06 6:13 p.m.40 views

CVE-2026-8018

Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via malicious network traffic. Chromium security severity: Low...

8.1CVSS5.8AI score0.00256EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/05/04 12:47 a.m.40 views

CVE-2026-7372

A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to an arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability. Stack-overflow via...

9CVSS6.5AI score0.00475EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/05/02 11:16 a.m.40 views

CVE-2026-4062

The Geo Mashup plugin for WordPress is vulnerable to Time-Based SQL Injection via the 'objectids' and 'excludeobjectids' parameters in all versions up to, and including, 1.13.18. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existin...

7.5CVSS6AI score0.00328EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/04/14 4:57 p.m.40 views

CVE-2026-32217

Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally...

5.5CVSS5.6AI score0.0042EPSS
SaveExploits0References2Affected Software21
ATTACKERKB
ATTACKERKB
added 2026/04/10 3:07 a.m.40 views

CVE-2026-5501

wolfSSLX509verifycert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints CA:FALSE that is legitimately signed by a trusted root. An attacker who obtains any leaf...

8.6CVSS6AI score0.00184EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/26 4:15 p.m.40 views

CVE-2026-26073

EVerest is an EV charging software stack. Versions prior to 2026.02.0 have a data race leading to possible std::queue/std::deque corruption. The trigger is powermeter public key update and EV session/error events while OCPP not started. This results in a TSAN data race report and an ASAN/UBSAN...

5.9CVSS5.8AI score0.00304EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/24 8:22 p.m.40 views

CVE-2025-33242

NVIDIA B300 MCU contains a vulnerability in the CX8 MCU that could allow a malicious actor to modify unsupported registries, causing a bad state. A successful exploit of this vulnerability might lead to denial of service and data tampering...

5.9CVSS5.8AI score0.00311EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/03/12 9:22 p.m.40 views

CVE-2026-32302

OpenClaw is a personal AI assistant. Prior to 2026.3.11, browser-originated WebSocket connections could bypass origin validation when gateway.auth.mode was set to trusted-proxy and the request arrived with proxy headers. A page served from an untrusted origin could connect through a trusted rever...

8.1CVSS5.8AI score0.00153EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/11 10:04 p.m.40 views

CVE-2026-3919

Use after free in Extensions in Google Chrome prior to 146.0.7680.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

5.8AI score0.00261EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/09 7:35 p.m.40 views

CVE-2025-62166

FreshRSS is a free, self-hostable RSS aggregator. Prior 1.28.0, a bug in the auth logic related to master authentication tokens, this restriction is bypassed. Usually only the default user's feed should be viewable if anonymous viewing is enabled, and feeds of other users should be private. This...

7.5CVSS5.8AI score0.0038EPSS
SaveExploits1References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/03 12:00 a.m.40 views

CVE-2025-69431

The ZSPACE Q2C NAS contains a vulnerability related to incorrect symbolic link following. Attackers can format a USB drive to ext4, create a symbolic link to its root directory, insert the drive into the NAS device's slot, and then access the USB drive's directory mounted on the NAS using the Sam...

5.4AI score0.00292EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2026/01/30 4:32 p.m.40 views

CVE-2026-1689

A vulnerability was detected in Tenda HG10 USHG7HG9HG10re300001138enxpon. The impacted element is the function checkUserFromLanOrWan of the file /boaform/admin/formLogin of the component Login Interface. The manipulation of the argument Host results in command injection. The attack can be launche...

7.5CVSS5.7AI score0.02636EPSS
SaveExploits1References6
ATTACKERKB
ATTACKERKB
added 2025/11/18 11:24 a.m.40 views

CVE-2025-41348

SQL injection vulnerability in WinPlus v24.11.27 by Informática del Este. This vulnerability allows an attacker recover, create, update an delete databases by sendng a POST request using the parameters 'val1' and 'cont in '/WinplusPortal/ws/sWinplus.svc/json/getacumperpost'...

9.8CVSS5.8AI score0.00544EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2025/05/13 12:00 a.m.40 views

CVE-2025-30397

Access of resource using incompatible type ‘type confusion’ in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

7.5CVSS7.1AI score0.26835EPSS
SaveExploits7References2
ATTACKERKB
ATTACKERKB
added 2024/08/05 12:00 a.m.40 views

CVE-2024-38856

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...

9.8CVSS7.3AI score0.99427EPSS
SaveExploits11References5
ATTACKERKB
ATTACKERKB
added 2024/07/01 12:00 a.m.40 views

CVE-2024-20399

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that ar...

6.7CVSS7.2AI score0.04306EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
added 2023/12/24 10:15 p.m.40 views

CVE-2023-7102

Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic...

9.8CVSS7.5AI score0.44575EPSS
SaveExploits2References8
ATTACKERKB
ATTACKERKB
added 2023/09/21 12:00 a.m.40 views

CVE-2023-41993

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS before iOS 16.7. Recent assessments: Assessed...

8.8CVSS9.1AI score0.29179EPSS
SaveExploits3References23
ATTACKERKB
ATTACKERKB
added 2022/11/08 12:00 a.m.40 views

CVE-2022-31199

Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents installed on monitored systems. The remote code execution vulnerabilities exist within the underlying protocol used by the component, and...

9.8CVSS10AI score0.36009EPSS
SaveExploits1References2
ATTACKERKB
ATTACKERKB
added 2022/10/11 7:15 p.m.40 views

CVE-2022-38027

Windows Storage Elevation of Privilege Vulnerability...

7CVSS7.1AI score0.00392EPSS
SaveExploits0References3Affected Software18
ATTACKERKB
ATTACKERKB
added 2022/09/26 12:00 a.m.40 views

CVE-2022-3038

Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

8.8CVSS8.8AI score0.24738EPSS
SaveExploits1References7
ATTACKERKB
ATTACKERKB
added 2022/07/03 1:15 p.m.40 views

CVE-2022-2288

Out-of-bounds Write in GitHub repository vim/vim prior to 9.0...

7.8CVSS6.8AI score0.01387EPSS
SaveExploits1References9
ATTACKERKB
ATTACKERKB
added 2021/09/15 12:00 a.m.40 views

CVE-2021-33045

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. Recent assessments: cbeek-r7 at September 06, 2024 6:04pm UTC reported: On September 5th 2024, CISA...

10CVSS9.6AI score0.99871EPSS
SaveExploits13References4
ATTACKERKB
ATTACKERKB
added 2020/12/08 12:00 a.m.40 views

CVE-2020-27930

A memory corruption issue was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.0.1, watchOS 7.1, iOS 12.4.9, watchOS 6.2.9, Security Update 2020-006 High Sierra, Security Update 2020-006 Mojave, iOS 14.2 and iPadOS 14.2, watchOS 5.3.9, macOS Catalina 10.15.7...

7.8CVSS7.6AI score0.22009EPSS
SaveExploits0References11
ATTACKERKB
ATTACKERKB
added 2020/10/16 12:00 a.m.40 views

CVE-2020-16896

An information disclosure vulnerability exists in Remote Desktop Protocol RDP when an attacker connects to the target system using RDP and sends specially crafted requests, aka ‘Windows Remote Desktop Protocol RDP Information Disclosure Vulnerability’. Recent assessments: 0J3lack0 at November 27,...

7.5CVSS7.2AI score0.12604EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2020/05/21 12:00 a.m.40 views

CVE-2020-1143

An elevation of privilege vulnerability exists in Windows when the Windows kernel-mode driver fails to properly handle objects in memory, aka ‘Win32k Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2020-1054. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...

7.8CVSS8.6AI score0.54158EPSS
SaveExploits5References2
ATTACKERKB
ATTACKERKB
added 2020/05/19 8:59 a.m.40 views

CVE-2020-8616: NXNSAttack: Recursive DNS Inefficiencies and Vulnerabilities

A malicious actor who intentionally exploits this lack of effective limitation on the number of fetches performed when processing referrals can, through the use of specially crafted referrals, cause a recursing server to issue a very large number of fetches in an attempt to process the referral...

8.6CVSS6.5AI score0.10593EPSS
SaveExploits1References21
ATTACKERKB
ATTACKERKB
added 2020/04/21 12:00 a.m.40 views

CVE-2020-4428

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533. Recent assessments: wvu-r7 at May 08, 2020 4:04pm UTC reported: Assessment for the related CVEs here:...

9.1CVSS9.1AI score0.61692EPSS
SaveExploits8References3
ATTACKERKB
ATTACKERKB
added 2020/03/17 12:00 a.m.40 views

CVE-2020-3950

VMware Fusion 11.x before 11.5.2, VMware Remote Console for Mac 11.x and prior before 11.0.1 and Horizon Client for Mac 5.x and prior before 5.4.0 contain a privilege escalation vulnerability due to improper use of setuid binaries. Successful exploitation of this issue may allow attackers with...

7.8CVSS8AI score0.07254EPSS
SaveExploits10References5
ATTACKERKB
ATTACKERKB
added 2020/03/02 12:00 a.m.40 views

CVE-2019-17026

Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw. This vulnerability affects Firefox ESR 68.4.1, Thunderbird 68.4.1, and Firefox 72.0.1. Recent assessments: gwillcox-r7 a...

8.8CVSS8.2AI score0.46311EPSS
SaveExploits7References11
ATTACKERKB
ATTACKERKB
added 2020/02/11 12:00 a.m.40 views

CVE-2020-0753

An elevation of privilege vulnerability exists in Windows Error Reporting WER when WER handles and executes files, aka ‘Windows Error Reporting Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2020-0754. Recent assessments: tekwizz123 at February 23, 2020 6:25pm UTC reported:...

7.8CVSS8.3AI score0.02313EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2020/02/03 12:00 a.m.40 views

CVE-2020-8597 rhostname buffer overflow in pppd

eap.c in pppd in ppp 2.4.2 through 2.4.8 has an rhostname buffer overflow in the eaprequest and eapresponse functions. Recent assessments: wvu-r7 at March 10, 2020 6:33pm UTC reported: AFAIK, it is common to enable full mitigations on the binary, with ASLR enabled on the system. While this doesn’...

9.8CVSS3.4AI score0.19925EPSS
SaveExploits3References15
ATTACKERKB
ATTACKERKB
added 2020/01/07 7:15 p.m.40 views

CVE-2020-5308

PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS, as demonstrated by the category and CategoryCode parameters in add-category.php, the CompanyName parameter in add-company.php, and the ProductName parameter in add-product.php...

9.8CVSS7AI score0.15652EPSS
SaveExploits3References6
ATTACKERKB
ATTACKERKB
added 2019/10/17 12:00 a.m.40 views

CVE-2019-14287

In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a “su...

9CVSS2.6AI score0.63764EPSS
SaveExploits12References37
ATTACKERKB
ATTACKERKB
added 2019/09/11 12:00 a.m.40 views

CVE-2019-1278

An elevation of privilege vulnerability exists in the way that the unistore.dll handles objects in memory, aka ‘Windows Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2019-1215, CVE-2019-1253, CVE-2019-1303. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker...

7.8CVSS8.3AI score0.19254EPSS
SaveExploits8References2
ATTACKERKB
ATTACKERKB
added 2019/09/03 12:00 a.m.40 views

CVE-2019-15043

In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. This makes it possible to run a denial of service attack against the server running Grafana. Recent assessments: h0ffayyy at September 26, 2020 6:21pm UTC reported: The Dashboard Snapshot API allows an...

7.5CVSS1.7AI score0.63388EPSS
SaveExploits1References15
ATTACKERKB
ATTACKERKB
added 2019/07/19 12:00 a.m.40 views

CVE-2019-1579

Remote Code Execution in PAN-OS 7.1.18 and earlier, PAN-OS 8.0.11-h1 and earlier, and PAN-OS 8.1.2 and earlier with GlobalProtect Portal or GlobalProtect Gateway Interface enabled may allow an unauthenticated remote attacker to execute arbitrary code. Recent assessments: busterb at July 24, 2019...

8.1CVSS3.5AI score0.46239EPSS
SaveExploits2References6
ATTACKERKB
ATTACKERKB
added 2019/06/18 12:00 a.m.40 views

VLC zlib_decompress_extra Double Free Vulnerability

VLC media player is a free and open-source portable cross-platform media player software developed by the VideoLAN project. VLC is available for desktop operating systems and mobile platforms, such as Android, iOS, iPadOS, Wizen, Windows 10 Mobile, and Windows Phone. It is also available on digit...

9.8CVSS0.3AI score0.02392EPSS
SaveExploits0References9
ATTACKERKB
ATTACKERKB
added 2018/03/28 12:00 a.m.40 views

CVE-2018-0158

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service DoS condition. The vulnerability is due to...

8.6CVSS4.3AI score0.0719EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2017/10/22 12:00 a.m.40 views

CVE-2017-11292

Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution. Recent...

8.8CVSS5AI score0.11885EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2017/08/09 12:00 a.m.40 views

CVE-2015-2291

1 IQVW32.sys before 1.3.1.0 and 2 IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted a 0x80862013, b 0x8086200B, © 0x8086200F, or d 0x80862007 IOCTL...

7.8CVSS7.8AI score0.09011EPSS
SaveExploits7References7
ATTACKERKB
ATTACKERKB
added 2016/08/09 12:00 a.m.40 views

CVE-2016-3310

The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allow local users to gain privileges via a crafted application, aka “Win32k Elevation of...

7.8CVSS7.6AI score0.20625EPSS
SaveExploits8References5
ATTACKERKB
ATTACKERKB
added 2015/10/22 12:00 a.m.40 views

CVE-2015-4902

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment. Recent assessments: gwillcox-r7 at November 23, 2020 6:18pm UTC reported: Reported as exploited in the wild as part of Google’s 2020 0day...

5.3CVSS3.4AI score0.13354EPSS
SaveExploits0References23
Total number of security vulnerabilities5000