Lucene search
+L
AttackerkbMost viewed

87511 matches found

ATTACKERKB
ATTACKERKB
added 2026/03/23 7:54 p.m.14 views

CVE-2026-2298

Improper Neutralization of Argument Delimiters in a Command 'Argument Injection' vulnerability in Salesforce Marketing Cloud Engagement allows Web Services Protocol Manipulation. This issue affects Marketing Cloud Engagement: before January 30th, 2026...

5.8AI score0.00413EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/20 8:8 a.m.14 views

CVE-2026-23274

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtIDLETIMER: reject rev0 reuse of ALARM timer labels IDLETIMER revision 0 rules reuse existing timers by label and always call modtimer on timer-timer. If the label was created first by revision 1 with XTIDLETIMERALARM...

7.8CVSS5.6AI score0.00167EPSS
SaveExploits0References9Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/20 8:0 a.m.14 views

CVE-2026-33064

Free5GC is an open-source Linux Foundation project for 5th generation 5G mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending ...

8.7CVSS5.8AI score0.00486EPSS
SaveExploits1References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/20 7:48 a.m.14 views

CVE-2026-33022

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Versions 0.60.0 through 1.0.0, 1.1.0 through 1.3.2, 1.4.0 through 1.6.0, 1.7.0 through 1.9.0, 1.10.0, and 1.10.1 have a denial-of-service vulnerability in that allows any user who can create a TaskRun or...

6.5CVSS5.8AI score0.00368EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/20 1:34 a.m.14 views

CVE-2026-4453

Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

5.9AI score0.00176EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/19 10:33 p.m.14 views

CVE-2026-33395

Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, the discourse-graphviz plugin contains a stored cross-site scripting XSS vulnerability that allows authenticated users to inject malicious JavaScript code through DOT graph definitions. F...

4.4CVSS5.7AI score0.00231EPSS
SaveExploits0References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/19 3:53 p.m.14 views

CVE-2026-3029

A path traversal and arbitrary file write vulnerability exist in the embedded get function in 'main.py' in PyMuPDF version, 1.26.5...

5.9AI score0.00354EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/19 8:37 a.m.14 views

CVE-2026-25445

Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X allows Object Injection.This issue affects WishList Member X: from n/a through 3.29.0...

8.8CVSS5.8AI score0.00301EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/18 7:47 p.m.14 views

CVE-2026-31969

HTSlib is a library for reading and writing bioinformatics file formats. CRAM is a compressed format which stores DNA sequence alignment data using a variety of encodings and compression methods. When reading data encoded using the BYTEARRAYSTOP method, an out-by-one error in the...

7.1CVSS6.3AI score0.00336EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/18 10:5 a.m.14 views

CVE-2026-23243

In the Linux kernel, the following vulnerability has been resolved: RDMA/umad: Reject negative datalen in ibumadwrite ibumadwrite computes datalen from user-controlled count and the MAD header sizes. With a mismatched user MAD header size and RMPP header length, datalen can become negative and...

5.7AI score0.00131EPSS
SaveExploits0References9Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/16 6:13 a.m.14 views

CVE-2025-71264

Mumble before 1.6.870 is prone to an out-of-bounds array access, which may result in denial of service client crash...

3.7CVSS5.8AI score0.00282EPSS
SaveExploits0References4
ATTACKERKB
ATTACKERKB
added 2026/03/13 8:58 p.m.14 views

CVE-2026-32635

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-next.3, 21.2.4, 20.3.18, and 19.2.20, a Cross-Site Scripting XSS vulnerability has been identified in the Angular runtime and compiler. It occurs whe...

8.6CVSS5.7AI score0.00339EPSS
SaveExploits0References4Affected Software2
ATTACKERKB
ATTACKERKB
added 2026/03/13 11:41 a.m.14 views

CVE-2026-32347

Missing Authorization vulnerability in raratheme Restaurant and Cafe restaurant-and-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restaurant and Cafe: from n/a through = 1.2.5...

5.8AI score0.00214EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/03/12 12:2 p.m.14 views

CVE-2026-4039

A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1...

6.5CVSS5.7AI score0.00316EPSS
SaveExploits0References8
ATTACKERKB
ATTACKERKB
added 2026/03/11 7:27 p.m.14 views

CVE-2026-31958

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility ...

8.7CVSS5.8AI score0.00375EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/10 9:4 p.m.14 views

CVE-2026-31812

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed...

8.7CVSS5.8AI score0.005EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/04 9:49 p.m.14 views

CVE-2026-29000

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT wi...

10CVSS6AI score0.05856EPSS
SaveExploits17References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/04 12:15 p.m.14 views

CVE-2026-21425

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

6.7CVSS5.9AI score0.00084EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/03/04 12:0 a.m.14 views

CVE-2026-26478

A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datagram and execute arbitrary shell code as the root account...

9.8CVSS6.2AI score0.02003EPSS
SaveExploits2References3
ATTACKERKB
ATTACKERKB
added 2026/02/26 10:59 p.m.14 views

CVE-2026-28279

osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the osctrl-admin environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing environments. These...

8.4CVSS8AI score0.009EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/26 2:3 a.m.14 views

CVE-2026-27970

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...

7.6CVSS6AI score0.00466EPSS
SaveExploits0References6Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/24 8:30 p.m.14 views

CVE-2025-46320

A cross-site scripting XSS vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7...

6.1CVSS5.9AI score0.00219EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/02/24 6:40 p.m.14 views

CVE-2026-26340

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of...

8.7CVSS5.9AI score0.00807EPSS
SaveExploits3References4
ATTACKERKB
ATTACKERKB
added 2026/02/24 1:33 p.m.14 views

CVE-2026-2767

Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

9.8CVSS5.9AI score0.00384EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 2026/02/24 1:32 p.m.14 views

CVE-2026-2759

Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

9.8CVSS5.9AI score0.00395EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 2026/02/22 7:32 a.m.14 views

CVE-2026-2933

A weakness has been identified in YiFang CMS up to 2.0.5. This affects the function update of the file app/db/admin/DadManage.php of the component Extended Management Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. T...

4.8CVSS3.1AI score0.00198EPSS
SaveExploits1References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/21 6:50 a.m.14 views

CVE-2026-27452

ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules BER and Distinguished Encoding Rules DER. In versions 11.0.5 and below, in some cases, decoding an INTEGER could leak the underlying ArrayBuffer. This issue is expected to be fixed in version 11.0.6...

9.2CVSS5.4AI score0.0026EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/20 10:23 p.m.14 views

CVE-2026-2045

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open ...

7.8CVSS6.4AI score0.04642EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/19 12:2 p.m.14 views

CVE-2019-25418

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the FWADDRESSES parameter. Attackers can send POST requests to the /korugan/fwgroups endpoint with script payloads to execute arbitra...

6.1CVSS5.6AI score0.00344EPSS
SaveExploits1References4Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/19 9:26 a.m.14 views

CVE-2026-1219

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'loadtracknoteajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers...

5.3CVSS5.5AI score0.00245EPSS
SaveExploits0References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/18 3:33 p.m.14 views

CVE-2013-0099

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none...

5.5AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2026/02/15 3:29 p.m.14 views

CVE-2026-26368

eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user UGUSER to reset the password of arbitrary accounts, including those in the UGADMIN and UGSUPERADMIN groups, without...

8.8CVSS5.8AI score0.00529EPSS
SaveExploits2References3
ATTACKERKB
ATTACKERKB
added 2026/02/11 6:8 p.m.14 views

CVE-2026-2319

Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicious extension to potentially exploit object corruption via a malicious file. Chromium security severity: Medium...

7.5CVSS5.6AI score0.00204EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/06 8:30 p.m.14 views

CVE-2026-25729

DeepAudit is a multi-agent system for code vulnerability discovery. In 3.0.4 and earlier, there is an improper access control vulnerability in the /api/v1/users/ endpoint allows any authenticated user to enumerate all users in the system and retrieve sensitive information including email addresse...

5.3CVSS5.5AI score0.00209EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/02/03 10:1 p.m.14 views

CVE-2020-37074

Remote Desktop Audit 2.3.0.157 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code during the Add Computers Wizard file import process. Attackers can craft a malicious payload file to trigger a structured exception handler SEH bypass and execute shellcode when...

9.8CVSS6.3AI score0.00337EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/01/20 4:14 a.m.14 views

CVE-2026-0906

Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Low...

9.8CVSS5.5AI score0.00315EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/01/19 3:52 p.m.14 views

CVE-2025-11043

An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges...

9.1CVSS5.5AI score0.00206EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2026/01/06 1:46 a.m.14 views

CVE-2025-20780

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184061; Issue ID: MSV-4712...

7.8CVSS5.9AI score0.00082EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2025/12/11 12:30 p.m.14 views

CVE-2025-14523

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the...

8.2CVSS5.5AI score0.00516EPSS
SaveExploits0References22
ATTACKERKB
ATTACKERKB
added 2025/09/19 6:46 p.m.14 views

CVE-2025-34194

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 Windows client deployments contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components. The software creates files as NT...

8.5CVSS5.9AI score0.00286EPSS
SaveExploits1References5
ATTACKERKB
ATTACKERKB
added 2025/08/19 8:52 p.m.14 views

CVE-2025-8041

In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141...

5.3CVSS5.8AI score0.00274EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2025/07/16 11:28 a.m.14 views

CVE-2025-30936

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Torod Company for Information Technology Torod torod allows SQL Injection.This issue affects Torod: from n/a through = 2.1...

9.3CVSS5.9AI score0.00371EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2025/07/13 10:2 p.m.14 views

CVE-2025-7546

A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfdelfsetgroupcontents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has bee...

7.8CVSS5.2AI score0.00176EPSS
SaveExploits0References8Affected Software1
ATTACKERKB
ATTACKERKB
added 2025/06/16 12:0 a.m.14 views

CVE-2025-43200

This issue was addressed with improved checks. This issue is fixed in watchOS 11.3.1, macOS Ventura 13.7.4, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iPadOS 17.7.5, visionOS 2.3.1, macOS Sequoia 15.3.1, iOS 18.3.1 and iPadOS 18.3.1, macOS Sonoma 14.7.4. A logic issue existed...

4.2CVSS6.1AI score0.01059EPSS
SaveExploits0References10
ATTACKERKB
ATTACKERKB
added 2025/05/23 4:15 p.m.14 views

CVE-2025-24917

In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM privileges, potentially leading to local privilege escalation...

7.8CVSS7.6AI score0.00152EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2025/05/07 6:15 p.m.14 views

CVE-2025-20186

A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device. This vulnerability is due to...

8.8CVSS7AI score0.00824EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2025/05/02 4:15 p.m.14 views

CVE-2023-53103

In the Linux kernel, the following vulnerability has been resolved: bonding: restore bond's IFFSLAVE flag if a non-eth dev enslave fails syzbot reported a warning1 where the bond device itself is a slave and we try to enslave a non-ethernet device as the first slave which fails but then in the...

5.5CVSS6.1AI score0.00189EPSS
SaveExploits0References5Affected Software1
ATTACKERKB
ATTACKERKB
added 2025/04/15 9:15 p.m.14 views

CVE-2025-30690

Vulnerability in the Oracle Solaris product of Oracle Systems component: Filesystem. The supported version that is affected is 11. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris...

7.2CVSS7.1AI score0.002EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
added 2025/04/08 6:16 p.m.14 views

CVE-2025-29816

Improper input validation in Microsoft Office Word allows an unauthorized attacker to bypass a security feature over a network...

7.5CVSS5.5AI score0.00443EPSS
SaveExploits0References2Affected Software8
ATTACKERKB
ATTACKERKB
added 2025/03/12 12:0 a.m.14 views

CVE-2025-21590

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affecte...

6.7CVSS7.2AI score0.01657EPSS
SaveExploits0References3
Total number of security vulnerabilities5000