Lucene search
+L
AttackerkbMost viewed

87421 matches found

ATTACKERKB
ATTACKERKB
•added 2026/03/12 12:2 p.m.•14 views

CVE-2026-4039

A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1...

6.5CVSS5.7AI score0.00316EPSS
SaveExploits0References8
ATTACKERKB
ATTACKERKB
•added 2026/03/11 7:27 p.m.•14 views

CVE-2026-31958

Tornado is a Python web framework and asynchronous networking library. In versions of Tornado prior to 6.5.5, the only limit on the number of parts in multipart/form-data is the maxbodysize setting default 100MB. Since parsing occurs synchronously on the main thread, this creates the possibility ...

8.7CVSS5.8AI score0.00375EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/03/10 9:4 p.m.•14 views

CVE-2026-31812

Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed...

8.7CVSS5.8AI score0.005EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/03/04 9:49 p.m.•14 views

CVE-2026-29000

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT wi...

10CVSS6AI score0.05856EPSS
SaveExploits17References4Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/03/04 12:15 p.m.•14 views

CVE-2026-21425

Dell PowerScale OneFS, versions prior to 9.10.1.6 and versions 9.11.0.0 through 9.12.0.1, contains an incorrect privilege assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

6.7CVSS5.9AI score0.00084EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/03/04 12:0 a.m.•14 views

CVE-2026-26478

A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datagram and execute arbitrary shell code as the root account...

9.8CVSS6.2AI score0.02003EPSS
SaveExploits2References3
ATTACKERKB
ATTACKERKB
•added 2026/02/26 10:59 p.m.•14 views

CVE-2026-28279

osctrl is an osquery management solution. Prior to version 0.5.0, an OS command injection vulnerability exists in the osctrl-admin environment configuration. An authenticated administrator can inject arbitrary shell commands via the hostname parameter when creating or editing environments. These...

8.4CVSS8AI score0.009EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/02/26 2:3 a.m.•14 views

CVE-2026-27970

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Versions prior to 21.2.0, 21.1.16, 20.3.17, and 19.2.19 have a cross-Site scripting vulnerability in the Angular internationalization i18n pipeline. In ICU messages...

7.6CVSS6AI score0.00466EPSS
SaveExploits0References6Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/02/24 8:30 p.m.•14 views

CVE-2025-46320

A cross-site scripting XSS vulnerability in a FileMaker WebDirect custom homepage could lead to unauthorized access and remote code execution. This vulnerability has been fully addressed in FileMaker Server 22.0.4 and FileMaker Server 21.1.7...

6.1CVSS5.9AI score0.00219EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
•added 2026/02/24 6:40 p.m.•14 views

CVE-2026-26340

Tattile Smart+, Vega, and Basic device families firmware versions 1.181.5 and prior expose RTSP streams without requiring authentication. A remote attacker can connect to the RTSP service and access live video/audio streams without valid credentials, resulting in unauthorized disclosure of...

8.7CVSS5.9AI score0.00807EPSS
SaveExploits3References4
ATTACKERKB
ATTACKERKB
•added 2026/02/24 1:33 p.m.•14 views

CVE-2026-2767

Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox 148, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

9.8CVSS5.9AI score0.00384EPSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
•added 2026/02/24 1:32 p.m.•14 views

CVE-2026-2759

Incorrect boundary conditions in the Graphics: ImageLib component. This vulnerability affects Firefox 148, Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird 148, and Thunderbird 140.8...

9.8CVSS5.9AI score0.00395EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
•added 2026/02/22 7:32 a.m.•14 views

CVE-2026-2933

A weakness has been identified in YiFang CMS up to 2.0.5. This affects the function update of the file app/db/admin/DadManage.php of the component Extended Management Module. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. T...

4.8CVSS3.1AI score0.00198EPSS
SaveExploits1References4Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/02/21 6:50 a.m.•14 views

CVE-2026-27452

ASN.1 TypeScript ESM library, including codecs for Basic Encoding Rules BER and Distinguished Encoding Rules DER. In versions 11.0.5 and below, in some cases, decoding an INTEGER could leak the underlying ArrayBuffer. This issue is expected to be fixed in version 11.0.6...

9.2CVSS5.4AI score0.0026EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/02/20 10:23 p.m.•14 views

CVE-2026-2045

GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open ...

7.8CVSS6.4AI score0.04642EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/02/19 12:2 p.m.•14 views

CVE-2019-25418

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the FWADDRESSES parameter. Attackers can send POST requests to the /korugan/fwgroups endpoint with script payloads to execute arbitra...

6.1CVSS5.6AI score0.00344EPSS
SaveExploits1References4Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/02/19 9:26 a.m.•14 views

CVE-2026-1219

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'loadtracknoteajax' due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers...

5.3CVSS5.5AI score0.00245EPSS
SaveExploits0References5Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/02/18 3:33 p.m.•14 views

CVE-2013-0099

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2013. Notes: none...

5.5AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
•added 2026/02/15 3:29 p.m.•14 views

CVE-2026-26368

eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user UGUSER to reset the password of arbitrary accounts, including those in the UGADMIN and UGSUPERADMIN groups, without...

8.8CVSS5.8AI score0.00529EPSS
SaveExploits2References3
ATTACKERKB
ATTACKERKB
•added 2026/02/11 6:8 p.m.•14 views

CVE-2026-2319

Race in DevTools in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures and install a malicious extension to potentially exploit object corruption via a malicious file. Chromium security severity: Medium...

7.5CVSS5.6AI score0.00204EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/02/06 11:14 p.m.•14 views

CVE-2020-37155

Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated 'A' characters to trigger an application crash without requiring additional...

7.5CVSS5.7AI score0.00388EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
•added 2026/02/06 8:30 p.m.•14 views

CVE-2026-25729

DeepAudit is a multi-agent system for code vulnerability discovery. In 3.0.4 and earlier, there is an improper access control vulnerability in the /api/v1/users/ endpoint allows any authenticated user to enumerate all users in the system and retrieve sensitive information including email addresse...

5.3CVSS5.5AI score0.00209EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/02/03 10:1 p.m.•14 views

CVE-2020-37074

Remote Desktop Audit 2.3.0.157 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code during the Add Computers Wizard file import process. Attackers can craft a malicious payload file to trigger a structured exception handler SEH bypass and execute shellcode when...

9.8CVSS6.3AI score0.00337EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/01/20 4:14 a.m.•14 views

CVE-2026-0906

Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page. Chromium security severity: Low...

9.8CVSS5.5AI score0.00315EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/01/19 3:52 p.m.•14 views

CVE-2025-11043

An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges...

9.1CVSS5.5AI score0.00206EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
•added 2026/01/06 1:46 a.m.•14 views

CVE-2025-20780

In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184061; Issue ID: MSV-4712...

7.8CVSS5.9AI score0.00082EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
•added 2025/12/11 12:30 p.m.•14 views

CVE-2025-14523

A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy routes a request to one backend but the...

8.2CVSS5.5AI score0.00516EPSS
SaveExploits0References22
ATTACKERKB
ATTACKERKB
•added 2025/09/19 6:46 p.m.•14 views

CVE-2025-34194

Vasion Print formerly PrinterLogic Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 Windows client deployments contain an insecure temporary-file handling vulnerability in the PrinterInstallerClient components. The software creates files as NT...

8.5CVSS5.9AI score0.00286EPSS
SaveExploits1References5
ATTACKERKB
ATTACKERKB
•added 2025/08/19 8:52 p.m.•14 views

CVE-2025-8041

In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141...

5.3CVSS5.8AI score0.00274EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
•added 2025/07/16 11:28 a.m.•14 views

CVE-2025-30936

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Torod Company for Information Technology Torod torod allows SQL Injection.This issue affects Torod: from n/a through = 2.1...

9.3CVSS5.9AI score0.00371EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
•added 2025/07/13 10:2 p.m.•14 views

CVE-2025-7546

A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfdelfsetgroupcontents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has bee...

7.8CVSS5.2AI score0.00176EPSS
SaveExploits0References8Affected Software1
ATTACKERKB
ATTACKERKB
•added 2025/06/16 12:0 a.m.•14 views

CVE-2025-43200

This issue was addressed with improved checks. This issue is fixed in watchOS 11.3.1, macOS Ventura 13.7.4, iOS 15.8.4 and iPadOS 15.8.4, iOS 16.7.11 and iPadOS 16.7.11, iPadOS 17.7.5, visionOS 2.3.1, macOS Sequoia 15.3.1, iOS 18.3.1 and iPadOS 18.3.1, macOS Sonoma 14.7.4. A logic issue existed...

4.2CVSS6.1AI score0.01059EPSS
SaveExploits0References10
ATTACKERKB
ATTACKERKB
•added 2025/05/23 4:15 p.m.•14 views

CVE-2025-24917

In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run arbitrary code with SYSTEM privileges, potentially leading to local privilege escalation...

7.8CVSS7.6AI score0.00152EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
•added 2025/05/07 6:15 p.m.•14 views

CVE-2025-20186

A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authenticated, remote attacker with a lobby ambassador user account to perform a command injection attack against an affected device. This vulnerability is due to...

8.8CVSS7AI score0.00824EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
•added 2025/05/02 4:15 p.m.•14 views

CVE-2023-53103

In the Linux kernel, the following vulnerability has been resolved: bonding: restore bond's IFFSLAVE flag if a non-eth dev enslave fails syzbot reported a warning1 where the bond device itself is a slave and we try to enslave a non-ethernet device as the first slave which fails but then in the...

5.5CVSS6.1AI score0.00189EPSS
SaveExploits0References5Affected Software1
ATTACKERKB
ATTACKERKB
•added 2025/04/15 9:15 p.m.•14 views

CVE-2025-30690

Vulnerability in the Oracle Solaris product of Oracle Systems component: Filesystem. The supported version that is affected is 11. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris...

7.2CVSS7.1AI score0.002EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
•added 2025/03/12 12:0 a.m.•14 views

CVE-2025-21590

An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromise the integrity of the device. A local attacker with access to the shell is able to inject arbitrary code which can compromise an affecte...

6.7CVSS7.2AI score0.01657EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
•added 2025/03/10 9:15 p.m.•14 views

CVE-2025-2136

Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: Medium...

8.8CVSS7.2AI score0.00322EPSS
SaveExploits0References3Affected Software1
ATTACKERKB
ATTACKERKB
•added 2024/12/09 1:15 p.m.•14 views

CVE-2023-30873

Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through = 1.9.8...

8.8CVSS5.8AI score0.00491EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
•added 2024/11/04 2:15 p.m.•14 views

CVE-2024-50526

Unrestricted Upload of File with Dangerous Type vulnerability in mahlamusa Multi Purpose Mail Form allows Upload a Web Shell to a Web Server.This issue affects Multi Purpose Mail Form: from n/a through 1.0.2...

10CVSS5.4AI score0.00606EPSS
SaveExploits2References2
ATTACKERKB
ATTACKERKB
•added 2024/06/27 10:15 a.m.•14 views

CVE-2024-0947

Reliance on Cookies without Validation and Integrity Checking vulnerability in Talya Informatics Elektraweb allows Session Credential Falsification through Manipulation, Accessing/Intercepting/Modifying HTTP Cookies, Manipulating Opaque Client-based Data Tokens. This issue affects Elektraweb:...

9.8CVSS5.8AI score0.00481EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
•added 2024/06/25 12:0 a.m.•14 views

CVE-2024-4885

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges. Recent assessments: Assessed Attacker Value: 0...

9.8CVSS8.4AI score0.99288EPSS
SaveExploits1References3
ATTACKERKB
ATTACKERKB
•added 2024/05/03 3:16 a.m.•14 views

CVE-2023-51588

Voltronic Power ViewPower Pro MySQL Use of Hard-coded Credentials Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Voltronic Power ViewPower Pro. An attacker must first obtain the ability to execute...

7.8CVSS6.1AI score0.00234EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
•added 2024/05/03 3:15 a.m.•14 views

CVE-2023-42101

Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulnerability in that the target must...

7.8CVSS6.2AI score0.00486EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
•added 2024/05/03 3:15 a.m.•14 views

CVE-2023-40505

LG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability. The specific flaw exists...

9.8CVSS7.9AI score0.0196EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
•added 2024/05/03 2:15 a.m.•14 views

CVE-2023-34268

Fatek Automation FvDesigner FPJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fatek Automation FvDesigner. User interaction is required to exploit this vulnerability in that t...

7.8CVSS6.2AI score0.00394EPSS
SaveExploits0References2Affected Software1
ATTACKERKB
ATTACKERKB
•added 2024/02/28 9:15 a.m.•14 views

CVE-2021-47001

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix cwnd update ordering After a reconnect, the reply handler is opening the cwnd and thus enabling more RPC Calls to be sent /before/ rpcrdmapostrecvs can post enough Receive WRs to receive their replies. This causes a...

4.7CVSS6.4AI score0.00285EPSS
SaveExploits0References5Affected Software1
ATTACKERKB
ATTACKERKB
•added 2024/02/27 7:4 p.m.•14 views

CVE-2021-46940

In the Linux kernel, the following vulnerability has been resolved: tools/power turbostat: Fix offset overflow issue in index converting The idxtooffset function returns type int 32-bit signed, but MSRPKGENERGYSTAT is u32 and would be interpreted as a negative number. The end result is that it hi...

5.5CVSS5.7AI score0.00222EPSS
SaveExploits0References5Affected Software1
ATTACKERKB
ATTACKERKB
•added 2024/02/27 7:15 a.m.•14 views

CVE-2021-46908

In the Linux kernel, the following vulnerability has been resolved: bpf: Use correct permission flag for mixed signed bounds arithmetic We forbid adding unknown scalars with mixed signed bounds due to the spectre v1 masking mitigation. Hence this also needs bypassspecv1 flag instead of...

5.5CVSS6.3AI score0.00232EPSS
SaveExploits0References4Affected Software1
ATTACKERKB
ATTACKERKB
•added 2024/02/13 5:15 a.m.•14 views

CVE-2022-48623

The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a denial of service...

9.1CVSS5.1AI score0.00788EPSS
SaveExploits0References5
Total number of security vulnerabilities5000