Lucene search
+L

395489 matches found

CVE
CVE
added 2026/09/01 3:30 p.m.20 views

CVE-2026-49329

A flaw in openshift/oauth-server allows an unauthenticated attacker to trigger a quadratic-time denial of service by sending a crafted Accept-Language header using '_' separators to the OAuth login and error page endpoints. The root cause is a bypass of the CVE-2022-32149 mitigation : the upstrea...

7.5CVSS5.8AI score0.00431EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/01 3:30 p.m.44 views

CVE-2026-10195

FS-Poster WordPress plugin (versions up to and including 8.0.1 ) is vulnerable to authenticated remote code execution via insufficient sanitization of the FFmpeg path parameter before it is passed to the exec() function, combined with missing authorization checks on REST API endpoints. Attackers ...

8.8CVSS6.1AI score0.0057EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/01 3:30 p.m.13 views

CVE-2026-79682

Dell PowerStore is affected by a Command Injection vulnerability that allows an authenticated user with limited privileges to execute arbitrary commands with root privileges . The CVSS 3.1 score is 8.8 (HIGH) with a local attack vector, low complexity, and changed scope, resulting in high impact ...

8.8CVSS6.1AI score0.00525EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/01 3:19 p.m.19 views

CVE-2026-84270

The affected software is gvfs (GNOME Virtual Filesystem), specifically its MTP backend . The flaw resides in do_read() within gvfsbackendmtp.c , which trusts the data length returned by a connected MTP device without capping it to the size originally requested by the client. When a malicious devi...

4.3CVSS5.8AI score0.0015EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/01 3:19 p.m.17 views

CVE-2026-84269

A heap-based buffer overflow was identified in the AFP backend of gvfs . When mounting a share, a malicious AFP server can supply a length in the DSI read path that exceeds the size the client requested. Because the function does not validate the server-provided length against the pre-sized reply...

6.5CVSS6AI score0.00249EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/01 3:19 p.m.17 views

CVE-2026-84267

CVE-2026-84267 is an uninitialized heap memory disclosure in the SFTP backend of gvfs (GNOME Virtual File System). The root cause is in the read_string() function, which allocates a buffer without verifying it is fully populated. A malicious SFTP server can send a short FXP_HANDLE reply, causing ...

4.3CVSS6AI score0.00212EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/01 3:19 p.m.15 views

CVE-2026-84207

Heym before 0.0.98 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its WebSocket Send and WebSocket Trigger workflow nodes. The root cause is the failure to apply SSRF egress guards to these nodes, allowing authenticated users to craft workflow nodes with arbitrary URLs and h...

5.4CVSS5.9AI score0.002EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/01 3:19 p.m.16 views

CVE-2026-84206

Snipe-IT before 8.7.0 contains an authorization bypass in the bulk asset restore endpoint , which is gated on the assets.edit permission instead of the intended assets.delete permission. This allows authenticated users with only edit rights to restore soft-deleted assets by posting asset identifi...

5.3CVSS5.9AI score0.00222EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/01 3:18 p.m.15 views

CVE-2026-84232

CVE-2026-84232 is a stored cross-site scripting (XSS) vulnerability in pulpcore's content serving application (python-pulpcore). The root cause is that files uploaded to Pulp file-type repositories are served with their original MIME type (e.g., text/html, image/svg+xml) and without a Content-Dis...

5.4CVSS5.8AI score0.00176EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/01 3:18 p.m.16 views

CVE-2026-84205

GROWI through 8.0.2 contains an authorization bypass in the GET /_api/v3/revisions/:id endpoint. The vulnerability arises because the endpoint validates access using a query parameter but returns the revision identified by the path parameter without confirming both reference the same page. An aut...

7.1CVSS5.9AI score0.00238EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/01 3:18 p.m.27 views

CVE-2026-84203

Memos versions 0.26.0 through 0.30.0 contain an insufficient session expiration flaw: refresh tokens are not revoked when a user changes their password. An attacker holding a stolen refresh token can call the RefreshToken RPC to mint new access tokens and rotate the refresh token indefinitely, ef...

8.6CVSS5.9AI score0.00255EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/01 3:18 p.m.12 views

CVE-2026-84204

GROWI through 8.0.2 contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they are not authorized to view by supplying known attachment identifiers. T...

7.1CVSS5.9AI score0.00238EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/01 3:18 p.m.26 views

CVE-2026-84202

ModelScope (through v1.40.0 ) uses PyYAML's unsafe yaml.Loader to parse model configuration files, enabling arbitrary code execution via Python object construction tags. An attacker can craft a malicious model repository with a poisoned configuration file that executes code when a user loads the ...

8.8CVSS6.3AI score0.00371EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/01 3:18 p.m.23 views

CVE-2026-84201

appium-mcp-server through 0.1.61 is affected by a path traversal vulnerability in the write_file and write_files_batch tools. The server fails to validate or normalize file paths, allowing an attacker to supply absolute paths or relative paths with parent-directory segments to write files outside...

7.1CVSS5.9AI score0.00144EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/01 3:15 p.m.22 views

CVE-2026-84268

CVE-2026-84268 is a heap-based buffer overflow in the gvfs SFTP backend (gvfsd-sftp process). When mounting a share and reading a file, the read_reply() function fails to validate the server-provided length against the allocated buffer size, allowing a malicious SFTP server to write past intended...

8.8CVSS6.1AI score0.00328EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/01 3:15 p.m.16 views

CVE-2026-84153

Xinhu Rainrock RockOA versions up to 2.3.2 contain a SQL injection vulnerability in the toaddval function of /index.php?m=index&a=publicsavevalue&ajaxbool=true. Manipulating the Value parameter allows a remote attacker with low privileges to affect confidentiality, integrity, and availability (CV...

6.5CVSS6.4AI score0.00192EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/01 3:12 p.m.18 views

CVE-2026-18931

This CVSS 9.1 (Critical) vulnerability affects TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software , versions V.4 through before V.16 . The root cause is hard-coded credentials embedded in the software, which allow an unauthenticated network attacker to retrieve embed...

9.1CVSS5.9AI score0.00232EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/01 3:08 p.m.15 views

CVE-2026-18630

CVE-2026-18630 is a SQL injection vulnerability in TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software , affecting versions from V.4 up to but not including V.16 . The root cause is improper neutralization of special elements used in an SQL command. The CVSS 3.1 score...

8.8CVSS5.9AI score0.00295EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/01 3:05 p.m.9 views

CVE-2026-18780

TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software contains a Cross-Site Request Forgery (CSRF) vulnerability affecting versions V.4 through before V.16 . The vulnerability allows an attacker to forge requests on behalf of an authenticated user, resulting in a High i...

7.1CVSS5.9AI score0.00117EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/01 3:01 p.m.37 views

CVE-2026-78012

A stack-based buffer overflow in Pyramid Solutions NetStaX EtherNet/IP Stack prior to v5.6.1 allows a large Class 3 explicit-message request to exceed the application-side receive buffer without generating an error or warning to the originating device. The result can be memory corruption , a devi...

9.8CVSS6.1AI score0.00475EPSS
SaveExploits0References3
CVE
CVE
added 2026/09/01 3:00 p.m.56 views

CVE-2026-84115

Cleo Harmony versions up to 5.8.1.10 are affected by an improper privilege management vulnerability in the JWT Refresh Token Handler component within the /api/connections file. Manipulation of the Bearer argument allows a remote, unauthenticated attacker to gain excessive privileges, with the sco...

8.3CVSS6.7AI score0.00284EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/01 2:59 p.m.10 views

CVE-2026-18771

TMT Machine Industry and Trade Ltd. Co. Talassoft Industrial Management Software is affected by a missing authentication for critical function vulnerability, enabling Authentication Bypass in versions V4 through before V.16 . The CNA (USOM, Turkey) assigned a CVSS 3.1 score of 7.5 (HIGH) with a v...

7.5CVSS5.9AI score0.004EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/01 2:59 p.m.13 views

CVE-2026-69664

Erlang/OTP inets httpd contains a Missing Release of Resource after Effective Lifetime flaw that allows an unauthenticated remote attacker to cause denial of service. The root cause is in how httpd_request_handler:handle_info/2 handles a malformed chunk-size line arriving in a separate write from...

8.7CVSS5.9AI score0.00686EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/01 2:57 p.m.45 views

CVE-2026-83557

jackson-databind ships a default PolymorphicTypeValidator (DefaultBaseTypeLimitingValidator) used automatically when @JsonTypeInfo is present without a custom validator. The flaw: java.lang.Comparable was omitted from its "unsafe base types" deny-list, so isSafeSubType returned true unconditional...

5.6CVSS6.2AI score0.00586EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/01 2:53 p.m.32 views

CVE-2026-84233

rpm is vulnerable to command execution via macro expansion in rpmuncompress -x. A local attacker can supply a specially crafted .gem filename containing RPM macro syntax ; when a user or automated workflow invokes rpmuncompress -x on that file, the macro expansion occurs during command constructi...

7CVSS6AI score0.0013EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/01 2:51 p.m.27 views

CVE-2026-83619

xmldom (a pure JavaScript W3C-compliant DOMParser and XMLSerializer module) is vulnerable to a ReDoS (Regular Expression Denial of Service) in versions 0.7.0 through 0.8.15 . The root cause is an unanchored global regex /[ \t\n\r]+$/g in lib/sax.js that trims end-tag names; when an end tag contai...

8.7CVSS5.9AI score0.00301EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/01 2:51 p.m.24 views

CVE-2026-70409

Erlang/OTP eldap suffers from an Improper Validation of Specified Quantity in Input flaw in eldap:parse_port/2. The function passes the port substring from a referral URL directly to list_to_integer/1 with no length bound. A malicious or compromised LDAP server can return a referral whose port is...

6.3CVSS5.8AI score0.00423EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/01 2:50 p.m.13 views

CVE-2026-70405

CVE-2026-70405 is an improper input validation vulnerability in the Erlang/OTP snmp module. The function snmp_pdus:dec_integer_notag/1 defaults its size limit to infinity, causing do_dec_integer_notag/2 to accumulate a BER INTEGER value via recursive shift-and-or operations whose cost grows super...

6.3CVSS5.9AI score0.00421EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/01 2:49 p.m.20 views

CVE-2026-66835

A Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra (doubled) slash. The root cause is that uri_string:normalize/1 performs RFC 3986 dot-segment removal ...

8.2CVSS5.9AI score0.00635EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/01 2:49 p.m.13 views

CVE-2026-83618

xmldom is a pure JavaScript W3C DOMParser/XMLSerializer module. In versions 0.9.10 through 0.9.12 , the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId using regexes (PubidLiteral_match, SystemLiteral_match) that inherit the multiline flag . A valid li...

8.7CVSS5.9AI score0.00328EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/01 2:48 p.m.26 views

CVE-2026-73270

Erlang/OTP inets httpd contains an improper handling of case sensitivity flaw in mod_auth:secret_path/3 , which matches a request path against a configured protected directory using re:run/3 without the caseless option . On case-insensitive filesystems , a request for /secret/file against a direc...

8.2CVSS5.9AI score0.00661EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/01 2:48 p.m.24 views

CVE-2026-75538

CVE-2026-75538 is a signed integer overflow in the Erlang/OTP inet TCP driver when operating in {packet,4} mode. An unauthenticated remote attacker can trigger an incorrect packet-length calculation that overflows the receive buffer into the BEAM VM allocator area (up to ~2 GB), corrupting alloca...

8.2CVSS6.1AI score0.00491EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/01 2:47 p.m.18 views

CVE-2026-83617

@xmldom/xmldom versions 0.9.11 through 0.9.12 contain a regex bypass in the requireWellFormed: true validation path. The QName_exact anchored expression in lib/grammar.js inherits the multiline flag , so an element or attribute name that is valid on its first line but contains U+000A, U+000D, U+2...

8.7CVSS5.9AI score0.00328EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/01 2:45 p.m.26 views

CVE-2026-74994

The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blocks, collapses all directory blocks into a single shared user/group namespace . This means a user authorized for one protected directory is also acc...

6CVSS5.9AI score0.00364EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/01 2:45 p.m.22 views

CVE-2026-83616

xmldom , a pure JavaScript W3C-standard XML DOM module, is affected by a Processing Instruction Target Injection vulnerability. In Document.createProcessingInstruction(target, data) within lib/dom.js, the target parameter is accepted without validation. The requireWellFormed: true serializer only...

8.7CVSS5.9AI score0.00348EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/01 2:45 p.m.21 views

CVE-2026-74835

The inets application's httpd HTTP server in Erlang/OTP fails to enforce a configured body-size limit on chunked requests, leading to memory exhaustion . The vulnerability is rated CVSS 4.0: 8.7 (HIGH) with high availability impact, low attack complexity, and no privileges required. Affected vers...

8.7CVSS5.9AI score0.00328EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/01 2:45 p.m.21 views

CVE-2026-84114

Cleo Harmony versions up to 5.8.1.10 contain an improper authentication vulnerability in the SAML Authentication component, specifically in the function LocalUserUtil.getNativeUserByAssertions . Manipulation of the Email argument allows a remote attacker with low privileges to bypass authenticati...

6.5CVSS6.1AI score0.00342EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/01 2:44 p.m.31 views

CVE-2026-83615

xmldom , a pure JavaScript XML DOM parser, has a quadratic memory consumption flaw in appendElement within lib/sax.js. The function clones the entire namespace map (currentNSMap) via _copy for every nested element that declares a new namespace prefix, keeping all ancestor maps alive on the parse ...

8.7CVSS5.9AI score0.00351EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/01 2:42 p.m.39 views

CVE-2026-73812

Erlang/OTP inets (HTTP server module) is vulnerable to HTTP Request Smuggling (CL.TE desync) when deployed behind a Content-Length-preferring front-end proxy. The root cause is in httpd:check_header/3 , which rejects duplicate Content-Length headers but never validates the simultaneous presence o...

8.3CVSS5.9AI score0.00301EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/01 2:41 p.m.25 views

CVE-2026-83614

xmldom , a pure JavaScript XML DOM parser, is vulnerable to quadratic-time denial of service via two independent code paths. The first, in lib/sax.js, causes parseElementStartPart to repeatedly rescan a malformed tag name to the next > during single-character recovery, reachable through the de...

8.7CVSS5.9AI score0.00351EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/01 2:41 p.m.14 views

CVE-2026-73276

CVE-2026-73276 is an HTTP Request Smuggling vulnerability in the inets/httpd component of Erlang/OTP , rated CVSS 4.0 8.3 (HIGH) . The root cause is that the gracefulness code in inets failed to reject headers containing whitespace before the colon , leading to header-dropping inconsistencies tha...

8.3CVSS5.9AI score0.00328EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/01 2:40 p.m.19 views

CVE-2026-66357

Erlang/OTP's inets httpd component has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines), meaning every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature enables HTTP request smuggling against servers built on this com...

8.3CVSS5.9AI score0.00328EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/01 2:38 p.m.20 views

CVE-2026-83613

xmldom , a pure JavaScript W3C XML DOM parser, is affected by a quadratic-time complexity flaw in DOMHandler.startElement (lib/dom-parser.js). Each parsed attribute is inserted via setAttributeNode, which triggers a linear getNamedItem/getNamedItemNS lookup in NamedNodeMap.setNamedItem (lib/dom.j...

8.7CVSS5.9AI score0.00344EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/01 2:38 p.m.18 views

CVE-2026-58569

Dell PowerStore contains an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An authenticated user with limited privileges could exploit this to execute arbitrary code with root privileges , resulting in high impact to confidentiality, integrity, and availability with a cha...

8.8CVSS6.2AI score0.00128EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/01 2:38 p.m.19 views

CVE-2026-83589

CVE-2026-83589 has been reserved but no technical details (affected product, root cause, or impact) are publicly available yet. Both the CVE entry and the Red Hat record indicate no description is available . Monitor for updates as details are expected to be published when the candidate is formal...

SaveExploits0References3
CVE
CVE
added 2026/09/01 2:37 p.m.22 views

CVE-2026-59696

CVE-2026-59696 is an Improper Validation of Specified Quantity in Input flaw in Erlang/OTP stdlib where uri_string:get_port/1 passes the URI port substring to binary_to_integer/1 with no length bound. A syntactically valid port of up to ~1.26 million digits converts successfully, costing the call...

6.9CVSS5.8AI score0.00421EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/01 2:37 p.m.20 views

CVE-2026-55951

The Erlang/OTP httpc HTTP client (inets package) does not enforce a limit on the total size of response headers. The max_header_size option defaults to nolimit, and httpc_response:parse_headers/6 accumulates all headers into a list before the length check fires (only after the terminating CRLF CR...

8.2CVSS5.9AI score0.00382EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/01 2:36 p.m.23 views

CVE-2026-83612

xmldom is a pure JavaScript DOMParser and XMLSerializer module. In versions from 0.9.0-beta.1 up to the fix in 0.9.12 , HTML-mode parsing via DOMParser.parseFromString() mishandles mixed-case closing tags for raw-text elements (script, style, textarea, title). The root cause is that parseHtmlSpec...

8.7CVSS5.9AI score0.00301EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/01 2:35 p.m.24 views

CVE-2026-71380

CVE-2026-71380 is a Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd . An unauthenticated remote attacker can trigger a denial of service by sending valid request headers declaring a large Content-Length and then stalling before the body is complete. In...

8.7CVSS5.9AI score0.00387EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/01 2:34 p.m.20 views

CVE-2026-83611

xmldom (and @xmldom/xmldom ) is a pure JavaScript XML DOM parser. The vulnerability lies in DOMParser.parseFromString() , which can silently accept a malformed end tag where the tag name is followed by a line break and trailing content (e.g., ), closing the element and discarding the trailing con...

6.9CVSS5.9AI score0.00352EPSS
SaveExploits0References7
Total number of security vulnerabilities395489