Lucene search
+L

379696 matches found

CVE
CVE
added 2026/07/12 1:15 a.m.23 views

CVE-2026-15472

Technical details are not publicly available in the provided documents. Monitor for updates.

5.3CVSS5.9AI score0.00207EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/12 1:12 a.m.23 views

CVE-2025-56000

Technical details for CVE-2025-56000 are not publicly available in the provided documents. The Fedora update mentions xorg-x11-server but does not link to this CVE. Monitor for updates to obtain concrete affected products, impact, or remediation.

SaveExploits0
CVE
CVE
added 2026/07/12 1:0 a.m.26 views

CVE-2026-15471

Eleveo Call Recording Software 9.7.0 contains a vulnerability in an unknown portion of /callrec/pci_dss_status.jsp that allows improper authorization. The issue supports remote exploitation and the exploit has been made public. No remediation details are provided in the document. Vendor contact o...

5.3CVSS5.8AI score0.00207EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/12 12:0 a.m.18 views

CVE-2026-59959

Technical details are not publicly available in the provided documents. Monitor for updates.

SaveExploits0References1
CVE
CVE
added 2026/07/11 11:45 p.m.21 views

CVE-2026-15470

Technical details (affected product, versions, root cause, exploit specifics) are not publicly provided in the supplied documents. Monitor for updates.

5.3CVSS5.7AI score0.00207EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/11 8:55 p.m.34 views

CVE-2026-58281

CVE-2026-58281 — Microsoft Edge (Chromium-based) Root cause: Deserialization of untrusted data in Edge may allow remote code execution. The vulnerability is exploitable over a network and falls under a high severity (CVSS v3.1 base score 8.3; AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H). Impact: Unauthor...

8.3CVSS6.2AI score0.00704EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/11 5:0 p.m.47 views

CVE-2026-10660

The CVE-2026-10660 issue affects the Zephyr Bluetooth BAP Broadcast Assistant GATT client (subsys/bluetooth/audio/bap_broadcast_assistant.c). A single static net_buf_simple buffer (att_buf, BT_ATT_MAX_ATTRIBUTE_LEN = 512) is shared across all connections; per-connection state (BUSY flag, long-rea...

6.4CVSS6.2AI score0.00159EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:1 p.m.43 views

CVE-2026-61861

CVE-2026-61861 affects ImageMagick prior to 7.1.2-26. A use-after-free in the FormatMagickCaption path occurs when memory allocation fails, allowing a dangling pointer to reference freed memory. This can lead to denial of service or potentially arbitrary code execution. Multiple sources (NVD, Deb...

7.5CVSS6.2AI score0.00323EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/11 1:1 p.m.39 views

CVE-2026-61870

ImageMagick before 7.1.2-26 contains a memory leak in the VIFF encoder when memory allocation fails. An attacker can trigger allocation failures by processing specially crafted VIFF images to exhaust memory and cause a DoS. Remediation: upgrade to ImageMagick 7.1.2-26 or later; apply vendor patch...

7.5CVSS6.1AI score0.00191EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/11 1:1 p.m.29 views

CVE-2026-61858

CVE-2026-61858 concerns ImageMagick prior to 7.1.2-26, where a policy bypass vulnerability exists in the APNG encoder and external delegates due to missing validation checks. Attackers can bypass policy restrictions during APNG encoding and write files to disallowed paths. The provided documents ...

5.3CVSS6.1AI score0.00246EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/11 1:1 p.m.33 views

CVE-2026-61465

ImageMagick before 7.1.2-26 and 6.9.13-51 lacks a check for the allowed memory allocation limit in matrix-backed operations (e.g., -canny). A crafted image can cause ImageMagick to allocate more memory than policy permits, resulting in a denial of service. Affected components: ImageMagick's memor...

6.5CVSS6.1AI score0.00173EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/11 1:1 p.m.39 views

CVE-2026-61857

CVE-2026-61857 affects ImageMagick prior to 7.1.2-26. The issue is a heap use-after-free caused by a missing null check when parsing XMP profiles, allowing crafted images to trigger crashes. Public advisories from multiple vendors (Ubuntu, Debian, Red Hat, Debian, NVD, etc.) describe the vulnerab...

7.5CVSS6.1AI score0.00266EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/11 1:1 p.m.32 views

CVE-2026-61454

CVE-2026-61454 affects Grav's Admin2 plugin prior to 2.0.4. The vulnerability arises from embedding a global JavaScript variable, window.GRAV_CONFIG , in the Admin2 SPA bootstrap page at /grav/admin and subroutes. This object is returned in every unauthenticated response and exposes server URL, A...

8.7CVSS6.1AI score0.00239EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:1 p.m.52 views

CVE-2026-61447

PraxionAI before 1.6.78 exposes a remote code execution flaw in CodeAgent._execute_python() that executes LLM-generated Python code without AST validation, import restrictions, or sandboxing. This enables prompt-injection to exfiltrate environment secrets and run arbitrary code on the host. The v...

10CVSS6.7AI score0.00742EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:1 p.m.25 views

CVE-2026-61448

Parse Server is affected by a stored XSS in versions 9.0.0–9.9.9 (excluding 9.10.0-alpha.2) and 8.6.0x up to 8.6.83. When a file with an unrecognized extension is uploaded, the client-supplied Content-Type is kept. A malformed Content-Type (not valid type/subtype) can bypass fileUpload.fileExtens...

2.1CVSS6AI score0.00245EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:1 p.m.31 views

CVE-2026-61445

Summary (CVE-2026-61445) PraisonAI prior to 4.6.78 exposes arbitrary file write and command execution via the AICoder component. The root cause is missing path validation and lack of command sanitization in LLM tool calls, enabling an attacker to inject malicious prompts through the chat interfac...

9.9CVSS6.3AI score0.00538EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:1 p.m.34 views

CVE-2026-61442

PraisonAI Platform before 0.1.9 has an authorization bypass on PATCH routes for projects, issues, and agents, where workspace-members can modify owner-created records. Specifically, a member can reassign lead_id to their own user id and then delete the owner-created project, bypassing the delete ...

7.1CVSS6.1AI score0.00256EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/11 1:1 p.m.28 views

CVE-2026-61439

Summary: CVE-2026-61439 affects PraisonAI

8.7CVSS6.1AI score0.0026EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:1 p.m.38 views

CVE-2026-61429

CVE-2026-61429 affects PraisonAI before 1.6.78. A SSRF in the Crawl4AI/Chromium backend allows bypassing initial validation via DNS rebinding and HTTP redirects, enabling a headless browser to access internal services and read internal responses including sensitive canary values. The CVSS metrics...

8.5CVSS6.1AI score0.00221EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:1 p.m.34 views

CVE-2026-61426

PrasionAI prior to 1.7.3 uses insecure defaults: it binds to all interfaces with no API key and permissive CORS, allowing unauthenticated access. Attacks can read agent instructions/system prompts via GET /api/agents or invoke /api/chat via POST without auth. No explicit remediation details are p...

8.8CVSS6.1AI score0.00322EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:1 p.m.36 views

CVE-2026-61428

PraisonAI AgentMail is affected by CVE-2026-61428 in versions before 4.6.78, where webhook messages lack signature verification. This enables unauthenticated attackers to POST crafted message.received events to the webhook endpoint, injecting arbitrary content into the agent and triggering replie...

7.3CVSS6.2AI score0.00246EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:1 p.m.44 views

CVE-2026-60090

CVE-2026-60090 affects PraisonAI prior to 4.6.78, exposing a SQL/CQL injection risk via the vector dimension in the PGVector and Cassandra knowledge-store backends. The root cause is that the caller-controlled dimension value is interpolated into the generated CREATE TABLE DDL without runtime enf...

9.8CVSS6.1AI score0.0041EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/11 1:0 p.m.40 views

CVE-2026-56763

CVE-2026-56763 affects Hono prior to 4.12.7. The parseBody function with dot option enabled accepts proto in field names, allowing prototype pollution when parsed results are merged into regular objects via unsafe merge patterns. Impacted behavior includes modification of object prototypes and po...

6.3CVSS6.1AI score0.00177EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:0 p.m.33 views

CVE-2026-60088

CVE-2026-60088 affects PraisonAI prior to 4.6.78. The issue is a path traversal flaw in custom command templates, where file paths are not validated, allowing an attacker to read files outside the workspace (e.g., @../outside_secret.txt or absolute paths) and exfiltrate process-readable files int...

6.8CVSS6.1AI score0.00147EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/11 1:0 p.m.33 views

CVE-2026-56372

ImageMagick (before version 7.1.2-19) contains a heap buffer overflow in the magnify operation. A malformed magnify:method value triggers an out-of-bounds read, which can expose sensitive information or cause denial of service. Multiple sources (NVD, Debian/Ubuntu OSV entries, Red Hat advisory, a...

9.1CVSS6.2AI score0.00198EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/11 1:0 p.m.29 views

CVE-2026-56303

Capgo before 12.128.2 contains an information disclosure in the PostgreSQL function find_apikey_by_value (marked SECURITY DEFINER) that can be executed by the anon role. An unauthenticated caller can hit the /rest/v1/rpc/find_apikey_by_value endpoint to retrieve API key metadata such as user_id, ...

8.7CVSS6.1AI score0.00302EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:0 p.m.31 views

CVE-2026-56296

Cap-go before 12.128.2 has an information disclosure flaw in the public.transfer_app RPC that returns distinct error messages for existing versus non-existing app IDs. This enables unauthenticated attackers to enumerate valid app IDs by observing error message differences when calling transfer_ap...

6.9CVSS6.1AI score0.00239EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 1:0 p.m.35 views

CVE-2026-56240

Capgo vulnerable before version 12.128.12. The billing authorization bypass results from a flaw in the plan_valid calculation, allowing organizations with exhausted or expired usage credits to bypass billing gates and keep access to /updates, /stats, /channel_self, and attachment upload endpoints...

5.3CVSS6.1AI score0.00182EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 9:29 a.m.86 views

CVE-2026-57827

The CVE-2026-57827 entry concerns the Joomla extension RSFiles (RSFiles component) from rsjoomla.com, affected versions prior to 1.17.12. The vulnerability is an unauthenticated arbitrary file upload that can upload executable files, enabling full remote code execution (RCE). The connected record...

10CVSS5.8AI score0.00405EPSS
SaveExploits4References2Affected Software1
CVE
CVE
added 2026/07/11 9:27 a.m.37 views

CVE-2026-57828

The CVE-2026-57828 entry concerns the Joomla extension Phoca Downloads (Phoca.cz) with an authenticated arbitrary file upload vulnerability in the RSFiles component prior to 6.1.3. The issue allows registered users to upload executable files, enabling full remote code execution (RCE). The provide...

9CVSS6.1AI score0.00372EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2026/07/11 7:47 a.m.42 views

CVE-2026-1359

CVE-2026-1359 affects the Genolve WordPress plugin and describes a missing capability check in genolve_setOpt() across all versions up to 5.0.5. This allows authenticated attackers with Contributor-level access (or higher) to modify arbitrary WordPress options, including enabling user registratio...

8.8CVSS6.2AI score0.00305EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 6:50 a.m.44 views

CVE-2026-9282

The connected documents confirm a directory traversal vulnerability in the W3 Total Cache WordPress plugin, affecting all versions up to and including 2.9.4. The issue arises through the setupSources function, enabling unauthenticated attackers to read arbitrary server files that may contain sens...

7.5CVSS6.2AI score0.02773EPSS
SaveIn wildExploits0References6
CVE
CVE
added 2026/07/11 6:50 a.m.28 views

CVE-2026-15010

The CVE-2026-15010 entry concerns the bbp Style Pack plugin for WordPress, vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 6.4.5 via the Topic Form Additional Fields feature. Root causes are insufficient input sanitization in bsp_topic_fields_form_save(), which wri...

6.4CVSS6.2AI score0.00203EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/11 6:50 a.m.34 views

CVE-2026-9017

The CVE describes an authorization bypass in the NEX-Forms – Ultimate Forms Plugin for WordPress (vulnerable up to and including 9.2.2). The underlying issue is that the plugin does not properly verify that a user is authorized to perform an action, enabling unauthenticated attackers to overwrite...

5.3CVSS6.1AI score0.00273EPSS
SaveExploits0References8
CVE
CVE
added 2026/07/11 5:35 a.m.87 views

CVE-2026-10041

The CVE-2026-10041 entry concerns the WCFM – Frontend Manager for WooCommerce WordPress plugin (versions

4.3CVSS6.2AI score0.0025EPSS
SaveExploits0References12
CVE
CVE
added 2026/07/11 5:35 a.m.40 views

CVE-2026-6939

The CVE-2026-6939 entry concerns the CorvusPay WooCommerce Payment Gateway for WordPress. It is vulnerable to Unauthenticated Stored Cross-Site Scripting via the approval_code parameter in all versions up to 2.7.4 due to insufficient input sanitization and output escaping. An unauthenticated REST...

7.2CVSS6.2AI score0.00324EPSS
SaveExploits0References11
CVE
CVE
added 2026/07/11 5:35 a.m.35 views

CVE-2026-12103

CVE-2026-12103 affects the Wallet for WooCommerce WordPress plugin (

4.3CVSS6.2AI score0.00287EPSS
SaveExploits0References10
CVE
CVE
added 2026/07/11 5:35 a.m.50 views

CVE-2026-15155

The CVE-2026-15155 entry concerns the WordPress plugin Essential Addons for Elementor (

8.8CVSS6.1AI score0.00356EPSS
SaveExploits0References9
CVE
CVE
added 2026/07/11 5:35 a.m.27 views

CVE-2026-12126

CVE-2026-12126 affects the WCFM Marketplace plugin for WordPress (versions

6.4CVSS6.2AI score0.00204EPSS
SaveExploits0References8
CVE
CVE
added 2026/07/11 5:35 a.m.36 views

CVE-2026-4661

The CVE-2026-4661 entry concerns the WordPress plugin WP CTA – Sticky CTA Builder, Generate Leads, Promote Sales (versions up to 2.2.2). The flaw is a time-based blind SQL injection in the fildname parameter, caused by insufficient escaping of user-supplied column names in ajaxCheck() and an inco...

7.5CVSS6.1AI score0.00327EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/11 5:35 a.m.33 views

CVE-2026-12994

Technical details are not publicly available in the provided documents. The description summarizes the vulnerability but lacks concrete affected versions, components, and remediation specifics beyond general impact. Monitor for updates.

5.3CVSS6.2AI score0.00361EPSS
SaveExploits0References12
CVE
CVE
added 2026/07/11 5:35 a.m.26 views

CVE-2025-5017

Summary: The Catalyst Connect Zoho CRM Client Portal WordPress plugin (≤ 2.2.0) is vulnerable to time-based SQL Injection via the uid parameter. The root cause is insufficient escaping of user input and lack of proper query parameterization, enabling authenticated attackers with Administrator-lev...

4.9CVSS6.1AI score0.00258EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/11 5:35 a.m.31 views

CVE-2026-11591

CVE-2026-11591 affects the WordPress plugin Widgets for Google Reviews up to version 13.3. It is a Stored Cross‑Site Scripting (XSS) vulnerability triggered via admin settings, caused by insufficient input sanitization and output escaping in the parameters fomo-title and fomo-text . Exploitation ...

4.4CVSS6.2AI score0.00252EPSS
SaveExploits0References10
CVE
CVE
added 2026/07/11 5:35 a.m.26 views

CVE-2026-1382

The CVE-2026-1382 entry covers the WordPress plugin “fresh Podcaster” up to version 1.0.7. The vulnerability is a Stored Cross-Site Scripting (stored XSS) flaw in the freshpodcaster shortcode attributes, caused by insufficient input sanitization and output escaping on user-supplied data. Impact i...

6.4CVSS6.2AI score0.00188EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/11 5:35 a.m.28 views

CVE-2026-10865

CVE-2026-10865 affects the Cost Calculator Builder plugin for WordPress. The vulnerability exists in all versions up to 4.0.11 and arises from exposure in the template body, allowing unauthenticated attackers to read plaintext payment gateway secrets (Stripe secret key, Razorpay secret key, and P...

5.3CVSS6.1AI score0.0037EPSS
SaveExploits0References10
CVE
CVE
added 2026/07/11 5:35 a.m.26 views

CVE-2026-12738

CVE-2026-12738 affects WP Easy Pay

4.3CVSS6.1AI score0.00213EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/11 5:35 a.m.33 views

CVE-2026-6801

The Context Blog theme for WordPress is affected up to version 1.3.5. The vulnerability is an unauthenticated sensitive information exposure via the context_blog_modal_popup, which can let an attacker retrieve the content of password-protected posts. The root cause is exposure through a postID pa...

5.3CVSS6.1AI score0.00239EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 5:35 a.m.28 views

CVE-2026-11898

CVE-2026-11898 affects the White Label CMS WordPress plugin (all versions up to and including 2.7.12). It enables Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. Attack scenario: an authenticated attacker with administrator-level permissi...

4.4CVSS6.2AI score0.00246EPSS
SaveExploits0References10
CVE
CVE
added 2026/07/11 5:35 a.m.31 views

CVE-2025-6784

CVE-2025-6784 affects the WordPress Code Engine plugin (versions up to 0.3.5). It allows Remote Code Execution via the 'code-engine' shortcode because access to the plugin’s code-injecting functionality is not restricted. Authenticated users with Contributor-level access and above can execute cod...

8.8CVSS6.3AI score0.00469EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/11 5:35 a.m.31 views

CVE-2026-11901

Affected software: WordPress WP Hotel Booking plugin (versions ≤ 2.3.1). Vulnerability: Insufficient Verification of Data Authenticity in the PayPal IPN handler (web_hook_process_paypal_standard). The IPN validation endpoint can be chosen from attacker-controlled test_ipn, permitting force-upgrad...

5.3CVSS6.1AI score0.00178EPSS
SaveExploits0References10
Total number of security vulnerabilities379696