Lucene search
+L

378298 matches found

CVE
CVE
added 2026/07/23 2:33 p.m.17 views

CVE-2026-43823

The CVE describes a double-free in EVP_PKEY* when initializing an RSA public key from DER/PEM bytes if decoding fails. The double-free occurs first in the catch block and again in deinit, potentially causing a crash on subsequent memory allocations. Affected code path manifests when BoringSSL can...

7.5CVSS5.4AI score0.00256EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 1:48 p.m.22 views

CVE-2026-8287

The CVE-2026-8287 entry describes an allocation-of-resources-without-limits or throttling vulnerability in BizimHesap Information Systems’ Online Pre-Accounting Software, affecting the product through version 17072026. The concise impact indicates potential availability impact (CVSS v3.1: 4.3, ME...

4.3CVSS5.2AI score0.00212EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 1:45 p.m.12 views

CVE-2026-16735

The CVE concerns release-it conventional-changelog up to 11.0.1, where the writeChangelog function in index.js of the Changelog File Handler is vulnerable. Manipulation of the infile argument enables local OS command injection, with the exploit publicly disclosed. The attack is local and requires...

5.3CVSS5.3AI score0.00622EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/23 1:30 p.m.15 views

CVE-2026-65690

Bold Reports Standalone Report Designer, versions before 14.1.12, is affected by a path traversal vulnerability in the file upload feature due to missing filepath validation. This allows an authenticated attacker to supply a crafted filename to traverse outside the intended directory and potentia...

8.8CVSS6.1AI score0.00599EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/23 1:30 p.m.38 views

CVE-2026-16733

The CVE refers to bahmutov find-cypress-specs (up to version 1.54.12) where the function shell.exec in src/index.js of the Branch Handler is vulnerable. Manipulating the --branch argument leads to OS command injection. The attack is described as locally executable, with the exploit publicly avail...

5.3CVSS5.5AI score0.00612EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/23 1:28 p.m.23 views

CVE-2026-65689

Bold Reports Standalone Report Designer before 14.1.12 is affected by a path traversal vulnerability in the database download feature that allows unauthenticated attackers to read arbitrary files on the server filesystem, including authentication credentials, potentially giving full unauthorized ...

9.8CVSS5.9AI score0.00581EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/23 1:25 p.m.20 views

CVE-2026-65688

The vulnerability affects Bold Reports Standalone Report Designer (before version 14.1.12). A missing filepath validation in the font processing feature enables unauthenticated attackers to perform a path traversal and read arbitrary files from the server filesystem, potentially exposing sensitiv...

9.8CVSS5.9AI score0.00594EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/23 1:24 p.m.14 views

CVE-2026-65687

Bold Reports Standalone Report Designer (vulnerable before 14.1.12) contains a path traversal vulnerability in its SVG processing feature that allows unauthenticated attackers to read arbitrary files from the server filesystem, potentially exposing credentials and enabling full unauthorized acces...

9.8CVSS5.9AI score0.00581EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.21 views

CVE-2026-65914

DOMPurify contains a mutation-XSS in versions before 3.3.2 when sanitized HTML is reinserted into special parsing contexts via innerHTML wrappers (script, xmp, iframe, noembed, noframes, noscript). Attackers can craft payloads with closing sequences to break out of the wrapper during reparsing, r...

6.1CVSS5.5AI score0.00166EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.24 views

CVE-2026-65913

DOMPurify prior to 3.3.2 is affected by a prototype pollution vulnerability in USE_PROFILES mode. An attacker can pollute Array.prototype properties (e.g., onclick) to bypass attribute filtering, causing DOMPurify to treat event handler attributes as allowed. This enables DOM-based XSS when sanit...

6.1CVSS5.2AI score0.00185EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.15 views

CVE-2026-65912

DOMPurify before 3.3.2 has a URI validation bypass when ADD_ATTR is used as a predicate via EXTRA_ELEMENT_HANDLING.attributeCheck. An attacker can craft a predicate to accept specific attribute/tag combinations, allowing unsafe protocols like javascript: to bypass validation and execute as DOM-ba...

6.1CVSS5.3AI score0.00175EPSS
SaveExploits0References2Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.23 views

CVE-2026-65904

CVE-2026-65904 affects DOMPurify up to version 3.4.3. In IN_PLACE mode, elements sourced from a different window/realm (e.g., iframe contentDocument) fail sanitization due to a cross-realm instanceof check in private _isNode(). The check returns false for foreign-realm nodes, causing the element ...

4.7CVSS5.9AI score0.00165EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.19 views

CVE-2026-65911

CVE-2026-65911 concerns DOMPurify up to version 3.3.3. Predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() can persist in internal state (EXTRA_ELEMENT_HANDLING) across sanitize() calls on the same instance. If a subsequent call passes ADD_ATTR/ADD_TAGS as an array instead of a f...

6.1CVSS4.5AI score0.00191EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.28 views

CVE-2026-65903

DOMPurify before 3.4.0 contains a logic error in ADD_TAGS where short-circuit evaluation lets forbidden tags bypass FORBID_TAGS. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS, causing those tags to be retained in the sanitized output. Affected: D...

6.1CVSS5.2AI score0.002EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.17 views

CVE-2026-65902

DOMPurify 3.4.7 fixes a mutation pollution vulnerability. Affected: DOMPurify

6.1CVSS5.4AI score0.0021EPSS
SaveExploits1References3Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.22 views

CVE-2026-65901

DOMPurify 3.4.6 has a cross-site scripting vulnerability in IN_PLACE mode where attacker-controlled nodeName on live non-form nodes can cause scripts to execute when the sanitized tree is inserted into a live document. Attackers can supply hostile live DOM objects with real script children whose ...

6.1CVSS5.1AI score0.00166EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.23 views

CVE-2026-65900

CVE-2026-65900 affects DOMPurify versions 3.0.0 up to 3.4.7 when configured with SAFE_FOR_TEMPLATES and a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE). The final scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.con...

6.1CVSS5.3AI score0.0018EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.17 views

CVE-2026-65899

The CVE affects DOMPurify 3.0.0 through 3.4.8, where clearConfig() does not reset the retained TRUSTED_TYPES_POLICY. This allows a DOMPurify instance reused across trust boundaries to remain bound to a previously supplied policy, so a later caller requesting RETURN_TRUSTED_TYPE output may receive...

6.1CVSS5.6AI score0.00231EPSS
SaveExploits1References3Affected Software1
CVE
CVE
added 2026/07/23 1:16 p.m.50 views

CVE-2026-65898

DOMPurify before 3.4.11 is affected. The vulnerability arises when setConfig() is used with an uponSanitizeAttribute hook and the ALLOWED_ATTR allowlist isn’t cloned, allowing the hook to permanently mutate the shared allowlist. An attacker can register a hook that conditionally permits dangerous...

7.2CVSS5.3AI score0.00167EPSS
SaveExploits1References2Affected Software1
CVE
CVE
added 2026/07/23 12:54 p.m.138 views

CVE-2026-14257

CVE-2026-14257 affects brace-expansion up to 5.0.7, vulnerable to denial of service via memory exhaustion. The expand() function limits result count with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker can keep the...

7.5CVSS5.3AI score0.00339EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/23 12:33 p.m.16 views

CVE-2026-15037

CVE-2026-15037 affects Qt XML (QDom): improper output neutralization in comment, CDATA, and processing-instruction serialization from Qt 4.0.0 through 6.11. Untrusted text serialized into these nodes can inject arbitrary XML markup because node terminators aren’t escaped under the default Invalid...

6.3CVSS5.5AI score0.00262EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 12:28 p.m.35 views

CVE-2026-65907

The vulnerability affects JetBrains TeamCity prior to 2026.1.2, where code execution was possible in Git VCS roots (2025.11.6). The issue is tied to TeamCity’s Git VCS integration, with impact described as CRITICAL (CVSS 3.1). Remediation: upgrade to TeamCity 2026.1.2 or later as indicated by the...

9.1CVSS6AI score0.00421EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 12:25 p.m.28 views

CVE-2026-65908

JetBrains PyCharm is affected by CVE-2026-65908. In PyCharm before 2026.1.4 (and 2026.2), an attacker could achieve arbitrary code execution by opening a malicious Python executable in an untrusted project. Root cause is likely processing of Python executables on project open; CVSSv3.1 indicates ...

8.6CVSS6.2AI score0.00126EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 12:24 p.m.41 views

CVE-2026-65906

CVE-2026-65906 affects JetBrains TeamCity prior to 2026.1.2. The issue is a code execution vulnerability exposed via Kotlin DSL sandbox escape, allowing an attacker to execute arbitrary code under certain conditions. The CVSS 3.1 base metrics indicate HIGH impact across confidentiality, integrity...

8.8CVSS5.6AI score0.00404EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 11:53 a.m.29 views

CVE-2026-65475

The CVE concerns the WP Chill Modula Image Gallery WordPress plugin, specifically versions 2.14.25–2.14.30, affected by an Improper Neutralization of Input During Web Page Generation (Stored XSS). The root cause is the improper handling of user input during page generation in Modula Image Gallery...

6.5CVSS5.3AI score0.0013EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 11:50 a.m.10 views

CVE-2026-61945

The CVE-2026-61945 entry concerns the WordPress WooCommerce Product Stock Alert plugin (versions up to 3.0.6) from MultiVendorX. Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability allows retrieval of embedded sensitive data. Affected software: Wo...

6.5CVSS5.3AI score0.00212EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 11:46 a.m.17 views

CVE-2026-57626

The CVE-2026-57626 entry concerns a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress MailPoet plugin, affecting versions 5.30.0 through 5.33.0. Affected component: MailPoet plugin for WordPress. Root cause and exact exploit details are not provided in the connected documents, but ...

7.1CVSS5.3AI score0.00089EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 11:42 a.m.13 views

CVE-2026-65897

Grav API Plugin before 1.0.10 is affected. The flaw in InvitationsController::create() fails to validate the groups field, allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. When such invitations are accepted, the new account gain...

8.8CVSS5.4AI score0.00361EPSS
SaveExploits0References4
CVE
CVE
added 2026/07/23 11:42 a.m.13 views

CVE-2026-65896

CVE-2026-65896 affects Grav API Plugin (getgrav/grav-plugin-api) versions before 1.0.10. PagesController::move() sanitizes only leading dots via ltrim($body['slug'], '.') and does not neutralize '/' or '..' segments, enabling an authenticated api.pages.write user to perform path traversal (e.g., ...

7.1CVSS5.5AI score0.00267EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/23 11:42 a.m.12 views

CVE-2026-65895

CVE-2026-65895 affects Grav API Plugin prior to 1.0.10. The issue allows an authenticated user with the api.config.write privilege to modify security-critical plugin configuration scopes, namely rate limiting and CORS. This can disable site-wide rate limiting (facilitating credential brute-forcin...

8.5CVSS5.3AI score0.00234EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/23 11:42 a.m.18 views

CVE-2026-65608

Grav prior to 2.0.9 is vulnerable to remote code execution via FlexDirectory. The flaw in FlexDirectory::dynamicDataField() uses attacker-influenced input with call_user_func_array() and only validates that the target is callable, allowing arbitrary shell commands when an authenticated user with ...

8.8CVSS6.8AI score0.00849EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/23 11:42 a.m.16 views

CVE-2026-65606

SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/ link references a name that is not an installed plugin, SiYuan Desktop opens a custom tab and inserts the link’s icon parameter into the tab header via innerHTML without ...

9.6CVSS5.2AI score0.00516EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/23 11:42 a.m.18 views

CVE-2026-65607

SiYuan before v3.7.2 has a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). The branch concatenates the raw, percent-decoded request path with util.TempDir and serves the file without the IsSubPath or IsSensitivePath check...

7.1CVSS5.6AI score0.00399EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/23 11:42 a.m.14 views

CVE-2026-65605

SiYuan prior to v3.7.2 is vulnerable to a stored XSS in the Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, with EscapeHTML applied only when HasUnclosedHtmlTag is true; balanced self-closing tags like can bypass this...

9.6CVSS5.2AI score0.00516EPSS
SaveExploits0References3
CVE
CVE
added 2026/07/23 11:37 a.m.19 views

CVE-2026-64815

JetBrains IntelliJ IDEA is affected by CVE-2026-64815 for versions prior to 2026.2. The vulnerability allows arbitrary code injection via UI Designer form files. Root cause details are not provided in the supplied documents, but the weakness enables code execution under certain conditions, as ind...

9.8CVSS5.7AI score0.0033EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:37 a.m.21 views

CVE-2026-64814

CVE-2026-64814 affects JetBrains IntelliJ IDEA prior to 2026.2, where unauthorized file access was possible during a Remote Development session. The provided documents state the condition but do not specify root cause details, exact vulnerable components, exploitable conditions beyond the Remote ...

8.6CVSS5.3AI score0.00315EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.14 views

CVE-2026-64813

JetBrains IntelliJ IDEA prior to version 2026.2 contains a vulnerability where unauthorized settings modification is possible during Remote Development sessions. The issue is indicated as a CRITICAL impact (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) with network attack vector, no privileges r...

10CVSS5.3AI score0.00393EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.76 views

CVE-2026-64812

CVE-2026-64812 affects JetBrains IntelliJ IDEA prior to 2026.2. The vulnerability allows unauthorized input injection during a Remote Development session. Root cause details are not elaborated beyond the description; exploitation status and mitigation are not specified in the provided documents. ...

10CVSS5.3AI score0.00363EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.13 views

CVE-2026-64811

JetBrains IntelliJ IDEA (before 2026.2) contains a vulnerability where arbitrary code execution is possible before granting project trust via development container configuration. CVSS 3.1: score 7.8 (HIGH), vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H; attack vector LOCAL, user interaction REQUIRED...

7.8CVSS6.2AI score0.00126EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.16 views

CVE-2026-64808

Affected software: JetBrains PhpStorm. Vulnerability: via project tooling, PhpStorm before 2026.2 allows arbitrary code execution prior to granting project trust. Root cause is related to the project tooling workflow. Impact: high (as per CVSS 3.1: AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Exploitati...

8.4CVSS6.2AI score0.0014EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.15 views

CVE-2026-64809

JetBrains PhpStorm is affected by CVE-2026-64809: arbitrary code execution possible before granting project trust via the configured interpreter, in PhpStorm before 2026.2. Root cause details are not provided; impact is high with local access and no user interaction required. Exploitation status ...

8.4CVSS6.2AI score0.0014EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.29 views

CVE-2026-64810

JetBrains IntelliJ IDEA versions prior to 2026.2 are affected by an HTML injection vulnerability in an IDE notification, enabling silent user activity tracking. The issue is described across CVE-2026-64810 records (NVD and CVE listings) with a CVSS 3.1 Base Score of 4.3 (Medium) and user interact...

6.1CVSS5.3AI score0.00149EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.14 views

CVE-2026-64807

CVE-2026-64807 affects JetBrains WebStorm prior to 2026.2. The issue enables arbitrary code execution via a project-supplied linter configuration. According to CVSS 3.1, the vulnerability has a base score of 7.8 (HIGH), with LOCAL attack vector, LOW attack complexity, no privileges required, and ...

7.8CVSS6.2AI score0.00126EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.12 views

CVE-2026-64806

CVE-2026-64806 affects JetBrains WebStorm prior to 2026.2. The issue allows arbitrary code execution before granting project trust via the configured Node.js interpreter. It indicates a local attack vector with high impact (C:H/I:H/A:H) and requires no user interaction. Remediation is to upgrade ...

8.4CVSS6.2AI score0.0014EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.13 views

CVE-2026-64804

JetBrains WebStorm is affected by CVE-2026-64804: before version 2026.2, arbitrary code execution could occur before granting project trust when using project-local linter tooling. The NVD entry lists a CVSS v3.1 base score of 8.4 (HIGH), with LOCAL attack vector, no user interaction required, an...

8.4CVSS6.2AI score0.0014EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.16 views

CVE-2026-64803

JetBrains GoLand is affected prior to version 2026.2. The vulnerability enables arbitrary code execution before granting project trust via the configured Go SDK, requiring local access and user interaction. Impact is high for confidentiality, integrity, and availability as per CVSS. Remediation: ...

7.8CVSS6.2AI score0.00143EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.15 views

CVE-2026-64805

CVE-2026-64805 affects JetBrains WebStorm prior to 2026.2. The advisory indicates that arbitrary code execution was possible before granting project trust via the project-local package-manager tooling. The root cause is tied to the project-local tooling workflow in WebStorm, enabling code executi...

8.4CVSS6.2AI score0.0014EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.23 views

CVE-2026-64802

Technical details about CVE-2026-64802 are not publicly provided in the supplied documents. Monitor for updates from JetBrains and NVD; no specifics on affected versions, vectors, or fixes are available here.

7.8CVSS6.2AI score0.00143EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:36 a.m.16 views

CVE-2026-64800

CVE-2026-64800 : In JetBrains GoLand before 2026.2, sensitive configuration values are written to log files by default, exposing potentially sensitive data. The connected sources confirm the affected product/version and the root cause (logging of sensitive values). No exploitation, mitigation ste...

5.7CVSS5.3AI score0.00491EPSS
SaveExploits0References1Affected Software1
CVE
CVE
added 2026/07/23 11:19 a.m.11 views

CVE-2026-65550

Technical details for CVE-2026-65550 are not publicly provided in the supplied documents; monitor for updates on affected versions, impact, and remediation.

5.9CVSS5.1AI score0.00148EPSS
SaveExploits0References1
Total number of security vulnerabilities378298