Lucene search
+L
CvelistMost viewed

398054 matches found

Cvelist
Cvelist
•added 2026/05/28 10:25 p.m.•78 views

CVE-2026-9966

Integer overflow in XML in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

0.00304EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/05/28 3:29 p.m.•78 views

CVE-2026-47673 Hono: JWT middleware accepts any Authorization scheme, not only Bearer

Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.12.21, the jwt and jwk middlewares do not verify that the Authorization header value uses theBearer scheme. Any two-part header value — regardless of the scheme name in the first position — proceeds t...

4.8CVSS0.00253EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/27 8:48 p.m.•78 views

CVE-2026-45136 claude-code-cache-fix: Local code execution via Python triple-quote injection in tools/quota-statusline.sh

claude-code-cache-fix is a cache optimization proxy for Claude Code. From 3.5.0 to before 3.5.2, tools/quota-statusline.sh introduced in v3.5.0 interpolates Claude Code's hook stdin payload directly into a Python triple-quoted string literal. A ''' byte sequence in any user-controlled field of th...

8.6CVSS0.00214EPSS
SaveExploits1References3
Cvelist
Cvelist
•added 2026/05/27 3:47 p.m.•78 views

CVE-2026-44321 free5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 middleware. The POST /upi/v1/upNodesLinks create-or-update handler accepts attacker-controlled JSON and passes it directly into...

7.5CVSS0.00606EPSS
SaveExploits1References4
Cvelist
Cvelist
•added 2026/05/27 12:58 p.m.•78 views

CVE-2026-46086 net: bridge: use a stable FDB dst snapshot in RCU readers

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by fdbdeletelocal, which updates f-dst to another port or to NULL while keeping the entry alive. Several bridge RCU readers...

0.00166EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/05/26 4:45 a.m.•78 views

CVE-2026-9531 Totolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injection

A weakness has been identified in Totolink CA750-PoE 6.2c.510. Impacted is the function setUpgradeUboot of the file /cgi-bin/cstecgi.cgi of the component Setting Handler. This manipulation of the argument FileName causes os command injection. The attack is possible to be carried out remotely. The...

6.5CVSS0.01768EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/05/20 9:20 a.m.•78 views

CVE-2026-42959 Crash during DNSSEC validation of malicious content

NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash given malicious upstream replies. When Unbound constructs chase-reply messages for validation, the code uses the wrong counter to calculate write offsets fo...

8.7CVSS0.00716EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/19 7:03 p.m.•78 views

CVE-2026-32738 libheif has a Heap OOB Read/SEGV Crash via Zero samples_per_chunk

libheif is a HEIF and AVIF file format decoder and encoder. In versions 1.21.2 and below, a crafted 792-byte HEIF sequence file with samplesperchunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor mlastsample = 0 + 0 - 1 = UINT32MAX, mapping all samples to an empty...

6.5CVSS0.00375EPSS
SaveExploits1References1
Cvelist
Cvelist
•added 2026/05/18 3:00 a.m.•78 views

CVE-2026-8786 Tencent WeKnora Config API Endpoint initialization.go getKnowledgeBaseForInitialization authorization

A vulnerability has been found in Tencent WeKnora up to 0.3.6. Affected by this issue is the function getKnowledgeBaseForInitialization of the file internal/handler/initialization.go of the component Config API Endpoint. The manipulation of the argument kbId leads to authorization bypass. It is...

6.5CVSS0.0042EPSS
SaveExploits1References4
Cvelist
Cvelist
•added 2026/05/15 7:46 a.m.•78 views

CVE-2026-6228 Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the adminform post type. The...

8.8CVSS0.00774EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/05/15 1:51 a.m.•78 views

CVE-2025-48513

Use of uninitialized resource within the AMD Platform Management Framework PMF could allow an attacker to read a uninitialized kernel memory resulting in loss of confidentiality or availability...

6.9CVSS0.00104EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/14 6:48 p.m.•78 views

CVE-2026-23998 Fleet has a Windows MDM management endpoint authentication bypass

Fleet is open source device management software. Prior to version 4.81.0, a vulnerability in Fleet’s Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, this could allow an attacker to impersonate an enrolled...

8.2CVSS0.00214EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/05/14 6:44 a.m.•78 views

CVE-2026-6225 Taskbuilder – Project Management & Task Management Tool With Kanban Board <= 5.0.6 - Authenticated (Subscriber+) Time-Based Blind SQL Injection via 'project_search' Parameter

The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'projectsearch' parameter in all versions up to, and including, 5.0.6 due to insufficient escaping on the user supplied parameter and lack of...

6.5CVSS0.00379EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/05/14 5:38 a.m.•78 views

CVE-2025-14869 Improper Validation of Specified Quantity in Input in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted payloads on certain API endpoints...

7.5CVSS0.00354EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/05/14 3:27 a.m.•78 views

CVE-2026-7648 LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.5 - Authenticated (Subscriber+) Payment Bypass to Free Course Enrollment via 'quantity' Parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to payment bypass through user-controlled key in all versions up to, and including, 4.3.5. This is due to improper handling of user-supplied request parameters in the REST API endpoint, whi...

4.3CVSS0.00403EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/05/13 7:28 p.m.•78 views

CVE-2026-33378 Grafana Data Source Plugin: DoS (OOM) via Negative Interval Injection in $__timeGroup Macro

Using the $timeGroup macro, one can achieve an OOM by overloading the server. This requires a SQL datasource. If the server is set up to auto-restart, the impact is minimal or non-existent, as the attack can take upwards of half an hour to crash the server...

6.5CVSS0.0042EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/13 6:10 p.m.•78 views

CVE-2026-42584 Netty: HttpClientCodec response desynchronization

Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103,...

7.3CVSS0.00716EPSS
SaveExploits1References1
Cvelist
Cvelist
•added 2026/05/13 5:29 a.m.•78 views

CVE-2026-6929 JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'sortf' parameter in all versions up to, and including, 5.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient...

7.5CVSS0.00541EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/05/13 12:08 a.m.•78 views

CVE-2026-8200 Schema validation log messages may not redact user data

When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 version...

4.8CVSS0.0034EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/12 10:23 p.m.•78 views

CVE-2026-42289 ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation

ChurchCRM is an open-source church management system. Prior to 7.3.2, UserEditor.php processes user account creation and permission updates entirely through $POST parameters with no CSRF token validation. An unauthenticated attacker can craft a malicious HTML page that, when visited by an...

8.8CVSS0.00196EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/12 9:34 p.m.•78 views

CVE-2026-8449

...

0.00179EPSS
SaveExploits0
Cvelist
Cvelist
•added 2026/05/12 8:25 p.m.•78 views

CVE-2026-44011 Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

Craft CMS is a content management system CMS. From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled...

8.6CVSS0.00441EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/05/12 4:58 p.m.•78 views

CVE-2026-35433 .NET Elevation of Privilege Vulnerability

...

7.3CVSS0.0057EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/12 4:54 p.m.•78 views

CVE-2026-44278

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2, FortiClientWindows 7.2 all versions may allow attacker to information disclosure via...

2.3CVSS0.00139EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/12 10:51 a.m.•78 views

CVE-2026-32684

The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensitive information...

2.9CVSS0.00126EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/11 6:37 a.m.•78 views

CVE-2026-5084 WebDyne::Session versions before 3.003_704 for Perl generate the session id insecurely

WebDyne::Session versions before 3.003704 for Perl generate the session id insecurely. The session handler generates the session id from an MD5 hash seeded with a call to the built-in rand function. The rand function is passed a maximum value based on the process id, the epoch time and the...

0.00372EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/05/11 2:00 a.m.•78 views

CVE-2026-8263 Tenda AC6 httpd WifiExtraSet fromSetWirelessRepeat os command injection

A security flaw has been discovered in Tenda AC6 15.03.06.49multiTDE01. Affected is the function fromSetWirelessRepeat of the file /goform/WifiExtraSet of the component httpd. Performing a manipulation of the argument mac/ssid results in os command injection. It is possible to initiate the attack...

5.8CVSS0.08692EPSS
SaveExploits1References5
Cvelist
Cvelist
•added 2026/05/10 4:28 a.m.•78 views

CVE-2026-7258 Out-of-bounds read in urldecode() on NetBSD

In PHP versions 8.2. before 8.2.31, 8.3. before 8.3.31, 8.4. before 8.4.21, and 8.5. before 8.5.6, some functions, including urldecode, pass signed char to ctype functions like isxdigit. On the systems with default signed char and optimized table-lookup ctype functions - such as NetBSD - this can...

6.3CVSS0.00405EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/09 4:10 a.m.•78 views

CVE-2026-42310 Pillow: PDF Parsing Trailer Infinite Loop (DoS)

Pillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0...

5.1CVSS0.00177EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/05/09 3:59 a.m.•78 views

CVE-2026-42301 Improper Input Validation leading to Improper Control of Generation of Code ('Code Injection') in pyp2spec

pyp2spec generates working Fedora RPM spec file for Python projects. Prior to version 0.14.1, pyp2spec was writing PyPI package metadata e.g. the summary field into the generated spec file without escaping RPM macro directives. When a packager then runs rpmbuild, those directives get evaluated, s...

7.8CVSS0.00227EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/05/09 3:56 a.m.•78 views

CVE-2026-41163 bubblewrap vulnerable to privilege escalation in setuid mode via ptrace

bubblewrap is a low-level unprivileged sandboxing tool. From version 0.11.0 to before version 0.11.2, if bubblewrap is installed in setuid mode then the user can use ptrace to attach to bubblewrap and control the unprivileged part of the sandbox setup phase. This allows the attacker to arbitraril...

8.7CVSS0.0036EPSS
SaveExploits0References2
Cvelist
Cvelist
•added 2026/05/09 3:38 a.m.•78 views

CVE-2026-42137 Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, pages.access/list and files.access/list permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0...

7.1CVSS0.00402EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/05/09 12:43 a.m.•78 views

CVE-2026-6664 PgBouncer integer overflow in PgBouncer network packet parsing

An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthenticated remote attacker can crash PgBouncer with a malformed SCRAM authentication packet...

7.5CVSS0.00729EPSS
SaveExploits1References1
Cvelist
Cvelist
•added 2026/05/08 2:22 p.m.•78 views

CVE-2026-43439 cgroup: fix race between task migration and iteration

In the Linux kernel, the following vulnerability has been resolved: cgroup: fix race between task migration and iteration When a task is migrated out of a cssset, cgroupmigrateaddtask first moves it from cset-tasks to cset-mgtasks via: listmovetail&task-cglist, &cset-mgtasks; If a csstaskiter...

0.00111EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/05/08 2:22 p.m.•78 views

CVE-2026-43437 ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain()

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: fix use-after-free on linked stream runtime in sndpcmdrain In the drain loop, the local variable 'runtime' is reassigned to a linked stream's runtime runtime = s-runtime at line 2157. After releasing the stream lock at...

7.8CVSS0.00171EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/05/08 7:15 a.m.•78 views

CVE-2026-44928

In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal...

2.9CVSS0.00231EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/08 3:42 a.m.•78 views

CVE-2026-42273 Heimdall: Case-sensitive host matching may lead to policy bypass

Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs host matching in a case-sensitive manner, while HTTP hostnames are case-insensitive. This discrepancy can result in heimdall failing to match a rule for a request host...

7.8CVSS0.00524EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/05/07 6:30 p.m.•78 views

CVE-2026-8084 OSGeo gdal HDF-EOS Grid File SWapi.c memmove out-of-bounds

A vulnerability was determined in OSGeo gdal up to 3.13.0dev-4. This vulnerability affects the function memmove of the file frmts/hdf4/hdf-eos/SWapi.c of the component HDF-EOS Grid File Handler. This manipulation causes out-of-bounds read. The attack is restricted to local execution. The exploit...

4.8CVSS0.00222EPSS
SaveExploits1References9
Cvelist
Cvelist
•added 2026/05/06 1:49 p.m.•78 views

CVE-2025-31976 HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials

HCL BigFix Service Management SM is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated...

4.8CVSS0.00162EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/05 7:13 p.m.•78 views

CVE-2026-33489 CoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison

CoreDNS is a DNS server that chains plugins. In versions prior to 1.14.3, the transfer plugin can select the wrong ACL stanza when both a parent zone and a more-specific subzone are configured. The longestMatch function in plugin/transfer/transfer.go uses a lexicographic string comparison instead...

8.2CVSS0.00423EPSS
SaveExploits1References2
Cvelist
Cvelist
•added 2026/05/04 10:07 p.m.•78 views

CVE-2026-7791

Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before 2.6.2034.0 allows a local non-admin authenticated user to place arbitrary files into arbitrary locations bypassing file system permission protections, leadi...

8.5CVSS0.00126EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/05/04 7:15 a.m.•78 views

CVE-2026-7743 CodeAstro Online Classroom studentdetails sql injection

A vulnerability has been found in CodeAstro Online Classroom 1.0. The impacted element is an unknown function of the file /OnlineClassroom/studentdetails. The manipulation of the argument deleteid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

6.5CVSS0.00316EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/05/02 9:00 a.m.•78 views

CVE-2026-7609 TRENDnet TEW-821DAP Firmware Udpate diagnostic tools_diagnostic os command injection

A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. The impacted element is the function toolsdiagnostic of the file /tmp/diagnostic of the component Firmware Udpate. This manipulation causes os command injection. Remote exploitation of the attack is possible. The exploit has been publish...

6.5CVSS0.0573EPSS
SaveExploits1References4
Cvelist
Cvelist
•added 2026/05/02 7:46 a.m.•78 views

CVE-2026-6229 Royal Addons for Elementor <= 1.7.1057 - Authenticated (Contributor+) Server-Side Request Forgery via CSV URL Parameter

The Royal Elementor Addons plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.7.1057. This is due to insufficient validation of user-supplied URLs in the rendercsvdata function, which can be bypassed by including 'docs.google.com/spreadsheets' in...

7.2CVSS0.00482EPSS
SaveExploits0References11
Cvelist
Cvelist
•added 2026/04/23 3:11 p.m.•78 views

CVE-2026-31533 net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption

In the Linux kernel, the following vulnerability has been resolved: net/tls: fix use-after-free in -EBUSY error path of tlsdoencryption The -EBUSY handling in tlsdoencryption, introduced by commit 859054147318 "net: tls: handle backlogging of crypto requests", has a use-after-free due to double...

9.8CVSS0.00707EPSS
SaveExploits0References7
Cvelist
Cvelist
•added 2026/04/21 7:35 p.m.•78 views

CVE-2026-40883 goshs: CSRF in state-changing GET routes enables authenticated file deletion and directory creation

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an already authenticated browser to trigger destructive actions such as ?delete and ?mkdir because...

6.1CVSS0.00194EPSS
SaveExploits1References1
Cvelist
Cvelist
•added 2026/04/09 7:12 p.m.•78 views

CVE-2026-24880 Apache Tomcat: Request smuggling via invalid chunk extension

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in Apache Tomcat via invalid chunk extension. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.18, from 10.1.0-M1 through 10.1.52, from 9.0.0.M1 through 9.0.115, from 8.5.0 through 8.5.100,...

0.00683EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/03/26 8:01 p.m.•78 views

CVE-2026-2100 P11-kit: null dereference via c_derivekey with specific null parameters

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the CDeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potential...

5.3CVSS0.0116EPSS
SaveExploits0References11
Cvelist
Cvelist
•added 2026/03/09 9:47 p.m.•78 views

CVE-2026-30931 ImageMagick has a heap-based buffer overflow in UHDR encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16, a heap-based buffer overflow in the UHDR encoder can happen due to truncation of a value and it would allow an out of bounds write. This vulnerability is fixed in 7.1.2-16...

6.8CVSS0.00153EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/03/09 9:45 p.m.•78 views

CVE-2026-30883 ImageMagick has a Heap Overflow when writing extremely large image profile in the PNG encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2-16 and 6.9.13-41, an extremely large image profile could result in a heap overflow when encoding a PNG image. This vulnerability is fixed in 7.1.2-16 and 6.9.13-41...

5.7CVSS0.00134EPSS
SaveExploits0References1
Total number of security vulnerabilities5000