Lucene search
+L
CvelistRecent

398493 matches found

Cvelist
Cvelist
•added 2026/09/23 4:29 p.m.•38 views

CVE-2026-95845 Moquette unbounded per-session message queues allow memory exhaustion

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight window is full, queued messages can accumulate without bound in memory or...

8.7CVSS0.00358EPSS
SaveExploits1References3
Cvelist
Cvelist
•added 2026/09/23 4:29 p.m.•36 views

CVE-2026-95844 Moquette deeply nested MQTT topics can cause stack exhaustion

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote client can publish or subscribe with a deeply nested topic, causing a...

8.7CVSS0.00291EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/23 4:29 p.m.•37 views

CVE-2026-95843 Moquette malformed shared subscriptions can crash command processing

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/shareName/topicFilter structure. A remote client can send a filter such as $share/grp withou...

8.7CVSS0.00429EPSS
SaveExploits1References4
Cvelist
Cvelist
•added 2026/09/23 4:29 p.m.•37 views

CVE-2026-95842 Moquette uncaught MQTT command exceptions can terminate shared session event loops

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions,...

8.7CVSS0.00429EPSS
SaveExploits1References4
Cvelist
Cvelist
•added 2026/09/23 4:29 p.m.•40 views

CVE-2026-85724 Moquette pattern ACL wildcard injection allows cross-tenant authorization bypass

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when pattern-based ACL rules are configured, AuthorizationsCollector.canDoOperation substitutes client ID and username values directly into rules containing %c or %u and then treats the result as an MQTT topic filter. A client that uses...

9.6CVSS0.0027EPSS
SaveExploits1References3
Cvelist
Cvelist
•added 2026/09/23 4:28 p.m.•43 views

CVE-2026-96775 MLflow dspy bypasses pickle deserialization control

MLflow's dspy flavor, versions = 2.0, applies the MLFLOWALLOWPICKLEDESERIALIZATION=False security control only when the modelpath ends in .pkl, which allows a remote attacker to execute arbitrary code via a crafted MLmodel artifact...

0.00385EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 4:23 p.m.•38 views

CVE-2026-96759 orval before 8.29.0 Code Injection via operationId

orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata objects. Attackers can inject arbitrary JavaScript code through a crafted operationId in an OpenAPI specification that executes when generated hooks are called...

9.8CVSS0.00426EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/23 4:23 p.m.•38 views

CVE-2026-96758 orval @orval/core before 8.28.0 Code Injection via Form-Data

orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property names in generated template literals. Attackers can inject $... expressions into OpenAPI schema property names that execute as live interpolation when the...

9.8CVSS0.00541EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/23 4:23 p.m.•36 views

CVE-2026-96757 orval before 8.29.0 Code Injection via unescaped OpenAPI media-type

orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated code. Attackers can inject JavaScript through crafted media-type keys in OpenAPI specifications that executes when generated fetch operations or mock resolve...

9.8CVSS0.00566EPSS
SaveExploits0References8
Cvelist
Cvelist
•added 2026/09/23 4:23 p.m.•43 views

CVE-2026-96756 orval before 8.30.0 Code Injection via Factory Generation

orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default values in new Date calls. Attackers can inject arbitrary expressions through apostrophes in OpenAPI schema defaults to execute code with the privileges of the...

9.2CVSS0.00482EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/23 4:23 p.m.•37 views

CVE-2026-96755 orval @orval/effect 8.14.0 through 8.28.1 Code Injection

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressions via schema defaults containing $... syntax, which are executed at module...

9.8CVSS0.00417EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/23 4:23 p.m.•37 views

CVE-2026-96754 orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path

orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in single-quoted route literals. Attackers can craft an OpenAPI document with an apostrophe in a static path segment to inject arbitrary JavaScript code that...

9.8CVSS0.00427EPSS
SaveExploits0References7
Cvelist
Cvelist
•added 2026/09/23 4:07 p.m.•36 views

CVE-2026-96656 Plex Media Server arbitrary file write

Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol check...

8.6CVSS0.00339EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/23 4:06 p.m.•37 views

CVE-2026-96655 Plex Media Server arbitrary-host SSRF

Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter...

5.3CVSS0.00199EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/23 4:06 p.m.•38 views

CVE-2026-96654 Plex Media Server URL injection

Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters...

6.9CVSS0.00217EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/23 4:06 p.m.•36 views

CVE-2026-96652 Plex Media Server SSRF

Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination...

5.3CVSS0.00199EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/23 4:06 p.m.•38 views

CVE-2026-96651 Plex Media Server path traversal

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the...

7.1CVSS0.0041EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/23 4:04 p.m.•42 views

CVE-2026-19888 NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer

Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a required value unset, which is then dereferenced ...

7.5CVSS0.00392EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 4:04 p.m.•36 views

CVE-2026-6669 Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...

5.9CVSS0.00314EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 4:04 p.m.•34 views

CVE-2026-6668 Integer overflow causes an infinite loop in packet buffer growth in PgBouncer

Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable to terminate. Because PgBouncer serves all...

7.5CVSS0.00404EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:50 p.m.•37 views

CVE-2026-6327 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...

4.3CVSS0.00166EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:49 p.m.•33 views

CVE-2026-93769 HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

HumHub 1.18.5 is affected by a stored cross-site scripting XSS vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission adminmanageusers to inject persistent HTML/JavaScript into a Profile Field Category title...

7.2CVSS0.00283EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/23 3:49 p.m.•37 views

CVE-2026-4921 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow an administrative user to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

2.7CVSS0.00189EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:49 p.m.•35 views

CVE-2026-3626 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

5.3CVSS0.0024EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:49 p.m.•40 views

CVE-2026-19267 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to missing authentication on the Business Rules Manager commands REST endpoint CommandsResource.java:31. A local actor can invoke unauthenticated commands to cause resource exhaustionand halt business-rule management functio...

6.2CVSS0.00125EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:48 p.m.•38 views

CVE-2026-19179 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression...

8.2CVSS0.003EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:48 p.m.•37 views

CVE-2026-19087 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to achieve privilege escalation within the container due to improper privilege management...

4.4CVSS0.00093EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:47 p.m.•38 views

CVE-2026-18875 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert CWE-74 in the FTM AI agent server api.vectordb.runbooks.js:51. An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer...

7.3CVSS0.00218EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:46 p.m.•37 views

CVE-2026-18872 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

9.3CVSS0.00194EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:46 p.m.•37 views

CVE-2026-18505 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to open redirect in the PMP HostHeaderFilter HostHeaderFilter.java:151. An unauthenticated attacker can craft a request with a manipulated Host header to redirect authenticated operators to attacker-controlled sites, enablin...

5.4CVSS0.00146EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:45 p.m.•38 views

CVE-2026-18490 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint BrmRMISSLServerSocketFactory.java:95, EP8. An adjacent-network attacker can deliver a crafted...

8.8CVSS0.00253EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:44 p.m.•34 views

CVE-2026-18185 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to access sensitive information and modify system configurations due to missing authentication for a critical function...

7.3CVSS0.00263EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:43 p.m.•34 views

CVE-2026-18184 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity XXE injection flaw...

7.4CVSS0.0022EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:43 p.m.•37 views

CVE-2026-18181 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to bypass authentication and access sensitive information due to a hard-coded cryptographic key...

8.1CVSS0.00247EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:42 p.m.•38 views

CVE-2026-18180 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to SQL injection...

6.5CVSS0.00267EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 3:35 p.m.•37 views

CVE-2026-96675 alsa-lib through 1.2.16.1 Denial of Service via pcm_multi

alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices before array access. Attackers can supply a malicious ALSA configuration file with sparse bindings to trigger an out-of-bounds array read and assertion failur...

4.8CVSS0.00111EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/23 3:35 p.m.•37 views

CVE-2026-96674 alsa-lib through 1.2.16.1 Integer Overflow via Topology File

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer an...

4.8CVSS0.00115EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/23 3:35 p.m.•37 views

CVE-2026-96673 Photoview through 2.4.0 SQL Injection via album download route

Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject SQL by manipulating the albumid path segment. Attackers can supply crafted SQL expressions in the albumid parameter to extract arbitrary data from the databa...

8.7CVSS0.00416EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/23 3:35 p.m.•33 views

CVE-2026-96672 Frappe ERPNext before 16.34.1 Unauthorized Method Invocation

Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculationformula values reference whitelisted methods before passing them to frappe.call. Accounts Managers can supply arbitrary dotted Python paths to invoke non-whitelisted internal server-side methods and...

6.4CVSS0.00217EPSS
SaveExploits0References6
Cvelist
Cvelist
•added 2026/09/23 3:01 p.m.•38 views

CVE-2026-96276 Flatpak: flatpak: arbitrary write in host context via flatpak build-init

If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that...

0.00462EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/23 3:01 p.m.•39 views

CVE-2026-96275 Flatpak: flatpak: arbitrary write access as root via extra-data extraction

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extractextradata. On system installs, the write happens as root. Two issues combine: files/extra is resolved via path operations that follow symlinks, and blob nam...

8.8CVSS0.00361EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/23 2:52 p.m.•38 views

CVE-2026-96600 Isotope eCommerce through 2.9.10 SQL Injection via Backend Callbacks

Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled identifiers and administrator-supplied values directly into SQL statements. Authenticated Contao backend users with Isotope module permissions can exploit...

7CVSS0.00249EPSS
SaveExploits0References7
Cvelist
Cvelist
•added 2026/09/23 2:52 p.m.•37 views

CVE-2026-96599 Isotope eCommerce through 2.9.10 Weak Order Identifier Generation

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer...

8.2CVSS0.00375EPSS
SaveExploits0References5
Cvelist
Cvelist
•added 2026/09/23 2:41 p.m.•36 views

CVE-2026-92419 IDOR in WEBCON BPS

WEBCON BPS is vulnerable to Insecure Direct Object Reference IDOR in the /api/vacations/path endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply...

5.3CVSS0.0031EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 2:38 p.m.•39 views

CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

8.7CVSS0.00304EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 2:34 p.m.•36 views

CVE-2026-73591

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

7.5CVSS0.00256EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 2:32 p.m.•33 views

CVE-2026-92164 Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local files

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTT...

6.5CVSS0.00267EPSS
SaveExploits0References3
Cvelist
Cvelist
•added 2026/09/23 2:30 p.m.•39 views

CVE-2026-73589

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Weak Encoding for Password vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information...

6.3CVSS0.00081EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2026/09/23 2:30 p.m.•37 views

CVE-2026-73858 Solspace Freeform: Limited Twig template injection via submitted field values

Solspace Freeform plugin for Craft CMS 5.x is a super flexible form-building tool. From 5.0.0 through 5.10.13, submitted values from public Freeform forms can be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in...

5.3CVSS0.0043EPSS
SaveExploits0References4
Cvelist
Cvelist
•added 2026/09/23 2:24 p.m.•39 views

CVE-2026-73588

Dell Secure Connect Gateway SCG Policy Manager, versions prior to 5.34.00.16, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

7.4CVSS0.00246EPSS
SaveExploits0References1
Total number of security vulnerabilities398493