Lucene search
+L

398464 matches found

NVD
NVD
•added 2026/09/25 5:17 p.m.•12 views

CVE-2026-97877

A vulnerability was determined in zhistaredu StarTraining up to 3.8.1. This issue affects the function UserLoginService.createToken of the file application.yml of the component JWT Token Handler. This manipulation of the argument userid/companyid causes use of hard-coded password. The attack is...

7.5CVSS0.00452EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•13 views

CVE-2026-97878

A vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Impacted is the function anonymous of the file /druid/index.html of the component Druid Console. Such manipulation leads to missing authentication. The attack may be performed from remote. The exploit is publicly available and...

7.5CVSS0.00627EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•9 views

CVE-2026-97871

A vulnerability has been found in Zhonglun CloudPos up to 3.0.1.76. This issue affects the function OpenLocalBrowser of the file ZlPos/ZlPos/Bizlogic/JSBridge.cs of the component JSBridge. Such manipulation of the argument url leads to code injection. The attack can be executed remotely. The...

7.5CVSS0.00518EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-95834

Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because dragremotefiledata in kitty/dnd.c holds a DragRemoteItem pointer into an arra...

4.6CVSS0.00127EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-95835

Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handleremoteaskpass in kitty/window.py opens the POSIX shared memory...

5.6CVSS0.001EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-93365

Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role to read the full content of private drafts and scheduled posts belonging to any other user, including administrators, by exploiting the content-get-list AJAX...

7.1CVSS0.00209EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/25 5:17 p.m.•10 views

CVE-2026-93363

The @payloadcms/storage-vercel-blob storage adapter for Payload contains an improper access control vulnerability that allows authenticated users to bypass collection-level permissions by accessing the client-upload route directly. Attackers can upload files through the client-upload endpoint...

5.3CVSS0.00177EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/25 5:17 p.m.•13 views

CVE-2026-93364

Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged page fields reserved for administrators by injecting reserved parameters into a content save request. Attackers can submit reserved fields such as type and...

5.3CVSS0.00186EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/25 5:17 p.m.•10 views

CVE-2026-94445

A malicious txtar could escape the intended execution context and force arbitrary writes to the playground host's trusted filesystem. Disjointly, one of the three possible paths to invoke go vet on the playground host did not correctly restrict the execution environment. This permitted a Go proce...

8.8CVSS0.00363EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-91837

A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters special characters that can execute...

7.8CVSS0.00136EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•9 views

CVE-2026-89032

BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated users to read other tenants' cached responses by exploiting a metadata key mismatch between getsemanticcachetenantscope and getmetadatavariablename. Attackers...

8.7CVSS0.00272EPSS
SaveExploits0References4
NVD
NVD
•added 2026/09/25 5:17 p.m.•10 views

CVE-2026-67421

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ Management rendered an AMQP authorization-error reason containing an attacker-controlled queue name as HTML when the OAuth management UI was enabled. Exploitation requires an...

4.5CVSS0.00302EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-80432

Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the drop, because dropenqueuerequest in kitty/dnd.c...

6CVSS0.00123EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-67419

RabbitMQ is a messaging and streaming broker. Prior to 4.3.5, an authenticated user who can bind a queue to a topic exchange and publish to it can use consecutive segments in a binding key to make both topic matchers revisit the same trie-node and routing-key-suffix states without memoization. Th...

7.1CVSS0.0033EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•10 views

CVE-2026-67415

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to th...

5.9CVSS0.00353EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•12 views

CVE-2026-67410

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.3.3 and 4.2.9, OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CWE-200. when OAuth2 authentication is enabled for the RabbitMQ Management UI and the configured flow, IDP use a client secret, the oauthclientsecre...

8.2CVSS0.00401EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-67413

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.23, 4.1.14, 4.2.9, and 4.3.3, the optional rabbitmqjmstopicexchange plugin's x-jms-topic exchange accepted a client-controlled rjmserlangselector binding expression whose LIKE evaluator expanded percent and underscore wildcards in...

6CVSS0.003EPSS
SaveExploits0References7
NVD
NVD
•added 2026/09/25 5:17 p.m.•12 views

CVE-2026-67420

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5, RabbitMQ OAuth credential refresh retains revoked runtime tags. when an existing AMQP connection refreshes from an OAuth token that grants the impersonator tag to a valid same-username toke...

2.3CVSS0.00238EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-67411

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSocket behind a trusted PROXY Protocol frontend could lose the proxy-derived client address before the MQTT authentication path checked loopbackusers, causing th...

6CVSS0.00393EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-67412

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ skips vhost authorization allowing cross-vhost message access. what the bug lets you do. A policymaker on one vhost reads and drains messages out of another...

6CVSS0.00302EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•10 views

CVE-2026-67407

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3 and 4.2.9 and 4.1.14 and 4.0.23, Incomplete fix for CVE-2026-44838: escaperegexchar/1 does not escape -, leaving room for an MQTT topic permission bypass. the CVE-2026-44838 fix made expandtopicpermission/2 escape regex...

5.1CVSS0.00253EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•10 views

CVE-2026-67241

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, AMQP 1.0 management exchange.declare skips alternate-exchange permission check. pUT /exchanges/:name lines 192-240 checks only configure on the declared exchange and passes XArgs straight to rabbitexchange:declare/7. ...

4.8CVSS0.00347EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•9 views

CVE-2026-67239

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18 and 4.0.23 and 4.1.14 and 4.2.9 and 4.3.3, Stored XSS via TLS peer-certificate DN in stream-management UI sibling of V-11. lines 102/106/110 render peercertsubject / peercertissuer with raw and no fmtstring. RFC4514...

7.6CVSS0.00267EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•6 views

CVE-2026-67242

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, OAuth2 isintegerExp guard skips token-expiry checks for float exp. validatetokenexpiry/1 lines 208-214 and expirytimestamp/1 138-144 both guard with 'when isintegerExp' and fall through to ok/never for float values...

6.3CVSS0.00462EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•9 views

CVE-2026-67406

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, Shovel does not format state logged by the crash reporter and can leave unencrypted credentials in a crash dump file. the shovel worker genserver processes does not implement the formatstatus/2...

4.6CVSS0.00278EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-67409

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252. the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response...

8.2CVSS0.0049EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•8 views

CVE-2026-67408

RabbitMQ is a messaging and streaming broker. From 4.1.0 until 4.3.3, 4.2.9, and 4.1.11, Stream Management Super-Stream Binding Keys Allocation Allows Low-Privilege Node Denial of Service. rabbitMQ 4.3.1 with rabbitmqstreammanagement enabled accepts PUT /api/stream/super-streams/vhost/name reques...

7.1CVSS0.00341EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•8 views

CVE-2026-67237

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or accesstoken cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the...

7.5CVSS0.00484EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•8 views

CVE-2026-67226

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags list. settags/2 maps rabbitdatacoercion:toatom/1 over the user's tags list. The 20 MB management body limit fits 3-4M short tag strings. An administrator can...

6.9CVSS0.00353EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•8 views

CVE-2026-67234

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, getauthmechanism/1 used termtobinary/1 on the strictauthmechanism or preferredauthmechanism atom when clearing the corresponding cookie, producing a non-ASCII cookie name that violates RFC 6265 and can prevent the...

2.3CVSS0.00561EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•7 views

CVE-2026-67227

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-parameter :name. resourceexists/2 and the PUT/DELETE handlers call rabbitdatacoercion:toatom/1 on the :name URL path segment. toatom/1 uses binarytoatom/2 unsafe...

5.9CVSS0.00288EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•9 views

CVE-2026-67230

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced neither maxframesize nor logintimeout before authentication, allowing an unauthenticated client to keep a connection alive with a slow stream of small frame...

6.3CVSS0.0047EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•7 views

CVE-2026-67222

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, mechanisms/1 applied listtoatom/1 to every colon-delimited token in an attacker-controlled authmechanism value, permanently consuming Erlang VM atoms and allowing the node to be crashed with a larg...

5.9CVSS0.0031EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/25 5:17 p.m.•6 views

CVE-2026-66078

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser. POST /api/users/bulk-delete...

2.1CVSS0.00356EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•9 views

CVE-2026-67225

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax value negotiated during the Tune handshake but did not compare it with an inbound frame's declared length before buffering the frame. With the stream plugin...

6.3CVSS0.00324EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/25 5:17 p.m.•8 views

CVE-2026-66073

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...

6CVSS0.00331EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•8 views

CVE-2026-67223

RabbitMQ is a messaging and streaming broker. The advisory establishes affected 3.13, 4.0, 4.1, 4.2, and 4.3 maintenance lines but contains conflicting first-fixed versions for the 3.13, 4.0, and 4.1 lines. fill/2 substitutes $username into userdnpattern without RFC 4514 DN escaping, allowing a...

6.3CVSS0.0035EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•8 views

CVE-2026-56729

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, when multiple KB categories have different editor roles assigned, a user with knowledgebase.editor in one category can see answer titles and updatedat timestamps from categories they do not have editor access to ,...

2.1CVSS0.00377EPSS
SaveExploits0References4
NVD
NVD
•added 2026/09/25 5:17 p.m.•9 views

CVE-2026-56723

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal ticket articles through the article listing API. However, the same customer can directly request an attachment belonging to an internal article via the attachme...

7.1CVSS0.00275EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•9 views

CVE-2026-61837

RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes full binding topology to any authenticated AMQP user without resource/management permission checks. the AMQP 1.0 HTTP-over-AMQP management endpoint GET...

6.3CVSS0.00246EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•7 views

CVE-2026-66071

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 JWT tag: scope values. extractscopes/1 parses scopes of the form .tag: and calls rabbitdatacoercion:toatom to convert to a tag atom. The token signature is...

6CVSS0.00342EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 5:17 p.m.•7 views

CVE-2026-56724

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, summary An issue with permission checks in the knowledge base management area has been identified. Under certain conditions, data validation for linked items was not fully enforced. This could have allowed users...

7.1CVSS0.00274EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 5:17 p.m.•9 views

CVE-2026-18320

Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attribute rule. This configuration fails to remove script-capable attributes such as event handlers e.g., 'onload', 'onerror'. An attacker could supply a document...

6.1CVSS0.00157EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/25 5:17 p.m.•8 views

CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

6.1CVSS0.00157EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/25 5:17 p.m.•8 views

CVE-2026-100237

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension allows Stored XSS. This issue affects Mediawiki - Thanks Extension: from before 1.43.10/1.45.5/1.46.1...

6.1CVSS0.00155EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/25 5:17 p.m.•6 views

CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

6.1CVSS0.00189EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/25 5:17 p.m.•11 views

CVE-2026-100248

The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of currentadmin...

8.4CVSS0.00405EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/25 4:17 p.m.•9 views

CVE-2026-97868

A security vulnerability has been detected in sheshbabu zen up to 1.5.0. Affected by this issue is the function dangerouslySetInnerHTML of the file features/notes/NotesEditor.jsx of the component Note Editor. The manipulation leads to cross site scripting. The attack may be initiated remotely. Th...

5.1CVSS0.00191EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/25 4:17 p.m.•10 views

CVE-2026-97869

A flaw has been found in langchain4j up to 1.5.3-beta10/1.11.10-beta18/1.18.1-beta27. This vulnerability affects the function AgenticScopeSerializer.fromJson of the file AgenticScopeJsonSerializationIT.java of the component LangChain4j-agentic. This manipulation causes deserialization. Remote...

4.3CVSS0.00375EPSS
SaveExploits0References8
NVD
NVD
•added 2026/09/25 4:17 p.m.•10 views

CVE-2026-97469

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash function and collects seed, hashoutput pairs to perform an offline brute-force attack and deduce the salt. A masked role can run a RESTRICTED function when the call is placed insi...

4.3CVSS0.00118EPSS
SaveExploits0References1
Total number of security vulnerabilities398464