Lucene search
+L

380158 matches found

NVD
NVD
•added yesterday•2 views

CVE-2026-66629

Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...

7.1CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•4 views

CVE-2026-59949

yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...

6.5CVSS
SaveExploits0References3
NVD
NVD
•added yesterday•2 views

CVE-2026-63632

Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...

3.3CVSS
SaveExploits0References4
NVD
NVD
•added yesterday•1 views

CVE-2026-63639

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...

8.8CVSS
SaveExploits0References12
NVD
NVD
•added yesterday•3 views

CVE-2026-59940

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...

9.8CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•1 views

CVE-2026-61407

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...

8.8CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•2 views

CVE-2026-56684

Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...

7.5CVSS
SaveExploits0References8
NVD
NVD
•added yesterday•5 views

CVE-2026-59825

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

7.4CVSS
SaveExploits0References7
NVD
NVD
•added yesterday•4 views

CVE-2026-50187

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...

8.8CVSS0.00056EPSS
SaveExploits0References3
NVD
NVD
•added yesterday•5 views

CVE-2026-50139

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...

5.9CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•2 views

CVE-2026-50138

goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...

8.1CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•5 views

CVE-2026-45733

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...

8.3CVSS
SaveExploits0References3
NVD
NVD
•added yesterday•1 views

CVE-2026-48798

SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...

7.1CVSS
SaveExploits0References3
NVD
NVD
•added yesterday•3 views

CVE-2026-32547

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

7.1CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•3 views

CVE-2026-32474

Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...

9.9CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•2 views

CVE-2026-32549

Unauthenticated Broken Access Control in ThumbPress 6.5 versions...

7.5CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•3 views

CVE-2026-32553

Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...

7.2CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•4 views

CVE-2026-32481

Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...

7.5CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•4 views

CVE-2026-32472

Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...

7.5CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•4 views

CVE-2026-32473

Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...

7.2CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•4 views

CVE-2026-32470

Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...

9.8CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•4 views

CVE-2026-18534

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk...

7.4CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•6 views

CVE-2026-73692

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

SaveExploits0
NVD
NVD
•added yesterday•4 views

CVE-2026-50575

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...

7.7CVSS
SaveExploits0References2
NVD
NVD
•added yesterday•3 views

CVE-2026-32468

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...

7.5CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•2 views

CVE-2026-32467

Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...

6CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•5 views

CVE-2026-32444

Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...

9.9CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•3 views

CVE-2026-32333

Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...

7.1CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•5 views

CVE-2026-32464

Unauthenticated Local File Inclusion in Theme Test Drive = 2.9.1 versions...

8.1CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•3 views

CVE-2026-32463

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

9.9CVSS
SaveExploits1References1
NVD
NVD
•added yesterday•4 views

CVE-2026-32466

Subscriber SQL Injection in Gravity Forms Bookings premium = 2.1 versions...

8.5CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•3 views

CVE-2026-32465

Customer PHP Object Injection in Essential Real Estate = 5.3.3 versions...

8.8CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•5 views

CVE-2026-28567

Unauthenticated Broken Access Control in WP Sort Order = 1.3.5 versions...

7.5CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•1 views

CVE-2026-28568

Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...

7.1CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•2 views

CVE-2026-28571

Unauthenticated Broken Access Control in FormyChat = 2.15.7 versions...

7.5CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•2 views

CVE-2026-28192

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro = 7.1.67 versions...

9.6CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•1 views

CVE-2026-28570

Unauthenticated Local File Inclusion in Vavo Core = 2.3.0 versions...

8.1CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•2 views

CVE-2026-28191

Subscriber Privilege Escalation in The Grid = 2.7.9.1 versions...

8.8CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•2 views

CVE-2026-28569

Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...

7.1CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•3 views

CVE-2026-24301

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

8.8CVSS
SaveExploits0References1
NVD
NVD
•added yesterday•4 views

CVE-2026-17084

The "stringprep" module didn't process characters from RFC 3454 tables B.2 or B.3 correctly: the latest Unicode codepoint attributes were used instead of the specified Unicode 3.2.0. This behavior would cause mismatches when processing domain names using IDNA 2003 the "idna" codec and the intable...

6CVSS
SaveExploits0References5
NVD
NVD
•added yesterday•4 views

CVE-2026-75874

Sandbox escape in the Remote Settings Client component. This vulnerability was fixed in Firefox 154 and Thunderbird 154...

10CVSS
SaveExploits0References3
NVD
NVD
•added yesterday•6 views

CVE-2026-75778

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

7.5CVSS
SaveExploits0References6
NVD
NVD
•added yesterday•8 views

CVE-2026-75783

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01. Affected by this vulnerability is an unknown functionality of the file /sbin/netifd of the component DHCP blobmsg Handler. The manipulation leads to stack-based buffer overflow. The attack must be carried out from within...

9.6CVSS
SaveExploits0References6
NVD
NVD
•added yesterday•6 views

CVE-2026-74985

Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

SaveExploits0References5
NVD
NVD
•added yesterday•4 views

CVE-2026-74986

Site isolation issue in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...

SaveExploits0References5
NVD
NVD
•added yesterday•6 views

CVE-2026-74989

Internally found bugs present in Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154 and Thunderbird 154...

SaveExploits0References4
NVD
NVD
•added yesterday•5 views

CVE-2026-74990

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was...

9.8CVSS
SaveExploits0References9
NVD
NVD
•added yesterday•5 views

CVE-2026-74988

Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154,...

SaveExploits0References7
NVD
NVD
•added yesterday•6 views

CVE-2026-74987

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was...

SaveExploits0References9
Total number of security vulnerabilities380158