Lucene search
+L

398947 matches found

NVD
NVD
•added 2026/09/23 8:17 p.m.•11 views

CVE-2026-84718

A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts the client-supplied X-Forwarded-For header as the request's client IP without verifying that it originated from a trusted proxy, and selects the leftmost...

4.3CVSS0.00136EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/23 8:17 p.m.•13 views

CVE-2026-84719

A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unifiedjobtemplate, and credentials of each cloned node and fails to check the instancegroups and executionenvironment...

9.9CVSS0.00428EPSS
SaveExploits0References7
NVD
NVD
•added 2026/09/23 8:17 p.m.•12 views

CVE-2026-84720

A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestorartifacts database column, which stores the raw merged setstats artifacts propagated between workflow nodes, is not wrapped in preventsearch and is therefore accepted for arbitrary field lookups...

6.5CVSS0.00271EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/23 8:17 p.m.•13 views

CVE-2026-84721

A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend. The email backend passes the user-supplied SMTP host and port from a notification template directly to the SMTP client without validating that the target is not an...

6.4CVSS0.00171EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/23 8:17 p.m.•9 views

CVE-2026-84683

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The HTML view of job, ad hoc command, project update, and inventory update standard output escapes HTML metacharacters but does not remove ANSI terminal escape sequences before conversion to HTML. An ANSI OSC 8...

8.7CVSS0.00256EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/23 8:17 p.m.•10 views

CVE-2026-84706

A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list an ANSIBLE prefix check plus a fixed ENVBLOCKLIST that omits process-hijacking loader variables such as BASHENV, ENV,...

7.6CVSS0.00306EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/23 8:17 p.m.•11 views

CVE-2026-84691

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4XX errors is an administrator-controlled Python format-string template that is rendered with a live user object as an argument. Because Python string...

8.7CVSS0.002EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/23 8:17 p.m.•11 views

CVE-2026-84712

A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ ApiV2PingView, AllowAny over-serializes RBAC-gated automation-mesh data into its anonymous response, exposing the full instance inventory node hostnames, node types, UUIDs, heartbeats,...

5.3CVSS0.00337EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/23 8:17 p.m.•10 views

CVE-2026-84713

A flaw was found in the automation-controller notification subsystem. Although NotificationTemplate.notification configuration is protected from API filtering, its recipient value is copied in clear text into the unprotected Notification.recipients field on every send. Because the credential-type...

6.5CVSS0.00311EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/23 8:17 p.m.•12 views

CVE-2026-82405

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes replacement of a target account's permissions by checking attacker-controlled vmInput.RecipientAddr instead of authenticated vmInput.CallerAddr. An...

8.7CVSS0.0026EPSS
SaveExploits0References4
NVD
NVD
•added 2026/09/23 8:17 p.m.•12 views

CVE-2026-82406

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/market.go Buy does not check IsClaimed before accepting a bid. A seller can use the Claim seller-accept branch to settle a resting-bid auction while leaving the...

7.1CVSS0.00341EPSS
SaveExploits0References4
NVD
NVD
•added 2026/09/23 8:17 p.m.•14 views

CVE-2026-82407

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the runtime validator update path accept a submitted BLSPublicKey without curve, prime-order subgroup, or nonzero validation. When a validator with a malformed ke...

7CVSS0.00434EPSS
SaveExploits0References4
NVD
NVD
•added 2026/09/23 8:17 p.m.•13 views

CVE-2026-82409

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts val...

8.4CVSS0.00268EPSS
SaveExploits0References4
NVD
NVD
•added 2026/09/23 8:17 p.m.•15 views

CVE-2026-75884

A flaw was found in AWX. The container group podspecoverride field uses an incomplete blocklist that only restricts automountServiceAccountToken, allowing injection of initContainers, serviceAccountName overrides, and projected service account token volumes. An AAP platform administrator can...

9.1CVSS0.00409EPSS
SaveExploits0References7
NVD
NVD
•added 2026/09/23 8:17 p.m.•8 views

CVE-2026-66076

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, isauthorized/2 calls rabbitmgmtutil:isauthorized/2, which checks only the management tag, instead of isauthorizedvhost/2. The /api/queues/quorum/:vhost/:queue/status handler reads the vhost...

2.3CVSS0.00265EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/23 8:17 p.m.•11 views

CVE-2026-66079

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parsearrayprimitive/2 for constructor 0x45 list0 returns an element with byte-width B = 0. The enclosing array32 parser at line 148 reads a 4-byte Count from the wire and loops Count times consumin...

8.2CVSS0.0032EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/23 8:17 p.m.•9 views

CVE-2026-67238

RabbitMQ is a messaging and streaming broker. Prior to versions 4.2.7 and 4.3.1, rabbitpidcodec:decomposefrombinary/1 parses a caller-supplied ETF-encoded binary and calls binarytoatomNode, utf8 on the node-name field. It is reached from rabbitvolatilequeue:pidfromname/2, which is invoked for any...

7.1CVSS0.0033EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/23 8:17 p.m.•12 views

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

8.7CVSS0.00354EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 8:17 p.m.•12 views

CVE-2026-68490

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

8.2CVSS0.00132EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 8:17 p.m.•12 views

CVE-2026-66070

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, matchorigin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so the response echoed the attacker's origin together with...

7.6CVSS0.00413EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/23 7:19 p.m.•9 views

CVE-2026-96770

All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against...

9.3CVSS0.00254EPSS
SaveExploits0References5
NVD
NVD
•added 2026/09/23 7:19 p.m.•9 views

CVE-2026-96872

Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0...

6.3CVSS0.00226EPSS
SaveExploits0References2
NVD
NVD
•added 2026/09/23 7:19 p.m.•9 views

CVE-2026-96549

A vulnerability has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown code of the file ssmpro/src/main/java/cn/sfturing/service/impl/CommonUserServiceImpl.java. Such manipulation leads to cleartext storage of sensitive information...

4.8CVSS0.00083EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/23 7:19 p.m.•10 views

CVE-2026-96548

A flaw has been found in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssmpro/src/main/resources/jdbc.properties. This manipulation causes hard-coded credentials. It is possible to initiate the attack remotely. The attack's complexity ...

6.3CVSS0.00261EPSS
SaveExploits0References6
NVD
NVD
•added 2026/09/23 7:19 p.m.•11 views

CVE-2026-96546

A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately...

2.5CVSS0.00115EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-96541

A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authentication handshake deadline is enforced. By exhausting the global...

7.5CVSS0.00794EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/23 7:19 p.m.•11 views

CVE-2026-96545

An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents in...

4.4CVSS0.00178EPSS
SaveExploits0References3
NVD
NVD
•added 2026/09/23 7:19 p.m.•7 views

CVE-2026-95600

Unauthenticated Sensitive Data Exposure in TrustedLogin Connector = 2.0.3 versions...

5.3CVSS0.00251EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•6 views

CVE-2026-95602

Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1...

6.5CVSS0.00276EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-95601

Unauthenticated SQL Injection in Product Filter by WBW = 3.1.7 versions...

9.3CVSS0.00247EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•9 views

CVE-2026-95603

Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...

7.2CVSS0.00397EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•7 views

CVE-2026-95604

Unauthenticated Broken Access Control in Loops & Logic = 4.2.4 versions...

7.5CVSS0.00332EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-95529

Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...

7.1CVSS0.0018EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•7 views

CVE-2026-95530

Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...

6.5CVSS0.00211EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•6 views

CVE-2026-95590

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

7.1CVSS0.00286EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-95592

Unauthenticated Insecure Direct Object References IDOR in Team = 6.0.0 versions...

5.3CVSS0.00238EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-95528

Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...

7.1CVSS0.0018EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-95586

Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...

6.5CVSS0.00161EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•7 views

CVE-2026-95593

Editor SQL Injection in Ultimeter = 3.0.8 versions...

7.6CVSS0.00291EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-95514

Unauthenticated Bypass Vulnerability in Netgsm = 2.10.0 versions...

5.3CVSS0.0025EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•6 views

CVE-2026-95524

Unauthenticated Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

5.3CVSS0.0025EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•7 views

CVE-2026-95525

Subscriber Arbitrary File Deletion in WP User Frontend = 4.3.11 versions...

6.5CVSS0.0047EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•7 views

CVE-2026-95527

Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...

6.5CVSS0.00253EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•6 views

CVE-2026-95515

Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...

7.1CVSS0.0018EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-95522

Shop manager SQL Injection in Easy Digital Downloads = 3.7.0 versions...

7.6CVSS0.00291EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-95523

Subscriber Bypass Vulnerability in WP User Frontend = 4.3.11 versions...

6.5CVSS0.00335EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•7 views

CVE-2026-94682

Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...

6.5CVSS0.00171EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•6 views

CVE-2026-95513

Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita = 4.6.0 versions...

7.5CVSS0.00263EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•9 views

CVE-2026-94679

Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...

5.4CVSS0.0023EPSS
SaveExploits0References1
NVD
NVD
•added 2026/09/23 7:19 p.m.•8 views

CVE-2026-94671

Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...

6.5CVSS0.00171EPSS
SaveExploits0References1
Total number of security vulnerabilities398947