Lucene search
+L

401090 matches found

CVE
CVE
added 2026/09/19 9:45 p.m.20 views

CVE-2026-93954

grimmory-tools grimmory (up to 3.3.3/3.4.1) contains an incorrect authorization flaw in the Settings API Endpoint . The vulnerable function is AppSettingController.getAppSettings in backend/src/main/java/org/booklore/controller/AppSettingController.java. The issue arises because PR #2558 moved th...

5.3CVSS0.00378EPSS
SaveExploits0References8
CVE
CVE
added 2026/09/19 5:00 p.m.26 views

CVE-2026-82672

CVE-2026-82672 is an HTTP Request/Response Smuggling vulnerability in the Elixir mint HTTP/1 client library (versions 0.1.0 through before 1.10.1). The root cause lies in Mint.HTTP1.Parse.chunk_size/1, which stops parsing a chunked response's chunk-size line at the first non-hexadecimal byte and ...

6.3CVSS0.00301EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/19 3:15 p.m.25 views

CVE-2026-82560

Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width. Each =over adds its indent to the margin, which wrap subtracts from the output width to get the space available for text. When that space...

7.5CVSS0.00209EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/19 2:11 p.m.39 views

CVE-2026-94001

A flaw in the Admin REST API of Keycloak (an open-source identity and access management solution) allows a delegated administrator to bypass fine-grained reset-password permissions. The endpoint used for deleting user credentials fails to properly check these permissions, enabling an administrato...

6.5CVSS0.00252EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 2:09 p.m.26 views

CVE-2026-94000

A flaw in the Admin REST API of Keycloak (open-source identity and access management) exists in the group-membership endpoints . The system fails to check whether a group grants administrative privileges before allowing a user to be added to it. This allows a delegated administrator holding the m...

6.6CVSS0.00242EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 2:09 p.m.29 views

CVE-2026-93999

Keycloak's OIDC token refresh process contains a flaw where the server restores requested audiences from stored client IDs but fails to verify whether the target audience client is still enabled before issuing a new access token. This allows an application holding an existing refresh token to con...

4.2CVSS0.00147EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 11:53 a.m.25 views

CVE-2026-93987

rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. The newVolume() function in cmd/serve/docker/volume.go constructs a mountpoint via filepath.Join(drv.root, name) using the attacker-controlled name field from a Docker VolumeDriv...

4.6CVSS0.00105EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 11:53 a.m.25 views

CVE-2026-93986

rclone before 1.75.1 contains a path traversal vulnerability in how it handles names from server and third-party listing responses. The tool fails to confine object names to the listed directory, allowing attackers to craft names containing forward slashes and parent directory references (e.g., ....

3.1CVSS0.002EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 11:53 a.m.62 views

CVE-2026-93985

OpenPanel js-runtime through commit bad75bdd is affected by a sandbox escape in its JavaScript webhook template validator . The validator fails to block computed member access to constructor chains, allowing attackers with project write access to craft webhook templates using computed property no...

9.9CVSS0.00476EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 11:53 a.m.20 views

CVE-2026-93984

OpenPanel tracking API, through commit bad75bddc74d12d36cfb843f4531d3b830a8d994 , fails to verify the client secret cryptographic hash before authorizing revenue events and bot filtering. An attacker possessing only a public client ID can supply arbitrary dummy secrets to inject forged revenue me...

6.9CVSS0.00204EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 11:53 a.m.23 views

CVE-2026-93983

OpenPanel (through commit bad75bdd ) contains a SQL injection vulnerability in its ClickHouse query layer. The root cause is a failure to escape property keys used in ClickHouse SQL queries, allowing an authenticated user to inject boolean SQL terms via crafted filter names. This enables attacker...

5.3CVSS0.00199EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 11:53 a.m.25 views

CVE-2026-93981

hono/jsx (a server-side rendering component of the hono web framework) before version 4.13.7 fails to HTML-escape plain strings in several rendering paths: child or fallback of Suspense , string child of ErrorBoundary alongside an async sibling, the single child of Context.Provider , and the root...

4.7CVSS0.00142EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 11:53 a.m.27 views

CVE-2026-93982

OpenPanel (through commit bad75bdd ) writes Model Context Protocol (MCP) authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP...

4.8CVSS0.00115EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/19 10:45 a.m.38 views

CVE-2026-78030

Perl DBI versions before 1.653 are vulnerable to arbitrary module loading (and thus code execution) via the dbm_type and dbm_mldbm connect attributes in DBD::DBM . The root cause is that these attributes are passed to Perl's require without validation; because require treats path-shaped strings a...

9.8CVSS0.00725EPSS
SaveExploits0References4
CVE
CVE
added 2026/09/19 8:30 a.m.27 views

CVE-2026-93742

Totolink A3002MU routers running firmware Hh-B20211125.1046 are vulnerable to a command injection flaw in the formWsc function located in the file /boafrm/formWsc . The root cause is improper handling of the localPin argument, allowing a remote attacker to inject arbitrary commands. The vulnerabi...

9.9CVSS0.0188EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/19 8:27 a.m.22 views

CVE-2026-9858

Partial Shipment for Woocommerce (WordPress plugin, versions ≤ 3.4) is vulnerable to Missing Authorization via the wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shipped AJAX actions. The root cause is that the AJAX handlers in woocommerce-partial-shipment.php (lines 228, 263, 291...

4.3CVSS0.00215EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/19 8:27 a.m.21 views

CVE-2026-1256

YS LeadGen – Popups, Opt-ins & Lead Capture for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.1.4 due to missing capability checks on popup management AJAX endpoints. Authenticated users with Subscriber-level or higher access can create arbitra...

6.4CVSS0.00204EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/19 8:27 a.m.40 views

CVE-2026-76579

LiteSpeed Cache for WordPress (all versions up to and including 7.9 ) contains a Reflected Cross-Site Scripting vulnerability in the ESI (esi) parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts by supplying a validly sign...

4.7CVSS0.0023EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/19 8:27 a.m.22 views

CVE-2026-9613

CVE-2026-9613 affects the Datalogics Ecommerce Delivery WordPress plugin in all versions up to and including 2.6.65 . The root cause is improper authorization verification in multiple AJAX actions (datalogics_create_shipping / datalogics_cancel_shipping), allowing authenticated users with subscri...

4.3CVSS0.00343EPSS
SaveExploits0References18
CVE
CVE
added 2026/09/19 8:27 a.m.22 views

CVE-2026-1255

CVE-2026-1255 affects the YS LeadGen WordPress plugin (Popups, Opt-ins & Lead Capture) in all versions up to and including 2.1.4 . The vulnerability is an unauthenticated information disclosure in the ysleadgen_get_captured_data AJAX action, which is accessible without authentication. This allows...

7.5CVSS0.00295EPSS
SaveExploits0References3
Rows per page
Query Builder