Threats tagged 'exploit'

724 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	–	EPSS 0.5%	CVE-2026-6815https://github.com/casdoor/casdoor · Casdoor 3.54.1 · Arbitrary File Write via Path Traversal MediumEPSS 0.5%2026-05-27Exploit-DB RSS FeedCVE-2026-6815 Casdoor 3.54.1 - Arbitrary File Write via Path Traversal EPSS 0.5%Exploit https://casdoor.org #web #exploit #linux / docker	Exploit-DB RSS Feed	2026-05-27
Medium	–		cPanel · CRLF Injection Medium2026-05-26Exploit-DB RSS Feed A CRLF (Carriage Return Line Feed) injection vulnerability has been identified in cPanel & WHM. This type of vulnerability can allow an attacker to manipulate HTTP headers or inject arbitrary headers by inserting CRLF sequences. No specific affected versions or detailed technical information are provided. There is no information about available patches or vendor advisories. The severity is assessed as medium based on the potential impact of CRLF injection vulnerabilities. Vulnerability #web #exploit	Exploit-DB RSS Feed	2026-05-26
Medium	–		https://downloads.wordpress.org/plugin/temporary-login.1.0.0.zip · Wordpress Temporary Login Plugin 1.0.0 - 'temp-login-token' Authentication Bypass to Account Takeover Medium2026-05-26Exploit-DB RSS Feed The Wordpress Temporary Login Plugin version 1.0.0 contains an authentication bypass vulnerability via the 'temp-login-token' parameter that can lead to account takeover. This vulnerability affects version 1.0.0 and earlier. No official patch or remediation information is provided. The severity is assessed as medium based on the potential for unauthorized account access. Vulnerability https://wordpress.org #web #exploit #linux	Exploit-DB RSS Feed	2026-05-26
Medium	–		https://archive.apache.org/dist/httpd/httpd-2.4.66.tar.gz · Apache HTTP Server 2.4.66 - 'mod_http2' Double-Free Denial of Service Medium2026-05-26Exploit-DB RSS Feed Apache HTTP Server version 2.4.66 contains a double-free vulnerability in the 'mod_http2' module that can lead to a denial of service condition. This vulnerability allows an attacker to cause the server to crash by triggering improper memory management in the HTTP/2 module. The issue affects specifically version 2.4.66 and has been classified with medium severity. No official patch or remediation details are provided in the available data. There are no known exploits in the wild at this time. Vulnerability https://httpd.apache.org #web #exploit #debian / ubuntu	Exploit-DB RSS Feed	2026-05-26
Critical	–		https://github.com/getgrav/grav · Grav CMS 2.0.0-beta.2 - Remote Code Execution Critical2026-05-26Exploit-DB RSS Feed Grav CMS 2.0.0-beta.2 - Remote Code Execution Exploit https://getgrav.org #remote #web #exploit	Exploit-DB RSS Feed	2026-05-26
High	–		Linux Kernel 6.8 · Local Privilege Escalation High2026-05-26Exploit-DB RSS Feed Linux Kernel 6.8 - Local Privilege Escalation Exploit #linux #local #exploit	Exploit-DB RSS Feed	2026-05-26
Medium	–		https://www.dlink.com · D-Link DSL2600U - 'rom-0' Admin Password Disclosure Medium2026-05-26Exploit-DB RSS Feed D-Link DSL2600U - 'rom-0' Admin Password Disclosure Exploit #exploit #ubuntu	Exploit-DB RSS Feed	2026-05-26
Critical	9.4		Can someone explain to a noob like me what the implications of this exploit are? Critical9.42026-05-25Reddit Cybersecurity A critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS versions 3.24.0 through 6.19.0 is actively exploited in a large-scale campaign known as ClickFix. Attackers exploit this flaw to steal admin API keys, allowing them to inject malicious JavaScript into website articles. This JavaScript then fingerprints visitors and serves a social engineering lure prompting victims to execute commands that install malware. The campaign has impacted over 700 domains, including major universities and companies. A patch was released in version 6.19. Vulnerability #cybersecurity #reddit #exploit	Reddit Cybersecurity	2026-05-25
Not rated	–		Drupal Core SQL injection flaw actively exploited less than 48 hours after patch. 15,000 attack attempts already recorded across 6,000 sites 2026-05-23Reddit Cybersecurity A SQL injection vulnerability in Drupal Core was patched recently, but active exploitation attempts began less than 48 hours after the patch release. Approximately 15,000 attack attempts have been recorded targeting around 6,000 sites. The vulnerability allows attackers to perform SQL injection attacks, potentially compromising affected Drupal installations. The patch has been released, but rapid exploitation attempts highlight the urgency for site administrators to apply the update promptly. Campaign #cybersecurity #reddit #exploit	Reddit Cybersecurity	2026-05-23
High	–		Another working Linux LPE exploit is out. How are teams treating local-only bugs now? High2026-05-21Reddit Cybersecurity A new working local privilege escalation (LPE) exploit targeting Linux systems has been publicly disclosed. The exploit is reported on a Reddit cybersecurity forum and references an external source discussing the vulnerability affecting Arch Linux. There is no detailed technical information or affected versions provided. No official patch or vendor advisory is currently available. The exploit is local-only and does not appear to be actively exploited in the wild at this time. Vulnerability #cybersecurity #reddit #exploit	Reddit Cybersecurity	2026-05-21
Medium	–		https://github.com/frangoteam/FUXA · FUXA 1.2.9 · RCE Medium2026-05-21Exploit-DB RSS Feed FUXA 1.2.9 - RCE Exploit #web #rce #exploit	Exploit-DB RSS Feed	2026-05-21
Medium	–		solaredge - (CSRF-OOB-Injection) Medium2026-05-21Exploit-DB RSS Feed solaredge - (CSRF-OOB-Injection) Exploit SolarEdge Technologies #web #csrf #exploit	Exploit-DB RSS Feed	2026-05-21
Medium	–		https://support.lenovo.com/es/es/solutions/legion_space · Lenovo LegionSpace 1.7.11.2 · 'DAService' Unquoted Service Path Medium2026-05-21Exploit-DB RSS Feed Lenovo LegionSpace 1.7.11.2 - 'DAService' Unquoted Service Path Exploit #local #exploit	Exploit-DB RSS Feed	2026-05-21
Medium	–		https://github.com/BookStackApp/BookStack · BookStack 25.12.1 · Denial of Service Medium2026-05-21Exploit-DB RSS Feed BookStack 25.12.1 - Denial of Service Exploit https://www.bookstackapp.com #web #exploit #bookstack v25.12 (docker) + php 8.3 + mysql 8.0	Exploit-DB RSS Feed	2026-05-21
Medium	–		https://github.com/cockpit-project/cockpit · Cockpit 359 · RCE Medium2026-05-21Exploit-DB RSS Feed Cockpit 359 - RCE Exploit https://cockpit-project.org #web #rce #exploit	Exploit-DB RSS Feed	2026-05-21
Critical	–		Remote Sunrise Helper for Windows 2026.14 · Remote Code Execution Critical2026-05-15Exploit-DB RSS Feed Remote Sunrise Helper for Windows 2026.14 - Remote Code Execution Exploit #windows #remote #local	Exploit-DB RSS Feed	2026-05-15
Medium	–		Remote Sunrise Helper for Windows 2026.14 · Unauthenticated File/Directory Listing Medium2026-05-15Exploit-DB RSS Feed Remote Sunrise Helper for Windows 2026.14 - Unauthenticated File/Directory Listing Exploit #windows #remote #local	Exploit-DB RSS Feed	2026-05-15
Medium	–		Windows Snipping Tool · NTLMv2 Hash Hijack Medium2026-05-15Exploit-DB RSS Feed Windows Snipping Tool - NTLMv2 Hash Hijack Exploit #windows #local #exploit	Exploit-DB RSS Feed	2026-05-15
Medium	–		PJPROJECT 2.16 · Heap Bufferoverflow Medium2026-05-14Exploit-DB RSS Feed PJPROJECT 2.16 - Heap Bufferoverflow Exploit #web #exploit	Exploit-DB RSS Feed	2026-05-14
Medium	–		ePati Antikor NGFW 2.0.1301 · Authentication Bypass Medium2026-05-14Exploit-DB RSS Feed ePati Antikor NGFW 2.0.1301 - Authentication Bypass Exploit #web #exploit	Exploit-DB RSS Feed	2026-05-14

Page 8 of 37