7334783 matches found
CVE-2026-107844 Contao: Path traversal in the images controller
Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the user-controlled path parameter to the configured image target directory with Path::join but does not use Path::isBasePath to verify that the canonical path remains inside that directory. An...
CVE-2026-107843 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check
Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compile enters its follow-up registration branch on any POST to a page containing the registration module without verifying FORMSUBMIT or the preceding captcha result. resendActivationMail can then invok...
CVE-2026-75351
OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service...
CVE-2026-75352
OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service...
CVE-2026-75353
OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remtoe attacker to cause a denial of service...
CVE-2026-78835
Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials...
Exploit for CVE-2026-21589
CVE-2026-21589 — Atlassian Arbitrary File Read An unauthentic...
CVE-2026-107842 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...
CVE-2026-107842 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.indexprotected is changed from enabled to disabled. Authorization metadata is stored per row...
CVE-2026-107822
A flaw was found in MariaDB. An issue in the Access Control List ACL cache causes identical privilege cache keys to be generated when a role and a local user share the same name. An attacker with user creation privileges can exploit this key collision by creating a matching account, allowing them...
CVE-2026-107821
A flaw was found in MariaDB. An attacker able to place a crafted table format FRM metadata file into the database data directory can exploit insufficient validation of metadata boundaries and field counts when the server opens the file. This could lead to out-of-bounds memory operations,...
CVE-2026-107819
A flaw was found in MariaDB Connector/C. During automatic Transport Layer Security TLS connection setup, the library verifies certificate trust but fails to confirm that the server hostname matches the certificate before switching authentication methods. An active man-in-the-middle MitM attacker...
CVE-2026-107817
A flaw was found in the mysqljson plugin in MariaDB. The plugin incorrectly assumes that imported MySQL tables contain valid binary JavaScript Object Notation JSON data. An attacker can exploit this issue by supplying a specially crafted MySQL table containing invalid JSON data, triggering an...
CVE-2026-106410
A missing authorization flaw was found in the Permissions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/517801814...
CVE-2026-106409
An incorrect reference resolution flaw was found in the WebAppInstalls component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/559097675...
CVE-2026-106404
An incorrect authorization flaw was found in the FontAccess component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553150261...
CVE-2026-106400
A clickjacking flaw was found in the Messages component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/518108937...
CVE-2026-106395
An uninitialized resource flaw was found in the Dawn component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553121488...