387841 matches found
EUVD-2026-98003
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the...
CVE-2026-96119
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application...
PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms
A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the pcre2compile32 function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denia...
pcre2: PCRE2: Out-of-bounds write via large pattern input
A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2patternconvert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability...
SUSE SLED15 / SLES15 Security Update : python3-paramiko (SUSE-SU-2026:4618-1)
The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4618-1 advisory. This update for python3-paramiko fixes the following issue: - CVE-2026-44405: data integrity compromise due to allowed...
MiracleLinux 8 : ruby:2.5 (AXSA:2026-2035:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2035:01 advisory. resolv: resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses CVE-2026-80212 rubygem-mongo: MongoDB Ruby Driver:...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libpng vulnerability (USN-8899-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8899-1 advisory. Ze Sheng discovered that libpng incorrectly handled certain compressed data chunks in PNG files. An...
PT-2026-112450
Name of the Vulnerable Software and Affected Versions Windows Sensor Data Service affected versions not specified Description A heap-based buffer overflow occurs in the Windows Sensor Data Service. This issue allows an authorized attacker to elevate privileges locally on the system. A heap-based...
CVE-2026-110036: Integer Overflow or Wraparound
A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service DoS by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application...
7-Zip < 26.02 XZ Heap Buffer Overflow RCE (ZDI-26-444)
The version of 7-Zip installed on the remote host is prior to 26.02. It is, therefore, affected by a remote code execution vulnerability as referenced in the ZDI-26-444 advisory. - This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User...
PT-2026-111517
Name of the Vulnerable Software and Affected Versions NVIDIA AIStore for Linux affected versions not specified Description An issue exists in the legacy ETL Kubernetes PodSpec initialization API. A remote, unauthenticated attacker can inject Kubernetes host-namespace and container-security...
CVE-2026-104252: Improper Neutralization of Input During Web Page Generation
Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML...
PT-2026-113473
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 155.0.8059.79 Description An observable discrepancy in the Media component allows a remote attacker to leak cross-origin data, which is information from a different origin than the one serving the page, by using...
Microsoft Windows: CVE-2026-83870: Windows Aggregated Data Platform Service Information Disclosure Vulnerability
Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally...
Microsoft Windows: CVE-2026-83639: Windows Sensor Data Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally...
CVE-2026-109703: Missing Authorization
Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1...
CVE-2026-83870: Out-of-bounds Read
Out-of-bounds read in Windows Aggregated Data Platform Service allows an authorized attacker to disclose information locally...
Microsoft Windows: CVE-2026-70261: Microsoft Trace Data Helper Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...
Microsoft Windows: CVE-2026-70260: Microsoft Trace Data Helper Information Disclosure Vulnerability
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally...