387916 matches found
Microsoft Copilot Web Data Cleansing Disclosure
The vulnerability of the Microsoft Copilot Web-based artificial intelligence conversational assistant is related to the lack of data cleansing measures at the management level. Exploiting this vulnerability can allow a malicious actor to disclose protected information...
Tencent AI-Infra-Guard Code Execution
The vulnerability of the Tencent AI-Infra-Guard software platform for security testing involves a flaw in the data protection mechanism. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code...
Google Chrome Downloads Component Unauthorized Access
The vulnerability of the Downloads component in Google Chrome and Microsoft Edge is related to improper authorization. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information, as well as cause service failures through a specially created HTML page...
Compatibility Subsystem Execution Linux Applications Windows WSL2
The vulnerability of the compatibility subsystem’s kernel for running Linux applications involves synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to replace data with malicious content...
Google Chrome Microsoft Edge Information Disclosure
The vulnerability of Google Chrome and Microsoft Edge browsers is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to protected information through a specially created HTML page...
DevTools Suite Protected Information Access
The vulnerability of the DevTools suite for web development in Google Chrome and Microsoft Edge is related to a lack of mechanisms for verifying data sources. Exploiting this vulnerability could allow an attacker to gain access to protected information...
CVE-2026-110124: Authorization Bypass Through User-Controlled Key
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values ...
CVE-2026-108489: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.3...
CVE-2026-110101: Improper Neutralization of Input During Web Page Generation
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/id/file, served as text/html from public/uploads, executin...
PT-2026-111401
Name of the Vulnerable Software and Affected Versions RUGGEDCOM CROSSBOW versions prior to V6.0 Description Improper access control exists regarding database queries used for subnet management. An authenticated attacker can exploit this to read, modify, or delete subnet configurations, resulting ...
PT-2026-111384
Name of the Vulnerable Software and Affected Versions Siemens S7-1500 affected versions not specified Description Devices fail to properly validate and sanitize visual marker data within imported CSV trace files before rendering the information on the Trace page. An attacker could social engineer...
PT-2026-112450
Name of the Vulnerable Software and Affected Versions Windows Sensor Data Service affected versions not specified Description A heap-based buffer overflow occurs in the Windows Sensor Data Service. This issue allows an authorized attacker to elevate privileges locally on the system. A heap-based...
pcre2: PCRE2: Out-of-bounds write via large pattern input
A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2patternconvert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability...
PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms
A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the pcre2compile32 function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denia...
Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Authentication Bypass.
Summary proxy-addr is used by IBM Storage Fusion Data Foundation, which could cause Authentication Bypass. CVE-2026-90711. Vulnerability Details CVEID:CVE-2026-90711 DESCRIPTION: proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs...
CVE-2025-66516-POC
⚠️ READ DISCLAIMER BEFORE USE ⚠️ Educational/Authorized Testing Only | License | Security Policy About This POC This repository contains a proof-of-concept POC exploit for CVE-2025-66516 , an XML External Entity XXE injection vulnerability in Apache Tika versions prior to 3.2.2. The vulnerability...
CVE-2026-96119 IBM i is Affected By An Improper Control of Code Generation Vulnerability in HTTP Server Administration GUI
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application...
CVE-2026-96119
IBM i versions 7.3, 7.4, 7.5, and 7.6 are vulnerable to an Improper Control of Code Generation (CWE-94) vulnerability within the HTTP Server Administration web application . Due to improper data sanitization , a remote authenticated attacker could potentially obtain sensitive information or execu...
CVE-2026-84418
IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API...