CVE-2026-81469

Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges...

CVE-2026-45381

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-81469

Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges...

CVE-2026-81469

Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges...

CVE-2026-81469

Dell Inventory Collector Client versions prior to 15.0.0 are affected by an Unquoted Search Path or Element vulnerability. A low-privileged attacker with local access can exploit this to achieve code execution and elevation of privileges , rated CVSS 7.8 (HIGH) with full impact to confidentiality...

EUVD-2026-84100

Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of Privileges...

CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

EUVD-2026-84070

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

CVE-2026-45381

Tautulli is a Python-based monitoring and tracking tool for Plex Media Server . In versions prior to 2.17.2 , the /search endpoint inserts a user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but no...

CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

SUSE CVE-2026-59834

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled paths values into SQL predicates used by non-SQL search modes, allowing an unauthenticated publish visitor to inject a UNI...

SUSE CVE-2026-72811

SiYuan versions = v3.7.2 contain a SQL injection vulnerability in the backlink/mention search query kernel/model/backlink.go, which concatenates stored block metadata title, name, alias, anchor text and the client-supplied keyword into a SQL MATCH/search statement while escaping only the...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

CVE-2026-16652

Temporal Server is vulnerable to excessive CPU consumption in its Schedule component. An authenticated caller with namespace write permission can create or update a Schedule that combines a fine-grained cadence with an exclusion calendar rejecting every candidate time, causing the server to evalu...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration

A flaw was found in the GNU C Library glibc DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from...

WordPress Tutor LMS plugin <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters vulnerability

Reflected Cross-Site Scripting via 'backurl' and 'search' Parameters vulnerability discovered by Filip Kowalski Agentunio in WordPress Plugin Tutor LMS versions = 4.0.8...

CVE-2026-69190: Authorization Bypass Through User-Controlled Key

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. Th...