87757 matches found
CVE-2026-66248 HCL iControl is affected by an Improper Error Handling vulnerability
iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...
CLEANSTART-2024-NV58280 logic error in the room key sharing functionality of Element Android before 1
Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of Element Android before 1...
CLEANSTART-2024-FT51773 logic error in the room key sharing functionality of matrix-js-sdk (aka Matrix Javascript SDK) before 12
Security vulnerability affects the element-web package. A logic error in the room key sharing functionality of matrix-js-sdk aka Matrix Javascript SDK before 12...
CLEANSTART-2026-GD03162 logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem
Security vulnerability affects the util-linux package. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem...
CLEANSTART-2026-WY70417 logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem
Security vulnerability affects the util-linux package. A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem...
CVE-2026-96561
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.8.0 . The vulnerability stems from a chain of missing input neutralization and output escaping starting at the /mwai-ui/v1/chats/submit REST en...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
CVE-2026-96561 AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
PT-2026-103667
The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.8.0 This is due to a chain of missing input neutralization and output escaping across the /mwai-ui/v1/chats/submit REST endpoint, the...
ROS-20261001-73-0043
The vulnerability in rclone is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...
ROS-20261001-73-0034
The vulnerability in Xen is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to increase their privileges...
CVE-2026-103922: Origin Validation Error
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame ...
CVE-2026-104002: Detection of Error Condition Without Action
A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda Python might allow actors to read sensitive field values that the application intended to mask. To remediate this issue, users should upgrade to version 3.35.0...
ROS-20261001-73-0012
The vulnerability of the Redis database management system is related to a memory reclamation error. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...
Rocky Linux 9 [CIQ] Security Update: libvirt / libvirt-client / libvirt-client-debuginfo / etc Multiple Vulnerabilities (crlsa-2024_2560)
The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20242560 advisory. The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition,...
CVE-2026-66248: Generation of Error Message Containing Sensitive Information
iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...
ROS-20261001-73-0036
The vulnerability in Xen is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-67172: Exposure of Sensitive Information to an Unauthorized Actor
HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error messages when invalid inputs are sent to certain API endpoints . This information could enable an attacker to facilitate further attacks...
Rocky Linux 9 [CIQ] Security Update: squid / squid-debuginfo / squid-debugsource (crlsa-2025_20935)
The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202520935 advisory. squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling CVE-2025-62168 Tenable has extracted the preceding...