490112 matches found
Flextype CMS 1.0.0-alpha.3 Arbitrary File Read
Flextype CMS version 1.0.0-alpha.3 contains an arbitrary file-read vulnerability in its stored shortcode processing functionality. Attacker-controlled entry fields are automatically processed by the shortcode parser when global shortcode processing is enabled...
PT-2026-85428
Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
CVE-2026-75163
The MBS-Solutions X-Serie Gateway running firmware V6_00_05 is susceptible to an information disclosure vulnerability. The ugw-deviceinfo method within /cgi-bin/wwwugw.cgi improperly returns sensitive system version fields, specifically operatingsystem and gatewayversion , to any authenticated us...
PT-2026-86238
An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file...
CVE-2026-67397
Plesk for Linux versions 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 are affected by a path traversal vulnerability (CVE-2026-67397) that allows local users with low privileges to execute arbitrary code as root . The vulnerability requires local access with low privileges and no user inte...
CVE-2026-67397
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...
CVE-2026-79992 affecting package emacs for versions less than 29.4-5
CVE-2026-79992 affecting package emacs for versions less than 29.4-5. A patched version of the package is available...
CVE-2026-85063
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...
GHSA-XQQH-3W52-Q8P7 vulnerabilities
Vulnerabilities for packages: ruby3.3-rails, ruby3.2-rails, ruby4.0-rails, ruby3.4-rails...
Important: Red Hat Security Advisory: Red Hat Quay 3.15.8
Red Hat Quay 3.15.8 is now available with bug fixes. Quay 3.15.8...
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Summary orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object... request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key...
CVE-2026-85309
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...
CVE-2026-84848
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-84814
Subscriber Privilege Escalation in Bricksforge = 3.1.8.8 versions...
CVE-2026-84813
Unauthenticated SQL Injection in GeoDirectory = 2.8.174 versions...
CVE-2026-84776
Unauthenticated Denial of Service Attack in MalCare Security = 6.69 versions...
CVE-2026-84777
Unauthenticated Broken Authentication in Really Simple SSL = 9.8.0 versions...
CVE-2026-84765
Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...