184990 matches found
CVE-2026-64101
A flaw was found in the Linux kernel's fwctl component. Insufficient validation of the Remote Procedure Call RPC input buffer size in the pdsfcfwrpc function can lead to an out-of-bounds read. A local attacker could exploit this vulnerability by providing a specially crafted RPC input, potentiall...
PT-2026-63268
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing Authorization in Kibana allows for unauthorized cross-space information disclosure. This occurs when user-supplied input is used to circumvent space-level access control, enabling acce...
EulerOS Virtualization 2.12.1 (EulerOS-SA-2026-2747)
According to the versions of the packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the...
CVE-2026-30632
Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the createdoc tool...
PT-2026-63284
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user can cause a denial of service by submitting a specially crafted RFC 4716 SSH2 public key to the SSH key ingestion endpoint. The issue stems from a normalization function...
PT-2026-62102
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling. This leads to remote code execution as a...
PT-2026-63243
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description Insufficient validation of untrusted input in the Chromecast component allows a local attacker to potentially perform a sandbox escape via malicious network traffic. A sandbox escape i...
PT-2026-63244
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.182 Description Insufficient validation of untrusted input within the Extensions component allows a remote attacker to spoof the contents of the Omnibox the browser's URL bar by using a specially...
PT-2026-71734
Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.2 SVGO versions 3.0.0 through 3.3.3 SVGO versions 4.0.0 through 4.0.1 Description The removeScripts plugin known as removeScriptElement in versions 1 through 3 fails to remove namespaced or prefixed script...
PT-2026-61933
Name of the Vulnerable Software and Affected Versions FlexCity versions 5.536.0 through 5.541.0 Description An open redirect issue allows input data manipulation by redirecting users to untrusted sites. Recommendations Update FlexCity to version 5.542.0...
PT-2026-62076
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user can cause a denial of service by submitting a specially crafted request to Entity Analytics endpoints. By providing an oversized input value, the attacker can trigger...
VulnCheck KEV: CVE-2026-58455
Dockwatch through 0.6.567 contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary shell commands by exploiting a missing exit after an authentication redirect in loader.php combined with unsanitized input passed to shellexec in...
PT-2026-63251
Name of the Vulnerable Software and Affected Versions Google Chrome on Linux versions prior to 150.0.7871.182 Description Insufficient validation of untrusted input within the Certificate component allows an attacker in a privileged network position to perform domain spoofing through the use of...
EulerOS Virtualization 2.12.0 : polkit (EulerOS-SA-2026-2793)
According to the versions of the polkit packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the...
WordPress Core SQL Injection Vulnerability
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations...
@astrojs/rss: XML Injection via Unescaped RSS Feed Fields
Summary In @astrojs/rss, the source.title and enclosure.type item fields are interpolated directly into XML template strings without XML-character escaping before being parsed by fast-xml-parser. An attacker who controls these field values can inject arbitrary XML elements into the generated RSS...
Improper Encoding or Escaping of Output
Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the transition:persist, transition:scope, or transition:persist-props directives when...
GHSA-7PW4-F3Q4-R2P2 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
Summary When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these...
EUVD-2026-44392
Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability...
node-tar: Decompression/parse DoS via unlimited input
Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...