63359 matches found
PT-2026-91181
Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...
PT-2026-91598
An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may lead to unexpected system termination...
PT-2026-91247
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...
The vulnerability of the Telnet Client command-line tool for Windows operating systems allows a hacker to execute arbitrary code.
The vulnerability of the Telnet Client command-line tool for Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2026-91221
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...
PT-2026-91246
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...
CVE-2026-59569: Improper Input Validation
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...
CVE-2026-12985: URL Redirection to Untrusted Site
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...
CVE-2026-59570: Improper Input Validation
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...
CVE-2026-25832
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...
ROS-20260914-73-0018
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...
CVE-2026-25687: Race Condition within a Thread
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...
CVE-2026-90898: Missing Authentication for Critical Function
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...
CVE-2026-25832
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2 , the TLS 1.3 client accepts a HelloRetryRequest that selects a group the client did not advertise, potentially allowing a man-in-the-middle to force a weaker or unintended key exchange group. The CVSS 3.1 score is 3.7 (Low) with high attack c...
CVE-2026-25832
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...
CVE-2026-25832
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...
CVE-2026-25832: Incorrect Resource Transfer Between Spheres
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...
CVE-2026-14276: Improper Neutralization of Special Elements used in an OS Command
IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action...
