1049795 matches found
CVE-2026-121624: Nanosystems Supremo: Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability…
Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session...
CVE-2026-121727: jorisvink kore: Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated…
Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass httpbodymax by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections,...
CVE-2026-121731: francoisjacquet RosarioSIS: RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including…
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted periodid parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN clauses to extract administrator...
CVE-2026-121631: lightdash: Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows…
Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUui...
CVE-2026-121582: n/a Umami: A vulnerability has been found in Umami up to 3.4.1
A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the component Record API Endpoint. Such manipulation of the argument Website leads to authorization bypass. The attack may be launched remotely. The exploit has been...
CVE-2026-121514: EasySoft ZenTao PMS: A weakness has been identified in EasySoft ZenTao PMS up to 22.6
A weakness has been identified in EasySoft ZenTao PMS up to 22.6. This impacts the function userModel::checkGroupChange of the file module/user/model.php of the component User Module. This manipulation of the argument group causes improper privilege management. Remote exploitation of the attack i...
CVE-2026-22060: NETAPP StorageGRID (formerly StorageGRID Webscale): All versions of StorageGRID (formerly StorageGRID Webscale) in default & common configurations allow an unauthenticated…
All versions of StorageGRID formerly StorageGRID Webscale in default & common configurations allow an unauthenticated attacker to access a limited set of APIs that are intended for use within the grid...
CVE-2026-121177: Google Chrome: UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof…
UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-121183: Google Chrome: Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had…
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-121235: Google Chrome: Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive…
Information leak in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. Chromium security severity: Low...
CVE-2026-119922: AWS babelfish-for-postgresql: Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8,…
Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6....
CVE-2026-120329: TYPO3 Extension "Mail": Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting…
Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig...
CVE-2026-120332: TYPO3 Extension "Mail": The HTML content of mails and tracked URLs are rendered unescaped in the backend module
The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report...
CVE-2026-120328: TYPO3 Extension "Mail": The click tracking middleware does not validate the authentication code of a recipient if the code is omitted
The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails...
CVE-2026-121024: AxxonSoft AxxonNet: Incorrect Authorization (CWE-863) in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows…
Incorrect Authorization CWE-863 in the Health Monitoring service in AxxonSoft AxxonNet before 3.28.0 on Linux allows a remote attacker in possession of a shared report token, which is intended for read-only access, to create, modify or delete monitoring alerts via the monitoring API...
CVE-2026-120524: blazethemes News Kit Addons For Elementor: The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData'…
The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2026-121045: Google Chrome: UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging…
UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Low...
CVE-2026-121047: Google Chrome: Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…
Buffer overflow in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-121054: Google Chrome: Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…
Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-121023: AxxonSoft AxxonNet ARP Agent: Insertion of Sensitive Information into Log File (CWE-532) in the ARP Agent component in AxxonSoft AxxonNet before…
Insertion of Sensitive Information into Log File CWE-532 in the ARP Agent component in AxxonSoft AxxonNet before 3.25.0 on Windows and Linux allows a local attacker with read access to ARP Agent log files or support packages to obtain the plaintext password of the LDAP directory service account v...