37700 matches found
CVE-2026-45552: Authorization Bypass Through User-Controlled Key
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.beforerequest → @jwtrequired app/routes/install/routes.py:36-39. The individual endpoints installexporter, installwaf, installgeoip,...
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
Description CVE-2024-50340 GHSA-x8vp-gf4q-mw5j addressed an issue where, with registerargcargv=On, a crafted query string let an unauthenticated GET change the kernel environment and debug flag by feeding --env/--no-debug through $SERVER'argv'. The fix shipped in symfony/runtime 5.4.46 / 6.4.14 /...
test-poc
CVE-2021-0928, writeToParcel/createFromParcel serialization...
MAL-2026-5452 Malicious code in shopify-app-bridge-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21c63417fe3a82fd514d0af7c913fb3c1cd62915839dc8910483fb6484bbbd9 The package's preinstall lifecycle script in package.json runs unconditionally on npm install and issues an HTTPS GET to...
Malicious code in shopify-app-bridge-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b21c63417fe3a82fd514d0af7c913fb3c1cd62915839dc8910483fb6484bbbd9 The package's preinstall lifecycle script in package.json runs unconditionally on npm install and issues an HTTPS GET to...
CVE-2025-10263
creationtimestamp| type| source ---|---|--- 2026-06-09 13:41:01+00:00| seen| https://infosec.exchange/users/andersonc0d3/statuses/116720431315436112 2026-06-09 13:42:27+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mnuda5fphm2q 2026-06-09 15:44:28+00:00| seen|...
CVE-2025-40808
creationtimestamp| type| source ---|---|--- 2026-06-09 12:30:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mnu76w7sj42g 2026-06-23 05:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-174-02...
WordPress Hippoo Mobile App for WooCommerce plugin <= 1.9.4 - Unauthenticated Authentication Bypass to Administrator Account Takeover vulnerability
Unauthenticated Authentication Bypass to Administrator Account Takeover vulnerability discovered by Mitchell in WordPress Plugin Hippoo Mobile App for WooCommerce versions = 1.9.4...
Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to xmldom (CVE-2026-41672, CVE-2026-41673, CVE-2026-41674 & CVE-2026-41675)
Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to multiple vulnerabilities due to xmldom. Vulnerability Details CVEID:CVE-2026-41672 DESCRIPTION: xmldom is a pure...
Security Bulletin: IBM App Connect Enterprise is vulnerable to Uncontrolled Recursion due to Node.js module yaml (CVE-2026-33532)
Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to Uncontrolled Recursion due to Node.js module yaml. Vulnerability Details CVEID:CVE-2026-33532 DESCRIPTION: yaml is a...
CVE-2026-41972
Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availability...
Security Bulletin: IBM App Connect Enterprise is vulnerable to FTP command injection and denial of service due to Node.js module basic-ftp ( CVE-2026-39983 & CVE-2026-41324 )
Summary IBM App Connect Enterprise Connector Discovery and OpenAPI Editor, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise runtime are vulnerable to FTP command injection and denial of service due to Node.js module basic-ftp. Vulnerability Details CVEID:CVE-2026-399...
CVE-2026-41972
Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availability...
CVE-2026-41972
CVE-2026-41972 describes a path traversal vulnerability in the SMS app with an impact on availability. The provided documents mention the issue and CVSS details (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) but do not specify affected product versions, vulnerable components, exact exploit paths, or a rem...
CVE-2026-8909
WpMobi WordPress plugin (versions ≤ 0.0.3) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation in handleSaveGeneralSettings. This allows unauthenticated attackers to modify General Settings and inject scripts into an administrator’s browser via unescaped app_name...
Microsoft Remote Desktop Client 缓冲区错误漏洞
Microsoft Remote Desktop Client is a remote desktop client developed by Microsoft Corporation. There are security vulnerabilities in Microsoft Remote Desktop Client. Attackers can exploit these vulnerabilities to execute code. The following products and versions are affected: Windows 10 Version...
CVE-2026-0420: Missing Cryptographic Step
An improper implementation of TLS certificate validation vulnerability found in NETGEAR's ReadyCloud client app which could allow an attacker to perform attacker-in-the-middle MiTM style attacks impacting the product's confidentiality. This vulnerability affects the listed NETGEAR models...
Huawei HarmonyOS 路径遍历漏洞
Huawei HarmonyOS is an operating system developed by Chinese company Huawei. It is a full-scenario distributed operating system based on a microkernel architecture. The Huawei HarmonyOS SMS app contains a path traversal vulnerability, which can be exploited by attackers to compromise the system’s...
CVE-2026-41972: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability in the SMS app. Impact: Successful exploitation of this vulnerability may affect availability...
