15395 matches found
CVE-2026-73196 Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding
A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...
CVE-2026-73196 Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding
A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password OTP key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a...
EUVD-2026-63123
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...
PT-2026-79090
Name of the Vulnerable Software and Affected Versions django CMS versions prior to 5.0.8 Description The copy plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copy plugin to clipboard and copy placeholder to clipboard paths accept source placeholder...
CVE-2026-54505: Improper Neutralization of Input During Web Page Generation
TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...
CVE-2026-76371
In FireAMP versions below 2.1.15, the connector action manifest misclassifies the "add listitem" action as read-only despite it modifying file lists. A user with playbook edit/run privileges could exploit this in a Safe Mode playbook to make unauthorized file-list changes. CVSS 2.7 (LOW). Fix: up...
CVE-2026-76316 Stored SPL Injection through Deployment Server Broker Registration in Splunk Enterprise
In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.9, and 9.4.14, an unauthenticated user who can reach the Splunk management port could store a Search Processing Language SPL pipeline that runs when an administrator opens the Add Data forwarder workflow. The SPL pipeline could access all...
CVE-2026-76316
An unauthenticated remote attacker who can reach the Splunk management port can register a crafted Deployment Server client identifier, which is then inserted into dispatched searches without special-character sanitization. When an administrator opens the Add Data forwarder workflow, the injected...
CVE-2024-58376
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...
CVE-2024-58376
Renovate versions 37.158.0 through 37.198.0 are vulnerable to a command injection flaw in the helmv3 manager . The root cause is the improper handling of registryAliases, where the software fails to quote the keys. Attackers with commit access to a repository can inject unquoted shell metacharact...
CVE-2024-58376 Renovate 37.158.0 before 37.199.0 Command Injection via helmv3
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...
Linux Distros Unpatched Vulnerability : CVE-2026-74979
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
CVE-2026-76371: Incorrect Permission Assignment for Critical Resource
In FireAMP versions below 2.1.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the add listitem action in a Safe Mode playbook while that action is listed as read-only, which could allow for unauthorized changes to file lists. The vulnerability is...
CVE-2024-58376: Improper Neutralization of Special Elements used in an OS Command
Renovate versions 37.158.0 before 37.199.0 contain a command injection vulnerability in the helmv3 manager's registryAliases handling that allows attackers with commit access to execute arbitrary commands. Attackers can manipulate registryAliases keys with unquoted shell metacharacters to inject...
PT-2026-78677
Name of the Vulnerable Software and Affected Versions Lemmy versions 0.19.18 through 0.19.18 Lemmy versions 1.0.0-alpha.1 through 1.0.0-alpha.19 Description A community moderator can feature or unfeature posts belonging to other communities. This occurs during federated CollectionAdd and...
PT-2026-78743
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user with access to the management port...
CVE-2026-66633 WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
EUVD-2026-60918
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...