40400 matches found
WordPress plugin Zoner Real Estate has a cross-site scripting vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...
MISP security vulnerabilities
MISP is a set of open-source software solutions developed by MISP. This product is used for collecting, storing, distributing, and sharing network security metrics. It also includes functions such as analysis of threats to network security and malware analysis. MISP has a security vulnerability...
Strawberry GraphQL security vulnerability
Strawberry GraphQL is an open-source Python GraphQL library that utilizes type annotations. Versions 0.288.4 to 0.315.3 of Strawberry GraphQL contain security vulnerabilities. These vulnerabilities stem from the GraphiQL template writing values from the header editor into the browser URL query...
Tautulli security vulnerabilities
Tautulli is an open-source application developed by Tautulli for monitoring Plex Media Server. Versions of Tautulli prior to 2.17.1 contained security vulnerabilities. These vulnerabilities stemmed from the exposure of the /image/ route, allowing attackers to control the entries and trigger...
Zephyr security vulnerabilities
Zephyr is an open-source, scalable real-time operating system RTOS developed by Zephyr. There is a security vulnerability in Zephyr, which stems from the fact that the tlssessionstore and tlssessionrestore functions in the TLS socket connection path do not validate the addrlen value. This leads t...
CVE-2025-67447: Improper Neutralization of Special Elements used in an OS Command
The network diagnosis ping module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properly sanitize user input in the IP address field before passing it to the system's ping command. An attacker can inject arbitrary OS commands,...
CVE-2019-25742: Improper Neutralization of Input During Web Page Generation
WordPress Theme Zoner Real Estate 4.1.1 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through the Address input field when creating properties. Attackers can inject JavaScript payloads in the property creation form that execu...
CVE-2026-10597: Authorization Bypass Through User-Controlled Key
OMICARD EDM developed by ITPison has a Insecure Direct Object Reference vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to obtain user's email address...
PT-2026-49156
Summary CSV formula injection also known as formula injection or CSV injection affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or LibreOffice Calc, formulas embedded in user da...
PT-2026-46212
Name of the Vulnerable Software and Affected Versions Zoner Real Estate version 4.1.1 Description A persistent cross-site scripting issue exists where authenticated agents can inject malicious JavaScript payloads through the Address input field during property creation. These scripts execute when...
PT-2026-46205
Name of the Vulnerable Software and Affected Versions AllPlayer version 7.4 Description A local buffer overflow exists in the way URLs are handled. An attacker can overwrite structured exception handling SEH pointers—a mechanism used to handle software errors—by providing an excessively long URL...
PT-2026-46206
LabF nfsAxe 3.7 Ping Client contains a buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying a malicious payload in the Host IP field. Attackers can craft a specially formatted input file with shellcode and overwrite the return address to execute calc.ex...
CVE-2026-40495
creationtimestamp| type| source ---|---|--- 2026-06-03 21:28:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mng2hfdmyg2m...
Docling: Unsafe URI and Path Handling in HTML Backend
Impact The HTML backend did not perform sufficient validation during resource handling: - Accepted file:// URIs enabling local file system access when enablelocalfetch=True - Path resolution allowed traversal outside intended directories via ../ sequences and absolute paths - Did not block intern...
CVE-2026-46249
A flaw was found in the Linux kernel's octeontx2-af PF driver. This vulnerability occurs during a kexec reboot when the hardware is not power-cycled, causing the AF state from the old kernel to persist. If the RVUM block revision is not cleared during AF shutdown, the PF driver may incorrectly...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
gpac:fuzz_scene: Heap-use-after-free in gf_node_get_attribute_by_tag
Project: https://github.com/gpac/gpac.git Detailed Report: https://oss-fuzz.com/testcase?key=5045588495499264 Project: gpac Fuzzing Engine: libFuzzer Fuzz Target: fuzzscene Job Type: libfuzzerasangpac Platform Id: linux Crash Type: Heap-use-after-free READ 8 Crash Address: 0x79d1706e02c0 Crash...
SUSE-SU-2026:21990-1 Security update 5.0.8 for Multi-Linux Manager Client Tools, Salt Bundle and Salt
This update fixes the following issues: golang-github-prometheus-nodeexporter: - Version 1.10.2: meminfo: Fix typo in Zswap metric name - Version 1.10.1: filesystem: Fix mount points being collected multiple times filesystem: Refactor mountinfo parsing bsc1261810 meminfo: Add Zswap/Zswapped metri...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...
net/url: Incorrect parsing of IPv6 host literals in net/url
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...