40409 matches found
CVE-2026-34193
Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory. A logic error in the address translation allowed a compromised Host Kernel to perform arbitrary writes to firmware memory...
CVE-2026-34193 GPU DDK - Arbitrary write via UFO updates due insufficient pointer validation in rgxfw_to_ptr()
Kernel software installed and running inside a Guest/Host VM may post improper commands to the GPU Firmware to trigger a write of data outside the intended GPU memory. A logic error in the address translation allowed a compromised Host Kernel to perform arbitrary writes to firmware memory...
EUVD-2026-33623
A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function createsupplier of the file /Exportcsv/export of the component Supplier Creation Interface. This manipulation of the argument Address/Company Name causes csv injection...
CVE-2026-10248 SourceCodester Pharmacy Sales and Inventory System Supplier Creation export create_supplier csv injection
A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function createsupplier of the file /Exportcsv/export of the component Supplier Creation Interface. This manipulation of the argument Address/Company Name causes csv injection...
CVE-2026-49328 Apache Fesod (Incubating): Improper validation of user-supplied URLs leading to SSRF
Server-Side Request Forgery SSRF in the UrlImageConverter component of Apache Fesod Incubating fesod-sheet before 2.0.2-incubating allows attackers to cause outbound network requests to internal or otherwise restricted resources via a user-supplied image URL. Users are recommended to upgrade to...
CVE-2026-49328
Apache Fesod (Incubating) contains a Server-Side Request Forgery (SSRF) vulnerability in the UrlImageConverter component in versions prior to 2.0.2-incubating . The flaw allows an attacker to provide a malicious image URL, tricking the server into initiating outbound network requests to internal ...
CVE-2026-42588
Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy...
SUSE-SU-2026:22002-1 Security update for tree-sitter
This update for tree-sitter fixes the following issue - CVE-2026-44216: wasmtime: allocation of a table exceeding the size of the host's address space leads to panic bsc1265300...
Malicious code in @telenor-se/core (npm)
Dependency confusion attack campaign targeting Scandinavian telecommunications and digital services organizations Telenor, Ownit, Vimla, and Customer 360 / C360. Four packages published by the debating0166 npm account use inflated version numbers 99.0.x to win npm registry resolution over private...
CVE-2026-10221
creationtimestamp| type| source ---|---|--- 2026-06-01 07:22:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mn7kbrzyzq2b...
RLSA-2026:22142 Important: php:8.3 security update
PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation...
ArmCode Arm Whois security vulnerability
ArmCode Arm Whois is a web information query tool developed by ArmCode Corporation. Version 3.11 of ArmCode Arm Whois contains a security vulnerability. This vulnerability stems from a stack buffer overflow, which could allow remote attackers to execute arbitrary code by providing excessive input...
Imagination Graphics DDK security vulnerability
Imagination Graphics DDK is a GPU driver toolkit developed by the British company Imagination. There is a security vulnerability in Imagination Graphics DDK, which stems from an address translation logic error. This vulnerability may allow the compromised host kernel to perform arbitrary writes t...
CVE-2018-25427: Stack-based Buffer Overflow
Arm Whois 3.11 contains a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception...
CVE-2026-10248: Improper Neutralization of Formula Elements in a CSV File
A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System up to 1.0. This issue affects the function createsupplier of the file /Exportcsv/export of the component Supplier Creation Interface. This manipulation of the argument Address/Company Name causes csv injection...
PT-2026-45409
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the address translation allows kernel software running inside a Guest or Host VM to post improper commands to the GPU Firmware. This can trigger...
Security Vulnerabilities fixed in Firefox for iOS 151.2 — Mozilla
Firefox for iOS Reader View replaced page content in its HTML template before replacing other internal placeholders. A malicious page could include a placeholder string that was later substituted with JSON-LD data, potentially resulting in arbitrary JavaScript execution. Firefox for iOS Reader Vi...
MCPilot code-related vulnerabilities
MCPilot is a multi-modal interactive assistant developed by Huang Runzhong, which integrates multiple AI models and the MCP protocol. Version 0.1.0 of MCPilot contains code vulnerabilities. These vulnerabilities stem from incorrect handling of the parameter serverBaseUrl in the MCP API Call...
📄 MATLAB R2024a Arbitrary Local System Information Disclosure
This proof of concept tool demonstrates arbitrary local system information disclosure via MATLAB using system/fileread primitives. ================================================================================================================================== | Title : MATLAB R2024a Full...