103846 matches found
Arbitrary File Read
Action Pack Active Storage is vulnerable to Arbitrary File Read. The vulnerability is due to unsafe libvips operations being permitted on untrusted image uploads, allowing attackers to craft malicious images that read arbitrary files accessible to the Rails process and expose sensitive applicatio...
Security Bulletin: There is a vulnerability in IBM WebSphere Application Server used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-14915)
Summary There is a vulnerability in IBM WebSphere Application Server used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2025-14915 DESCRIPTION: IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server...
Security Bulletin: Security vulnerability has been found in IBM Application Gateway Operator
Summary Security vulnerability has been addressed in IBM Application Gateway Operator Vulnerability Details CVEID:CVE-2026-17617 DESCRIPTION: The IBM Application Gateway Operator is vulnerable to Server-Side Request Forgery SSRF due to insufficient validation of URLs specified in custom resources...
Security Bulletin: Multiple vulnerabilities have been identified in IBM WebSphere Application Server used by IBM Rational ClearQuest (CVE-2026-14974, CVE-2026-14515)
Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...
CVE-2026-34490
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...
CVE-2026-34490
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...
EUVD-2026-51576
Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...
CVE-2026-34490
CVE-2026-34490 affects the XAAP Android application (pre-1.53). The issue is cleartext storage of sensitive data in an unencrypted local database on the device, allowing a local attacker on a jailbroken or otherwise compromised device to retrieve sensitive information. CVSS v4.0 base score 4.8 (M...
CVE-2026-56569 HCL iControl is affected by multiple security vulnerabilities.
HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...
Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by an authentication bypass
Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by an authentication bypass CVE-2026-16184 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions Affected Products| Versions...
Security Bulletin: Multiple vulnerabilities have been identified in WebSphere Application Server shipped with WebSphere Service Registry and Repository (CVE-2026-10842 etc.)
Summary WebSphere Application Server is shipped as a component of WebSphere Service Registry and Repository. Information about multiple vulnerabilities affecting WebSphere Application Server have been published in security bulletins. Vulnerability Details Refer to the security bulletins listed in...
Security Bulletin: IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by cross-site scripting and deserialization vulnerabilities (CVE-2026-14974, CVE-2026-14515)
Summary IBM WebSphere Application Server, which is bundled with IBM WebSphere Hybrid Edition, is affected by cross-site scripting and deserialization vulnerabilities CVE-2026-14974, CVE-2026-14515. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...
CVE-2026-55502
Cloudreve prior to version 4.17.0 contains an OAuth scope bypass in the admin storage policy route POST /api/v4/admin/policy/oauth/signin. The admin route is under RequiredScopes(Admin.Read) and does not apply the local Admin.Write guard used by sibling policy mutation routes, allowing an attacke...
CVE-2026-14537
Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-a...
PT-2026-66860
Name of the Vulnerable Software and Affected Versions Modern Loan Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution, at the '/admin/delete group.php' endpoint via the id...
PT-2026-66764
HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...
CVE-2026-56758
The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment. When parsing certain fields within the calling AP title, an attacker controlled length value of zero or one may cause the parser to read past the end of a heap buffer...
CVE-2026-63033 MZ Automation lib60870 Out-of-bounds Read
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObjectParseObjectAddress to read one byte past the end of the heap-allocated message buffer...