202407 matches found
CVE-2026-75077
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly...
CVE-2026-72108
A flaw was found in the Linux kernel's device-mapper dm thin metadata component. When operations involving metadata snapshots, such as reserving or releasing a snapshot, encounter a commit failure, the system can write an inconsistent 'heldroot' to disk. This can lead to metadata corruption withi...
.NET: .NET Core: .NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests 'http request/response smuggling' in .NET allows an unauthorized attacker to bypass a security feature over a network...
.NET: .NET Denial of Service Vulnerability
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network...
http4k: `DigestAuthProvider.verify` did not bind to request URI
Impact An issue in DigestAuthProvider.verify: The uri parameter in the client's Authorization: Digest … response was not checked against the actual request URL. A captured Digest authentication response could be replayed against any other URL served by the same realm, breaking the per-request-URL...
CVE-2026-72095
A flaw was found in the Linux kernel's dma-fence component. The dmafencededuparray function incorrectly handles zero-count input, leading to a memory corruption vulnerability. A local attacker could potentially exploit this by triggering specific conditions in the amdgpuuserqwait functions, which...
unbound: Unbound: Denial of Service via malformed EDNS Report-Channel option
A flaw was found in Unbound. When the 'dns-error-reporting: yes' option is enabled, a remote attacker can send a specially crafted DNS response containing a malformed EDNS Report-Channel option from a delegated zone they control. This can lead to a stack variable overwrite, causing the Unbound...
Security Bulletin: IBM i is Affected By Denial of Service in Host Servers [CVE-2026-17015]
Summary IBM i is vulnerable to a denial of service due to an out-of-bounds read CVE-2026-17015 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-17015 DESCRIPTION: IBM i could allow a remote authenticated attacker to cause a denial of service and obtain...
CVE-2026-75077 SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly...
CVE-2026-40506
OpenEMR before 8.2.0 is vulnerable: the db GET parameter in standard_tables_manage.php is passed unsanitized to temp_dir_cleanup(), allowing path traversal and recursive deletion of arbitrary directories. Chaining with an open redirect in dicom_frame.php enables an unauthenticated attacker to tri...
EUVD-2026-60396
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...
CVE-2026-40506 OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php
OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...
CVE-2026-50645 vulnerabilities
Vulnerabilities for packages: apache-tika-fips, wso2is, apache-tika...
CVE-2026-75012
A security vulnerability has been detected in TOTOLINK EX1200L 9.3.5u.6146B20201023. Affected by this issue is the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Password Configuration Handler. The manipulation leads to null pointer dereference. The attack can be...
CVE-2026-75014
A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/getbarcodedata.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may...
CVE-2026-67678
File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code...
CVE-2026-19478
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...
CVE-2026-19478
GitLab CE/EE (self-managed) versions 18.2 through 19.2.3 are affected by a critical unauthenticated arbitrary method invocation vulnerability (CVSS 9.4, CWE-94) in the GraphQL API. The root cause is in the @gl_introduced directive's fallback field resolver (future_field_fallback.rb), which calls ...
EUVD-2026-60441
ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...