27059 matches found
CVE-2026-88026: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C Driver can cause a caller-supplied character sequence to alter a regular-expression predicate generated by an affected application. An authenticated user who can influence such a...
CVE-2026-63427: Authentication Bypass by Spoofing
An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges...
CVE-2026-88896: Server-Side Request Forgery (SSRF)
EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal, which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: IPv4-mapped IPv6 prefixes but does not recognize IPv6 transition addresses that embed private IPv...
CVE-2026-86087: Improper Limitation of a Pathname to a Restricted Directory
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbitrary files on the system...
Linux Distros Unpatched Vulnerability : CVE-2026-61908
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of- bounds index. An authenticated user could attempt to...
CVE-2022-26962
Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NPBCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or mrfAnnouncementNameparameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The maliciou...
PT-2026-89599
Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.5 Description An authenticated user can send a specially crafted request to write arbitrary files on the system. Recommendations At the moment, there is no information...
PT-2026-89594
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...
PT-2026-89287
A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle MitM access to execute code with root privileges on the Broker VM...
PT-2026-89593
A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges...
CVE-2026-18994: Improper Export of Android Application Components
A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application...
PT-2026-89414
MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convert markdown to pdf module. The attribute, objectAttribute,...
PT-2026-89541
Name of the Vulnerable Software and Affected Versions MongoDB integration for Laravel affected versions not specified Description Improper neutralization of special elements in data query logic within the embedded-document relation handling allows an authenticated user to manipulate an embedded...
CVE-2026-88033: Improper Neutralization of Special Elements in Data Query Logic
Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Java Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the...
CVE-2026-11813: Incorrect Default Permissions
A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges...
PT-2026-89544
Name of the Vulnerable Software and Affected Versions MongoDB Ruby Driver affected versions not specified Description Improper neutralization of special elements in the data query logic of the GridFS component allows a structured file identifier provided by a caller to be interpreted as a query...
PT-2026-89516
Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of regular-expression metacharacters in the LINQ query translation component allows an authenticated user to provide a character sequence that alters a...
PT-2026-89637
šØ CVE-2026-81941 IBM Langflow OSS 1.0.0 through 1.11.5 allows an authenticated non-administrative user could execute arbitrary operating system commands on the server at the privilege level of the application process by constructing a flow with an MCP Tools component configured to use a local std...
Linux Distros Unpatched Vulnerability : CVE-2026-61911
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed...
GHSA-3CGP-3CQX-J8W2 Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree
Summary Chat histories are stored as an unvalidated JSON object. After a message is deleted, the code that picks the chat's new current message walked down the childrenIds links without recording where it had already been. Any account with the default user role could store a chat whose messages...