75941 matches found
CVE-2026-25832
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...
PT-2026-91247
Name of the Vulnerable Software and Affected Versions Zscaler Client Connector on Android and ChromeOS affected versions not specified Description An improper input validation issue exists in Zscaler Client Connector on Android and ChromeOS. This flaw allows an attacker to potentially bypass...
PT-2026-91730
Name of the Vulnerable Software and Affected Versions IBM Sterling Secure Proxy versions 6.2.0.0 through 6.2.1.2 Description A client-side authorization bypass allows a remote authenticated attacker to view administrative user interface components. Recommendations At the moment, there is no...
ROS-20260914-73-0018
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client-side. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...
CVE-2026-78336: Insertion of Sensitive Information Into Sent Data
Insertion of sensitive information into sent data vulnerability in Apache Syncope. Any authenticated user can query for the list of available OIDC providers configured for SSO with Console and Enduser. The returned payload contains all configuration settings, including client secrets, regardless ...
CVE-2026-25832
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...
PT-2026-91221
Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost versions 11.8.0 through 11.8.4 Mattermost versions 11.7.0 through 11.7.7 Description An issue exists where the software fails to validate Dynamic Client Registration redirect URIs by URL component, instead...
PT-2026-91248
Name of the Vulnerable Software and Affected Versions Zscaler client connector affected versions not specified Description A pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture. Recommendations At the moment, there is no information about a newer...
CVE-2026-14276: Improper Neutralization of Special Elements used in an OS Command
IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action...
CVE-2026-25832: Incorrect Resource Transfer Between Spheres
In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts HelloRetryRequest selecting an unadvertised group...
CVE-2026-90898: Missing Authentication for Critical Function
Bifrost registers MCP clients through its management API. A stdio client is a command plus args. Bifrost starts that program in the gateway the moment the client is added. No MCP handshake required. The default is governance.authconfig.isenabled=false. Auth off means every caller is a local admin...
CVE-2026-59570: Improper Input Validation
On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle packet capture...
CVE-2026-59569: Improper Input Validation
An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls...
CVE-2026-25687: Race Condition within a Thread
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...
CVE-2026-12985: URL Redirection to Untrusted Site
Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...
ALSA-2026:67133 Important: firefox security update
Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Privilege escalation in the DOM: Workers component CVE-2026-16365 firefox: thunderbird: Sandbox escape in the Remote Settings Client component...
AlmaLinux 10 : freerdp (ALSA-2026:66349)
The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:66349 advisory. FreeRDP: FreeRDP: Remote code execution or client crash via malicious TS Gateway CVE-2026-55193 Tenable has extracted the preceding description block directly fr...
Telnet Client Code Execution
The vulnerability of the Telnet Client command-line tool for Windows operating systems is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
ROS-20260914-73-0041
The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to the implementation of security features at the client side. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...
