76076 matches found
EUVD-2026-75300
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-59679
fsreadglyphs in the libXfont2 font-server client src/fc/fserve.c indexes the per-character encoding array using numchars from the FSQueryXBitmaps16 reply, but that array was allocated with a size derived from numextents in the separate FSQueryXExtents16 reply. The two CARD32 fields are never...
CVE-2026-81635
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...
CVE-2026-81635
A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product...
EUVD-2026-75264
The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to an identifier the client supplies and can change at will, allowing an attacker who already knows a...
server v1.0.1
Hashtopolis LoC Hashtopolis is a multi-platform client-server tool for distributing hashcat tasks to multiple computers. The main goals for Hashtopolis's development are portability, robustness, multi-user support, and multiple groups management. To report a bug, please create an issue and try to...
PocketCinema
PocketCinema for Miyoo Mini Plus A lightweight Stremio-style...
SaltStack <=3002 - Shell Injection
SaltStack Salt through 3002 allows an unauthenticated user with network access to the Salt API to use shell injections to run code on the Salt-API using the SSH client. id: CVE-2020-16846 info: name: SaltStack =3003 to mitigate this vulnerability. reference: -...
com.datomic:peer (>=1.0.7705, <=1.0.7745), com.viglet.core:viglet-core-messaging (>=2026.3.10, <=2026.3.13) +78 more potentially affected by CVE-2026-49364 via org.apache.artemis:artemis-core-client (>=2.50.0, <=2.56.0)
org.apache.artemis:artemis-core-client MAVEN version =2.50.0, =1.0.7705, =2026.3.10, =0.29.0, =4.1.6, =9.0.13, =5.5.2, =5.5.2, =5.5.2, =5.5.2, =9.0.13, =9.0.13, =1.6.0, =3.12.0, =3.12.0, =3.12.0, =3.14.3 and more Source cves: CVE-2026-49364 Source advisory: MEND:CVE-2026-49364...
biz.eyebeam.mssc:mssc-public-bom (>=1.0.1, <=1.0.12), br.com.faroltech:mssc-brewery-bom (>=1.0.3, <=1.0.5) +1094 more potentially affected by CVE-2026-49364 via org.apache.activemq:artemis-core-client (>=1.0.0, <=2.53.0)
org.apache.activemq:artemis-core-client MAVEN version =1.0.0, =1.0.1, =1.0.3, =5.0.9, =6.0.0m1, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =1.0.3, =1.0.7364, =1.6, =1.1, =1.2 and more Source cves: CVE-2026-49364 Source advisory: MEND:CVE-2026-49364...
com.datomic:peer (>=1.0.7705, <=1.0.7745), com.viglet.core:viglet-core-messaging (>=2026.3.10, <=2026.3.13) +78 more potentially affected by CVE-2026-57822 via org.apache.artemis:artemis-core-client (>=2.50.0, <=2.56.0)
org.apache.artemis:artemis-core-client MAVEN version =2.50.0, =1.0.7705, =2026.3.10, =0.29.0, =4.1.6, =9.0.13, =5.5.2, =5.5.2, =5.5.2, =5.5.2, =9.0.13, =9.0.13, =1.6.0, =3.12.0, =3.12.0, =3.12.0, =3.14.3 and more Source cves: CVE-2026-57822 Source advisory: MEND:CVE-2026-57822...
biz.eyebeam.mssc:mssc-public-bom (>=1.0.1, <=1.0.12), br.com.faroltech:mssc-brewery-bom (>=1.0.3, <=1.0.5) +989 more potentially affected by CVE-2026-57822 via org.apache.activemq:artemis-core-client (>=1.3.0, <=2.53.0)
org.apache.activemq:artemis-core-client MAVEN version =1.3.0, =1.0.1, =1.0.3, =5.0.9, =6.0.0m1, =2.2.1, =2.2.1, =2.2.2, =2.2.1, =1.0.3, =1.0.7364, =1.6, =1.1, =1.2 and more Source cves: CVE-2026-57822 Source advisory: MEND:CVE-2026-57822...
MAL-2026-16119 Malicious code in etoro-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31819832ff4b43fc9bc7bcd9f3439f71902802331ba6df3c3964c47765397e1 The preinstall lifecycle script in [email protected] unconditionally sends the installer's hostname, OS username, and current working directory to...
Malicious code in etoro-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31819832ff4b43fc9bc7bcd9f3439f71902802331ba6df3c3964c47765397e1 The preinstall lifecycle script in [email protected] unconditionally sends the installer's hostname, OS username, and current working directory to...
EUVD-2026-75244
An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation during message delivery attempts, occupying a shared broker thread and leading to denial of service. This issue affects Apache Artemis: from 2.50.0 through 2.56.0...
CVE-2026-19583
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...
CLEANSTART-2026-EC45528 Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5
Multiple security vulnerabilities affect the apache-nifi package. Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5. See references for individual vulnerability details...
CVE-2026-19583
CVE-2026-19583 is a permission bypass in Velociraptor (an endpoint forensics and EDR tool by Velocidex). Sensitive artifacts such as Linux.Sys.BashShell require the EXECVE permission to schedule, enabling arbitrary command execution on endpoints. However, no equivalent permission check was enforc...
CVE-2026-19583 Velociraptor Required Permissions bypass by using client monitoring queries
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...
CVE-2026-19583 Velociraptor Required Permissions bypass by using client monitoring queries
Velociraptor allows some sensitive artifacts to be gated by additional permissions. For example, the Linux.Sys.BashShell artifact allows arbitrary command execution on endpoints, and so it requires the EXECVE permission to schedule. However, no such check was implemented for client monitoring...