77965 matches found
awxkit: path traversal via YAML !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.form...
CVE-2026-65053 Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, IMPrender obtains the name of the data part with IMPContents::getPartName, which returns the MIME part's own name parameter as...
CVE-2026-56684
A flaw was found in Valkey. An authenticated client can trigger a CLIENT KILL command while the tlsProcessPendingData function iterates a pending list. This action causes connTLSClose to delete the iterator's cached next node, leading to a use-after-free vulnerability. This flaw, when Transport...
CVE-2026-55564
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can exploit an out-of-bounds read vulnerability in the glyphcacheget function. By sending crafted glyph fragments, the server can cause the client to read beyond the intended memory buffer. This can lead to a client crash...
CVE-2026-77995
Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client 3.2.0, OAuth Single Sign-On – OIDC SSO 1.2.2, Login with Keycloak OAuth Single Sign-On SSO 1.2.2, Single Sign-On for Educational Institutes 1.2.2 - The manipulation of a cookie value allows actors to login a...
CVE-2026-59567
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...
CVE-2026-59568
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...
CVE-2026-59564
An authentication bypass issue exists in communications between affected versions of the Zscaler Client Connector and the Zscaler Client Connector Portal...
CVE-2026-59565
A remotely exploitable buffer overflow bug can cause a local and kernel denial-of-service attack on affected versions of Zscaler Client Connector on Windows...
CVE-2026-59566
A locally exploitable buffer overflow bug can cause a local denial-of-service attack on affected versions of Zscaler Client Connector on Android and ChromeOS...
Sensitive Information Disclosure
Keycloak is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper authorization when retrieving rotated client secrets stored in a secure vault, which allows a delegated administrator with view-only permissions to obtain the actual secret instead of the vault...
CVE-2026-59568 Remote Code Execution
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...
CVE-2026-59568 Remote Code Execution
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...
EUVD-2026-64884
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow remote code execution, giving an unauthenticated, unprivileged user the ability to execute arbitrary code in the ZCC context...
CVE-2026-59568
CVE-2026-59568 covers multiple vulnerabilities in Zscaler Client Connector (ZCC) that allow an unauthenticated, unprivileged remote attacker to achieve remote code execution in the ZCC context. The CNA-assigned CVSS 3.1 score is 9.1 (CRITICAL) , with a network attack vector, low complexity, no pr...
CVE-2026-59567 Local privilege escalation
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...
CVE-2026-59567
Zscaler Client Connector is affected by multiple local privilege escalation vulnerabilities that allow an unprivileged user to execute arbitrary code in a privileged context . The CVSS 3.1 score is 8.8 (HIGH) , with a local attack vector, low complexity, low privileges required, no user interacti...
EUVD-2026-64883
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...
CVE-2026-59567 Local privilege escalation
Multiple vulnerabilities on affected versions of Zscaler Client Connector allow local privilege escalation, giving an unprivileged user the ability to execute arbitrary code in a privileged context...