16800 matches found
CVE-2026-41875
The Quick.Cart software contains a Cross-Site Request Forgery (CSRF) vulnerability within the admin config panel . An attacker can craft a malicious website that, when visited by an administrator, automatically sends a POST request to modify the administrator's login credentials and password. Whi...
CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...
CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...
PT-2026-102461
Name of the Vulnerable Software and Affected Versions Apache Karaf affected versions not specified Description An issue exists in the org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties function, which supports the config MBean and config shell commands. The software deriv...
PT-2026-102818
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The update config MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
CVE-2026-79535
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
CVE-2026-41875: Cross-Site Request Forgery (CSRF)
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...
PT-2026-102507
Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...
CVE-2026-79535: Improper Neutralization of Special Elements used in an OS Command
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
EUVD-2026-89361
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
CVE-2026-79535
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
CVE-2026-79535
mbailey VoiceMode = 8.10.1 is vulnerable to OS Command Injection. The updateconfig MCP tool and the "voicemode config set" CLI writes a caller-supplied value into /.voicemode/voicemode.env without shell-safe escaping...
CVE-2026-79535
The mbailey VoiceMode software (versions
PT-2026-102493
Name of the Vulnerable Software and Affected Versions U-Boot versions prior to 2026.07 Description When configured with the CONFIG IP DEFRAG=y parameter, the software fails to clear the IP reassembly state after delivering a complete datagram. This allows an attacker capable of delivering...
PT-2026-102810
Name of the Vulnerable Software and Affected Versions simple-git versions prior to 4.0.0 Description The default blockUnsafeOperationsPlugin fails to fully reject configuration includes provided via customArgs to the git.clone function. This allows Git to load an attacker-controlled configuration...
K000163433: Spring Cloud vulnerability CVE-2026-41002
Security Advisory Description The base directory spring.cloud.config.server.git.basedir used by the Spring Cloud Config Server to clone Git repositories to is susceptible to time-of-check-time-of-use TOCTOU attacks. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 inclusive; upgrade ...
CVE-2026-12264
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...
CVE-2026-12264 Authenticated File Write via HA Failover Config Upload leads to RCE
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...
CVE-2026-12264 Authenticated File Write via HA Failover Config Upload leads to RCE
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...