55774 matches found
CVE-2026-34092 Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from before 1.43.7, 1.44.4, 1.45.2...
CGA-39XV-9C7F-HMMH
Bulletin has no description...
PT-2026-39591
ATutor is vulnerable to Reflected XSS in /install/install.php endpoint. An attacker can provide a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Product is no longer actively supported. Maintainers of this project were notified early...
PT-2026-39725
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiar docfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping th...
CVE-2026-38569
HireFlow v1.2 is vulnerable to Cross Site Scripting XSS in candidatedetail.html via the Resume or Feedback Comment fields via POST /candidates/add or POST /feedback/add...
PT-2026-39751
Name of the Vulnerable Software and Affected Versions Audiobookshelf versions prior to 2.32.2 Description The server fails to limit the file size of uploads and the decompressed size of entries within ZIP files. An administrator can upload a specially crafted .audiobookshelf ZIP file to the 'POST...
CVE-2026-42871: Exposure of Sensitive Information to an Unauthorized Actor
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiardocfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping the...
CVE-2021-47946
OpenCart 3.0.3.6 contains a cross-site request forgery vulnerability in the /account/edit endpoint that allows unauthenticated attackers to modify victim account details by tricking users into visiting malicious pages. Attackers can craft CSRF payloads that change victim email addresses and accou...
CVE-2021-47949
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to...
CVE-2021-47949 CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to...
CGA-2484-JJR2-5PX7
Bulletin has no description...
CGA-8RP5-3Q4V-CHW3
Bulletin has no description...
GHSA-HM8Q-7F3Q-5F36 vulnerabilities
Vulnerabilities for packages: langfuse-fips, commercial-gitlab-rails-ee, wazuh-dashboard, wazuh-dashboard-fips, langfuse, librechat, opensearch-dashboards, opensearch-dashboards-fips, kibana, commercial-gitlab-rails-ee-fips...
CGA-7R9J-P638-77WP
Bulletin has no description...
CGA-8MXM-P9GJ-V425
Bulletin has no description...
CGA-4G7H-469C-PHMC
Bulletin has no description...
CGA-5H53-Q2F8-C6PP
Bulletin has no description...
CGA-5QH5-22JC-QM9P
Bulletin has no description...
CVE-2026-8215
A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This vulnerability affects the function iasRequestFileEvent of the component RMI Interface. This manipulation of the argument mstrSourceFileName causes path traversal. The attack can be initiated remotely. The...