389145 matches found
CVE-2026-110141
Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...
CVE-2026-111162: Out-of-bounds Read
WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser WMParseNewHmp that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing application...
CVE-2026-110909: Improper Restriction of Communication Channel to Intended Endpoints
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...
CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...
UBUNTU-CVE-2026-101337
When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attackers to overwrite the stack with up to 64K of attacker controlled data. Zone files which are written out by NSD itself, such as for zones for which the NSD...
PT-2026-115276
Name of the Vulnerable Software and Affected Versions OpenHealth versions prior to 0.2.1 Description Missing authentication and authorization in the '/api/health-data/id' GET, PATCH, and DELETE handlers allow unauthenticated attackers to access medical records. By knowing a HealthData record id, ...
PT-2026-114443
Name of the Vulnerable Software and Affected Versions Wheels CLI versions prior to 4.1.1 Description The software fails to verify that the local development server responding to HTTP requests is associated with the current project. A malicious process listening on a targeted local port can...
PT-2026-115141
Name of the Vulnerable Software and Affected Versions libfwsi versions prior to 20260523 Description A heap out-of-bounds read occurs in the libfwsi mtp volume values read data function. This issue allows attackers to read data beyond the allocated buffer by using specially crafted MTP volume she...
CVE-2026-26243: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central...
CVE-2026-109686: Deserialization of Untrusted Data
Deserialization of Untrusted Data vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Object Injection.This issue affects Link Whisper Free: from n/a through 0.9.7...
CVE-2025-66275: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...
Oracle Linux 10 : ghostscript (ELSA-2026-83551)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83551 advisory. - CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data Tenable has extracted the preceding...
Oracle Linux 9 : ghostscript (ELSA-2026-83553)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83553 advisory. - RHEL-273957 CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data Tenable has extracted the...
Oracle Linux 10 : libsoup3 (ELSA-2026-83618)
The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-83618 advisory. - CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket message reassembly - CVE-2026-102556 libsoup3: libsoup: Heap buffer overfl...
PT-2026-114948
Name of the Vulnerable Software and Affected Versions Grafana OSS affected versions not specified Grafana Enterprise affected versions not specified Description The data source proxy fails to apply role-based access control to write requests forwarded to Loki data sources. An authenticated user...
CVE-2026-34015: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...
CVE-2026-44084: Authorization Bypass Through User-Controlled Key
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...
CVE-2025-68403: External Control of System or Configuration Setting
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...
CVE-2026-111312: Missing Authentication for Critical Function
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...