389519 matches found
CVE-2026-34015: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8...
CVE-2026-44084: Authorization Bypass Through User-Controlled Key
An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later...
PT-2026-115139
Name of the Vulnerable Software and Affected Versions libfsapfs versions prior to 20260922 Description An integer underflow exists in the libfsapfs key encrypted key read data function. This allows attackers to trigger heap out-of-bounds reads by providing a crafted encrypted APFS image with...
CVE-2026-39989: Server-Side Request Forgery (SSRF)
A server-side request forgery SSRF vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read application data. We have already fixed the vulnerability in the following version: Download Station 5.10.1.312...
PT-2026-114948
Name of the Vulnerable Software and Affected Versions Grafana OSS affected versions not specified Grafana Enterprise affected versions not specified Description The data source proxy fails to apply role-based access control to write requests forwarded to Loki data sources. An authenticated user...
CVE-2026-111348: Authorization Bypass Through User-Controlled Key
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the detail, goodsInfo, cancel...
CVE-2026-111150: Out-of-bounds Read
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values, causing DecompressDataBl...
PT-2026-122721
Security vulnerability affects the strimzi-kafka-operator package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
PT-2026-122791
Security vulnerability affects the strimzi-kafka-operator package. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor...
CVE-2025-68403: External Control of System or Configuration Setting
An external control of system or configuration setting vulnerability has been reported to affect QuRouter. If a local attacker gains an administrator account, they can then exploit the vulnerability to modify data on the system. We have already fixed the vulnerability in the following version:...
CVE-2026-76661: Improper Input Validation
A vulnerability in HPE NonStop QIOMON allows an out-of-bounds write that can corrupt buffer data...
PT-2026-115156
Name of the Vulnerable Software and Affected Versions ValleyBell libvgm versions prior to commit a6eed945 Description The PCM data-block decompressor contains a heap out-of-bounds read issue caused by an unbounded compression-table index. An attacker can provide a specially crafted .vgm file...
UBUNTU-CVE-2026-101019
Description NGINX JavaScript njs has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with libxml2 canonicalization. In both the built-in njs and QuickJS backends during the canonicalization process, the $attr$Name getter may return undefined for an...
ALSA-2026:83551 Important: ghostscript security update
The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed. Security Fixes: ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and...
CVE-2026-109829: Origin Validation Error
undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the cache builds its key from the original request URL before the redirect handle...
CVE-2026-0993: Buffer Copy without Checking Size of Input
SODOLA SL902-SWTGW124AS firmware before 200.2.12 contains a buffer overflow vulnerability that allows unauthenticated remote attackers to cause a denial of service by sending an oversized boundary value in the Content-Type header of a crafted POST request. Attackers can exploit the embedded HTTP...
CVE-2026-93484: Improper Neutralization of Special Elements used in an SQL Command
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...
UBUNTU-CVE-2026-93484
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands, leading to data theft, modification, or...
Linux Distros Unpatched Vulnerability : CVE-2026-88842
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox dpkg. The writestatusfile function does not reset a field cursor between package stanzas. When two packages are removed in a single...
libsoup3 security update
3.6.5-20 - CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket message reassembly 3.6.5-19 - CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion 3.6.5-18 - CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket...