40674 matches found
EUVD-2026-43753
Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode...
EUVD-2026-44670
LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests...
MINI-5P6V-HGQX-FG4V
Bulletin has no description...
CVE-2026-32822
Technical details are not publicly available in the provided documents. No specific affected versions, vulnerable components, or fixes are disclosed here. Monitor for updates.
CVE-2026-32822
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash...
MINI-HMM7-RF2X-QQRP
Bulletin has no description...
atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen
A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to /GoToR actions. This issue allows an attacker to...
Vulnerability of the DOM component: Mozilla Firefox’s navigation feature allows attackers to compromise the privacy and integrity of protected information.
Vulnerability of the DOM component: Mozilla Firefox’s navigation mechanism is associated with deficiencies in access control. Exploiting this vulnerability can allow an attacker to compromise the confidentiality and integrity of protected information...
TencentOS Server 2: compat-poppler022 (TSSA-2026:0651)
The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0651 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...
The vulnerability of the R7-Officer corporate server’s document editor lies in the lack of protective measures for the website structure, allowing attackers to execute arbitrary JavaScript code.
The vulnerability of the R7-Officer corporate server document editor is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow an attacker to execute arbitrary JavaScript code...
The vulnerability of the R7-Officer corporate server’s document editor, related to improper code generation, allows a perpetrator to gain unauthorized access to protected information or execute arbitrary code.
The vulnerability of the R7-Officer corporate server’s document editor is related to improper handling of code generation. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or execute arbitrary code...
TencentOS Server 3: evince (TSSA-2026:0620)
The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0620 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...
MINI-P3JG-8FMH-8WRH
Bulletin has no description...
Updated perl-CSS-Minifier-XS package fixes a security vulnerability
The updated package fixes a security vulnerability: CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. CVE-2026-13593...
XML External Entity (XXE) Injection
Overview net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net. Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS...
MINI-5PG7-8JMX-4MCR
Bulletin has no description...
MINI-JC7F-8QMV-7HVH
Bulletin has no description...
CVE-2026-45703 Pimcore: WordExport Authorization Bypass for Unauthorized Document Export
Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 LTS and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/Controller/TranslationController.php only checks the wordexport feature permission and directly resolves attacker-controlled type/id input...