12010 matches found
EUVD-2026-51419
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...
CVE-2026-14922
WP Photo Album Plus is affected by a stored cross-site scripting (XSS) vulnerability affecting all versions up to 9.2.03.001. The flaw arises in the photo-comment pipeline due to a decode-after-sanitize (double-encoding) sequence: on write, wppa_do_comment() sanitizes input with wppa_filter_html(...
CVE-2026-56671
The CVE-2026-56671 affects ComfyUI prior to 0.28.0. Root cause: get_model_preview in app/model_manager.py constructs a path using os.path.join(folder, filename) with an unrestricted {filename} capture, allowing path traversal via literals like ../, encoded traversal, absolute paths, or an unbound...
EUVD-2026-51401
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, getmodelpreview in app/modelmanager.py joins an unrestricted filename route capture to a selected model directory without a containment check, allowing an unauthenticated remote attacker to us...
EUVD-2026-51357
The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session TCP port 102, the decoder may advance its internal read position incorrectly, leading to a he...
EUVD-2026-51342
The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...
EUVD-2026-51340
The MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This...
PT-2026-66678
Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.28.0 Description An unauthenticated remote attacker can read image-decodable files and enumerate host paths. The get model preview function in app/model manager.py uses os.path.joinfolder, filename with an...
The vulnerability of the XmlLayout() function in the Apache Log4j Core library allows attackers to compromise the integrity of the protected information.
The vulnerability of the XmlLayout function in the Apache Log4j Core logging library is related to improper encoding or escaping of output data. Exploiting this vulnerability allows an attacker to influence the integrity of the protected information from a remote location...
Security update for yq (important)
openSUSE security update: security update for yq ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21500-1 Rating: important References: bsc1267199 bsc1271994 Cross-References: CVE-2026-39821 CVE-2026-56852 CVSS scores: CVE-2026-39821 SUSE : 7.4...
CVE-2026-65421
The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...
CVE-2026-63550
The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session TCP port 102, the decoder may advance its internal read position incorrectly, leading to a he...
CVE-2026-63550
The CVE-2026-63550 issue affects the MMS BER decoder, where a boundary-handling flaw in processing certain fields of confirmed-request messages can cause the decoder to advance its read position incorrectly on receiving a BER-encoded element over an established MMS session (TCP port 102). This ma...
CVE-2026-65421 MZ Automation libiec61850 Out-of-bounds Read
The MMS BER decoder contains a flaw in decoding fixed-width BER fields boolean/integer: an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-service condition...
CVE-2026-66349
The CVE-2026-66349 entry concerns the MMS server connection handler. A flaw in processing BER-encoded request data occurs when an MMS confirmed request PDU with an extended BER tag is received over an established session, where a missing bounds check can cause the decoder to advance its internal ...
CVE-2026-62663
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters image, audio, video, document in banks accept untrusted user input as file paths via Pathvalue and pass them directly to openfilepath, "rb" without any path sanitization,...
SUSE CVE-2026-54066
SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 "Path Traversal via Double URL Encoding" sanitized the /export/ route but the identical root cause remains in the /assets/path route. In publish mode anonymous read-only HTTP endpoint,...
CVE-2026-62663 Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)
Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, all four media filters image, audio, video, document in banks accept untrusted user input as file paths via Pathvalue and pass them directly to openfilepath, "rb" without any path sanitization,...
CVE-2026-62663
CVE-2026-62663 affects Banks: in versions before 2.4.4, all media filters (image, audio, video, document) accept untrusted user input as file paths via Path(value) and pass them to open(file_path, "rb") without path sanitization or directory restriction. An attacker who controls template variable...
