68749 matches found
CVE-2026-16969
Affected product: IRIS web application (version 2.4.26 and possibly others). Vulnerability: Stored cross-site scripting (XSS) in the assets function. Impact: High (CVE-2026-16969, CVSS v3.1 base score 7.6) with confidentiality impact elevated; requires user interaction and has network access with...
CVE-2026-16969 DFIR-IRIS Stored XSS in Assets
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
CVE-2026-16969
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
EUVD-2026-51069
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
UBUNTU-CVE-2026-16529
A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...
EUVD-2026-50978
A flaw was found in the PCP Performance Co-Pilot pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service...
CVE-2026-16529 Pcp: pcp: denial of service due to signed integer overflow
A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...
CVE-2026-16529
A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...
EUVD-2026-50977
A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...
CVE-2026-16529
Affects Performance Co-Pilot (PCP) components pmlogger/pmcd; issue is a signed integer overflow in PCP __pmGetPDU() that can be triggered by crafted network packets during PDU processing or SASL negotiation, permanently blinding the daemon and causing DoS on subsequent reads. Mitigation (per Red ...
undici: Undici: Cookie attribute injection allows bypassing security protections
A flaw was found in undici, where its setCookie function does not fully sanitize cookie attributes. A remote attacker could exploit this by providing specially crafted input to the domain or unparsed fields, leading to the injection of additional cookie attributes. This vulnerability can allow an...
CVE-2026-64473
A flaw was found in the VFIO Virtual Function I/O subsystem of the Linux kernel. During device unregistration, debugfs a diagnostic filesystem entries might remain visible with outdated or "stale" data after the associated resources have been released. This occurs because the debugfs entries are...
CVE-2026-64460
A flaw was found in the Linux kernel's PCI/IOV subsystem. When a PCI device fails to respond during a power state transition, the kernel's Virtual Function VF Resizable Base Address Register BAR restoration process can attempt to access memory outside of its allocated bounds. This out-of-bounds...
CVE-2026-59952
Valibot has a concrete vulnerability CVE-2026-59952 in versions prior to 1.4.2 where record() can produce issue paths containing attacker-controlled Object.prototype-like keys (e.g., toString, valueOf, hasOwnProperty). When flatten() processes these issues, flatErrors.nested[dotPath] resolves to ...
EUVD-2026-50573
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-27, a heap buffer over-write can occur in the fx operation by passing a crafted argument. This issue has been fixed in version 7.1.2-27...
PT-2026-66470
Missing authentication for critical function vulnerability in FTC Software IT Services FTC E-Commerce Management Panel allows Authentication Bypass. This issue affects FTC E-Commerce Management Panel: before 1.0.2...
(Pwn2Own) Phoenix Contact CHARX SEC-3150 ModBus Server Exposed Dangerous Function Denial-of-Service Vulnerability
This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CharxModbusServer, which listens on...
PT-2026-66527
SQLite 3.41 is vulnerable to use after free in the jsonExtractFunc function. Premature release of parsed JSON object memory leads to subsequent illegal access of freed pointer. Remote attackers can trigger this flaw via specially crafted SQL queries, resulting in service crash and sensitive memor...