2333 matches found
CVE-2026-15243 Improper Validation of Certificate in CAS Client
Apereo CAS Client accepts any CA-trusted certificate for any hostname, provided the URL the client is calling matches the configured allowlist or regex. An attacker with a MITM position DNS poisoning, rogue Wi-Fi, malicious proxy, etc. can provide any CA-signed certificate for a hostname that...
EUVD-2026-48140
Unauthenticated Cross Site Request Forgery CSRF in Kwayy HTML Sitemap = 4.0 versions...
EUVD-2026-48136
Contributor Sensitive Data Exposure in TinyMCE Templates = 4.8.1 versions...
EUVD-2026-48188
Unauthenticated Cross Site Scripting XSS in Easy Form Builder = 4.0.12 versions...
EUVD-2026-46475
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...
CVE-2025-60835
CVE-2025-60835 concerns IZArc v4.6, specifically the unrar.dll component, where a path traversal flaw could allow an attacker to access files via crafted input. The connected sources consistently state a path-traversal vulnerability in unrar.dll but do not provide detailed exploit steps, affected...
CVE-2025-60835
An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...
CVE-2025-60835
An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal...
PT-2026-62162
Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description A flaw in the Metadata Plugin of the Oracle Enterprise Manager Base Platform allows a low privileged attacker with network...
CVE-2026-61900 Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6
The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE...
CVE-2026-57310
Windu CMS stores user passwords using a weak scheme: an MD5/SHA1-based hash with a static salt. This design allows an attacker who obtains password hashes to recover credentials. The vulnerability is confirmed in version 4.1 and may affect other versions; exploitation details are not provided in ...
EUVD-2026-45943
A Blind SQL injection vulnerability has been identified in Windu CMS. A remote unauthenticated attacker is able to inject SQL syntax into URL path in HTTP header resulting in Blind SQL Injection. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in versi...
CVE-2026-63845 drm/amdgpu/jpeg: set no_user_fence for JPEG v4.0 ring
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v4.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 8d0cac9478a3f046279c657d6a2545de49ae675a...
ROOT-OS-UBUNTU-2404-CVE-2025-68188 CVE-2025-68188 in rootio-linux - Patched by Root
Root has patched CVE-2025-68188 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2404-CVE-2025-21820 CVE-2025-21820 in rootio-linux - Patched by Root
Root has patched CVE-2025-21820 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
ROOT-OS-UBUNTU-2404-CVE-2026-53140 CVE-2026-53140 in rootio-linux - Patched by Root
Root has patched CVE-2026-53140 in the rootio-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...
GHSA-MHWW-P97M-3368 AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance
Aurora PostgreSQL is a fully managed relational database engine that's compatible with PostgreSQL. The team has identified CVE-2026-11400, an issue in Aurora PostgreSQL using the AWS Advanced JDBC Wrapper Impact An issue in AWS Wrappers for Amazon Aurora PostgreSQL will allow for privilege...
CVE-2026-30618
CVE-2026-30618 affects xszyou Fay 4.3.1, where the MCP STDIO server management and command execution handling can be abused via a publicly exposed MCP management interface to execute arbitrary commands in the Fay service context. Technical details across sources describe an RCE via attacker-contr...
