66684 matches found
CVE-2026-84942
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...
CVE-2026-52486
An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module...
CVE-2026-84942
This stored cross-site scripting (XSS) vulnerability affects OpenSearch Dashboards . The root cause is a flaw in the checkForFunctionProperty validation routine within the Vega expression function, which failed to recurse into arrays of objects, allowing a function property nested inside an array...
CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...
EUVD-2026-74074
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...
CVE-2026-84942 Stored Cross-Site Scripting via Vega Expression Function Bypass in OpenSearch Dashboards
Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The...
CVE-2026-85384
A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a crafted configuration file to trigger th...
Exploit for Type Confusion in Google Chrome
CVE-2026-85046 Saw the other POC of this and I thought to mys...
EUVD-2026-73942
A stack-based buffer overflow vulnerability exists in the httpd component of RE210 AC750 due to improper bounds checking in the splitString function when processing an uploaded configuration file. An authenticated attacker on the local network can upload a crafted configuration file to trigger th...
CVE-2026-86669
A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now publi...
CVE-2026-73004
Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally...
CVE-2026-72964
Missing authentication for critical function in Windows Internet Connection Sharing ICS allows an authorized attacker to perform tampering locally...
CVE-2026-69554
Missing authentication for critical function in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally...
CVE-2026-69528
Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally...
CVE-2026-69321
Missing authentication for critical function in Windows Power Dependency Coordinator allows an authorized attacker to perform tampering locally...
EUVD-2026-74020
In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
WordPress ilGhera Reviso Exporter for WooCommerce plugin <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function vulnerability
Missing Authorization to Authenticated Subscriber+ Agreement Grant Token Deletion via disconnectcallback Function vulnerability discovered by Legion Hunter in WordPress Plugin ilGhera Reviso Exporter for WooCommerce versions = 1.2.3...
EUVD-2026-73771
Missing authentication for critical function in Windows Autopilot allows an authorized attacker to perform tampering locally...
EUVD-2026-73449
A vulnerability was detected in aircheng-org iWebShop-5 up to 5.15. This affects the function Login of the file controllers/systemseller.php. Performing a manipulation of the argument Name results in improper authentication. It is possible to initiate the attack remotely. The exploit is now publi...