76515 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-65412
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gat...
Linux Distros Unpatched Vulnerability : CVE-2026-87799
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an...
Linux Distros Unpatched Vulnerability : CVE-2026-85185
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated...
PT-2026-102646
Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host versions prior to 15.82 Description Improper path validation in the local IPC Inter-Process Communication service allows a local authenticated user with low privileges to perform arbitrary file writes with...
PT-2026-102645
🚨 CVE-2026-102630 UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect...
UBUNTU-CVE-2026-100395
lxc-copy host-context hostname update follows symlink...
CVE-2026-97024: UNIX Symbolic Link (Symlink) Following
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...
CVE-2026-93330: Incorrect Behavior Order
Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset...
CVE-2026-92371: Improper Link Resolution Before File Access
TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Recording CSR functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged...
CVE-2026-92370: Improper Access Control
An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows an authenticated remote attacker to bypass user-configured permission settings during session establishment. By modifying access control parameters for...
CVE-2026-92369: Time-of-check Time-of-use (TOCTOU) Race Condition
TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer,...
CVE-2026-92368: Heap-based Buffer Overflow
TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user...
CVE-2026-102630: Use of Less Trusted Source
UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading ...
CVE-2026-102715: Out-of-bounds Write
Any host on the LAN can send two mDNS records and make the responder write past the end of its transmit packet. The string table stores each name in a slot rounded up to a multiple of four: c / addons/mdns/nxdmdns.c:11436, 11443, 11447 / memorylen = memorylen & 0xFFFFFFFC + 8 & 0xFFFFFFFF; ... le...
CVE-2026-103043: Inefficient Regular Expression Complexity
anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking. Attackers can supply specially crafted input strings with repeated patterns to cause exponential regex engine backtracking, blocking the Node.js...
CVE-2026-53988: Missing Authentication for Critical Function
Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send...
EUVD-2026-70280
fast-uri vulnerable to authority injection via an unvalidated port in serialize...
NPM: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
NPM: fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority vulnerability discovered by ? in WordPress Npm fast-uri versions 2.4.5...
fast-uri vulnerable to host confusion via an unclosed bracket in the URI authority
Impact fast-uri accepts a host that contains an unbalanced or misplaced authority bracket or without reporting an error. A host that starts with but does not end with , such as @127.0.0.1, is neither validated as an IP literal nor canonicalized as a domain name, so parse returns it as the host wi...