180484 matches found
The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager lies in the lack of a mechanism for verifying input data during backup scenarios. This allows a malicious actor to execute arbitrary code with SYSTEM privileges.
The vulnerability of the software for calculating positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager is related to deficiencies in the mechanism for verifying input data during backup scenario execution. Exploiting this vulnerability could allow an attacker, operating...
The vulnerability of the Directum HR Pro system, which exists due to insufficient verification of input data, allows a perpetrator to disclose protected information.
The vulnerability of the Directum HR Pro system exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to disclose protected information by sending a specially crafted POST request...
The vulnerability of the Directum Web Agent component of the Directum RX system, which arises due to insufficient validation of input data, allows a perpetrator to execute arbitrary code.
The vulnerability of the Directum Web Agent component of the Directum RX system exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using a specially crafted file...
CVE-2026-72573
An OS command injection vulnerability in 4xmen/pm2panel all versions allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec'pm2 restart ' + id without input...
CVE-2026-72571
A path traversal vulnerability in mustafaakin/cast-localvideo all versions allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the user-supplied req.body.dir parameter directly to res.sendFile without sanitization, enabling...
CVE-2026-72572
A path traversal vulnerability in o1lab/xmysql all versions allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.joincwd, name without sanitization before...
CVE-2026-72580 duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
CVE-2026-72580
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directl...
CVE-2026-60074
A flaw was found in Date::Manip. This vulnerability allows an attacker to provide specially crafted input containing non-ASCII decimal digits to the Date::Manip library for Perl. The library's parsing logic incorrectly processes these digits, truncating the input and resulting in an inaccurate da...
CVE-2026-21083
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...
CVE-2026-21083
CVE-2026-21083 affects Samsung Smart Switch software with improper input validation in versions before 3.7.72.6, enabling adjacent attackers to access sensitive data (confidentiality impact high). The description indicates the vulnerability is fixed in 3.7.72.6 or later; update to that version or...
EUVD-2026-55108
Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data...
CVE-2026-21073
CVE-2026-21073 affects Galaxy Themes prior to the SMR Aug-2026 Release 1. Description: improper input validation could allow a physical attacker to launch arbitrary activity. CVSS v4.0 score is 5.2 (Medium) with Attack Vector: Physical, Attack Complexity: Low, Privileges Required: None, User Inte...
CVE-2026-21073
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...
EUVD-2026-55098
Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity...
EUVD-2026-55097
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...
CVE-2026-21072
Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory...
CVE-2026-21072
The CVE-2026-21072 entry concerns the VC1 codec in libsavsvc.so, where improper input validation enables a local attacker to cause out-of-bounds memory writes. This indicates a local-privilege impact, with CVSSv4.0 vector reflecting Local Access, Low Attack Complexity, and no user interaction req...
CVE-2026-21071
The CVE-2026-21071 issue affects the MPEG4 codec component inlibsavsvc.so and is caused by improper input validation, enabling a local attacker to write out-of-bounds memory. Impact per provided metrics is low across confidentiality, integrity, and availability (local access, no user interaction,...