3268 matches found
PT-2026-84661
In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an attacker to influence which file is returned by the control's image cache, potentially exposing file contents outside the intended image directories...
PT-2026-84592
The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete function in all versions. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server,...
PT-2026-84898
This module enables you to add extra layer of verification for user registration. The module doesn't sufficiently validate user-supplied input resulting in an account takeover vulnerability...
The vulnerability of the validate_network_url() function in the NLTK library for symbolic and statistical processing allows a attacker to perform an SSRF attack.
The vulnerability of the validatenetworkurl function in the NLTK library for symbolic and statistical processing related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...
The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data and compromise its integrity.
The vulnerability of the WebAppInstalls component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to gain access to sensitive data and compromise its integrity through a specially crafted HTML page...
The vulnerability of the Git repository management system Gitea, related to insufficient validation of server-side requests, allows a hacker to execute a SSRF attack.
The vulnerability of the Git repository management system Gitea is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform a SSRF attack remotely...
The vulnerability of the fsock_get_contents() function in the elFinder file manager allows a hacker to disclose sensitive information that should be protected.
The vulnerability of the fsockgetcontents function in the elFinder file manager is related to insufficient validation of requests on the server side. Exploiting this vulnerability allows a remote attacker to disclose sensitive information that should be protected...
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially crafted HTML page...
The vulnerability of the WebUI components in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data.
The vulnerability of the WebUI components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...
The vulnerability of the HTML component in Google Chrome and Microsoft Edge browsers allows attackers to access confidential data and compromise its integrity.
The vulnerability of the HTML component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data and compromise its integrity through a specially created HTML page...
The vulnerability in the Accessibility component of Google Chrome and Microsoft Edge browsers allows attackers to gain access to confidential data and compromise its integrity.
The vulnerability of the Accessibility component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data and compromise its integrity through a specially created HTML pag...
The vulnerability of the Media component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.
The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created video file...
CVE-2026-84201
appium-mcp-server through 0.1.61 is affected by a path traversal vulnerability in the write_file and write_files_batch tools. The server fails to validate or normalize file paths, allowing an attacker to supply absolute paths or relative paths with parent-directory segments to write files outside...
The vulnerability of the isPublicIP() function in the core/providers/utils/fetch.go file of the data-free synchronization software Bifrost allows a attacker to perform an SSRF attack.
The vulnerability of the isPublicIP function in the core/providers/utils/fetch.go file of the data-free synchronization software Bifrost is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a remote attacker to execute an SSRF attack...
ROS-20260901-73-0029
The vulnerability in the incus is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to cause service failures...
VulnCheck KEV: CVE-2024-0250
The Analytics Insights for Google Analytics 4 AIWP WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can...
CVE-2026-82392
pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...
K000163144: Spring Data vulnerability CVE-2026-41696
Security Advisory Description Spring Data MongoDB repository query methods annotated with @Query that use regex parameter binding perform insufficient validation of the bound parameter. An attacker can supply a crafted string to break out of the intended regular expression quoting. Affected...
EUVD-2026-68374
NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...
CVE-2026-40464 A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP
NSP is vulnerable to a stored XSS due to insufficient validation or encoding of user-controlled input in a workflow application. An authenticated attacker with access to the workflow application could embed harmful code that runs when another user views the content...