20741 matches found
VulnCheck KEV: CVE-2026-20349
Cisco Secure Firewall Adaptive Security Appliance ASA and Secure Firewall Threat Defense FTD contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service DoS condition...
CVE-2025-30238
In affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings...
CVE-2026-72902
creationtimestamp| type| source ---|---|--- 2026-08-10 20:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msqx5bpxs72r...
CVE-2026-72886
creationtimestamp| type| source ---|---|--- 2026-08-10 20:32:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msqwzpb62x2g 2026-08-10 21:00:47+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3msqymyf7po2t...
EUVD-2026-55725
Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...
CVE-2026-56619
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...
EUVD-2026-55668
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...
CVE-2026-56619
CVE-2026-56619 affects HCL BigFix Mobile. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient validation and output encoding of user-controlled input. The CVSS v3.1 base score is 5.4 (Medium) with Network attack, Low attack complexity, Privileges Required: Low...
CVE-2026-12984 Exposure of Sensitive Information to an Unauthorized Actor in Zyxel's WAH7601
Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026...
CVE-2026-72590
creationtimestamp| type| source ---|---|--- 2026-08-10 11:44:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mspzjjbxlo2u 2026-08-10 12:22:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/f7f7kexouu4m2...
The vulnerability of the smp_cmdPairingReq() function in the net/bluetooth/smp.c module of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the smpcmdPairingReq function in the net/bluetooth/smp.c module of the Linux operating system is related to insufficient security checks for protected connections. Exploiting this vulnerability could allow a remote attacker to compromise the confidentiality, integrity, and...
The vulnerability of the REST API interface implementation of the Splunk Enterprise platform for operational analysis allows a perpetrator to disclose protected information.
The vulnerability of the REST API implementation of the Splunk Enterprise platform for operational analysis is related to insufficient protection of sensitive data when the |rest command is executed. Exploiting this vulnerability allows a malicious actor to disclose sensitive information by sendi...
CGA-35WW-WRGV-276W
Bulletin has no description...
NPM: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
NPM: crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain vulnerability discovered by ? in WordPress Npm crypto-js versions 4.0.0...
GHSA-RG76-677X-56Q9 crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Summary CryptoJS.lib.WordArray.random in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware...
OSEC-2026-14 RSA signature verification raises undocumented exception
The RSA decrypt and encrypt functions raise an Invalidargument exception if the message is smaller than 2. This leads to X509 certificates with a signature value of 0 or 1 to throw this Invalidargument exception instead of a proper error. Fix The fix is to reuse the Insufficientkey exception, whi...
EUVD-2026-54269
Insufficient validation of untrusted input in Contextual Tasks in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: High...
libaom: libaom: remote code execution via SVC layer context handling with attacker-controlled frames
A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC Scalable Video Coding layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer contex...
Insufficient Verification of Data Authenticity
Overview org.apache.cxf:cxf-rt-rs-security-oauth2 is a services framework. Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the JwtRequestCodeFilter process. An attacker can override security-sensitive parameters such as codechallenge,...
CVE-2026-0637
The CVE pertains to WS02 products where an Event Publisher output adapter configured with irrelevant properties logs those properties without proper validation or sanitization. This can expose sensitive data (e.g., user credentials) to anyone with access to the wso2carbon logs, enabling unauthori...