openssh: OpenSSH: sftp client allows attacker to control downloaded file location

A flaw was found in OpenSSH. The sftp client, when used to download files from a malicious server with the 'sftp server:/path .' command, does not properly restrict where those files are saved. This allows an attacker to control the download location, potentially overwriting existing files or...

LibreOffice: LibreOffice: Denial of Service via crafted OOXML documents

A flaw was found in LibreOffice. A remote attacker could exploit this out-of-bounds write vulnerability by tricking a user into opening a specially crafted OOXML Office Open XML document with mismatched encryption salt parameters. This could lead to a denial of service DoS, making the application...

ROS-20260709-73-0022

The vulnerability in portainer-ce is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

Node.js Koa Data Compromise

The vulnerability of the Node.js Koa web framework is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of the protected information...

Enterprise Infrastructure Security Component Data Compromise

The vulnerability of the Enterprise Infrastructure Security component of the JD Edwards EnterpriseOne Tools system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of protected...

Enterprise Infrastructure Security Component Data Compromise

The vulnerability of the Enterprise Infrastructure Security component of the JD Edwards EnterpriseOne Tools management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility o...

D-Link DNS-120 Local_Backup_Info Buffer Overflow

The vulnerability of the LocalBackupInfo function in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 devices is related to buffer...

D-Link UPnP_AV_Server_Path_Setting Function Use-After-Free

The vulnerability of the UPnPAVServerPathSetting function in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 devices is related to...

Prismata: Confining Cross-Site Prompt Injection in Web Agents

Autonomous web agents promise to automate everyday browsing tasks, but inherit one of the web's oldest attack surfaces. Cross-Site Scripting proved that mixing trusted and untrusted content is dangerous, even on benign pages. Agents resurface this risk by interpreting natural language as...

PT-2026-121033

Уязвимость компонента Extensions веб-браузеров Google Chrome и Microsoft Edge связана с недостаточной проверкой состояния совместно используемого ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность защищаемой информации...

PT-2026-121035

Уязвимость компонента InterestGroups веб-браузеров Google Chrome и Microsoft Edge связана с ошибками авторизации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность защищаемой информации с помощью специально созданного PDF файла...

PT-2026-120971

Уязвимость компонента Isolated веб-браузеров Google Chrome и Microsoft Edge связана с неправильной авторизацией. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на целостность защищаемой информации с помощью специально созданной HTML-страницы...

D-Link DNS-120 DNS-Schedule Info Function Use-After-Free

The vulnerability of the DownloadsScheduleInfo function in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 devices is related to buffe...

LibreOffice Buffer Overflow DoS

The vulnerability of the LibreOffice office software package is related to overflowing buffers in dynamic memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information through a specially created document...

D-Link DNS-120 CGI Addgroup Get Group Quota Minsize Buffer Overflow

The vulnerability of the cgiaddgroupgetgroupquotaminsize function in the /cgi-bin/accountmgr.cgi script of the D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4,...

Webdav_Upload_File D-Link DNS-120

The vulnerability of the WebdavUploadFile function in the /cgi-bin/webdavmgr.cgi script of the D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and...

D-Link DNS-120 CGI Set Wto Buffer Overflow

The vulnerability of the cgisetwto function in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 devices is related to errors in privile...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper enforcement of the Certificate Revocation List on the gRPC listener when separate listeners are configured for HTTP and gRPC client endpoints. An attacker can gain unauthorized access and...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper enforcement of the Certificate Revocation List on the gRPC listener when separate listeners are configured for HTTP and gRPC client endpoints. An attacker can gain unauthorized access and...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper enforcement of the Certificate Revocation List on the gRPC listener when separate listeners are configured for HTTP and gRPC client endpoints. An attacker can gain unauthorized access and...