3281 matches found
CVE-2026-38719
OpENer v2.3-558-g1e99582 contains an out-of-bounds read vulnerability in the Common Packet Format CPF parser, specifically in CreateCommonPacketFormatStructure in source/src/enetencap/cpf.c. A crafted ENIP/CPF message can supply an attacker-controlled itemcount value that is not consistently...
MINI-34MP-QFQX-W95W
Bulletin has no description...
MINI-HX37-MCVF-JVJP
Bulletin has no description...
CGA-MC7P-CJ26-V5P2
Bulletin has no description...
MINI-5R9H-CHC7-PQQ7
Bulletin has no description...
MINI-8XJ4-MPHP-86QR
Bulletin has no description...
MINI-MJP8-7M8H-3H95
Bulletin has no description...
ECHO-C2CF-7660-2DC1
Bulletin has no description...
ECHO-E755-2177-A945
Bulletin has no description...
MINI-72QC-CJ34-GCQW
Bulletin has no description...
MINI-PQMQ-9XMX-V468
Bulletin has no description...
MINI-73WP-FQ7J-CVWG
Bulletin has no description...
Update 26.12 for Microsoft Dynamics 365 Business Central 2025 Release Wave 1 (Application Build 26.12.48244, Platform Build 26.0.48120)
None None...
RUSTSEC-2026-0140 DNS rebinding and cross-origin CSRF in dynoxide's MCP HTTP transport
dynoxide's MCP HTTP transport was vulnerable to DNS rebinding via its transitive rmcp dependency, plus a related cross-origin CSRF gap. A malicious web page could make the user's browser send requests to a local dynoxide mcp --http or dynoxide serve --mcp server with a non-loopback Host header,...
CGA-HQR7-C5MP-M37P
Bulletin has no description...
MINI-Q5FF-V2MH-7WGW
Bulletin has no description...
CVE-2026-8221
A flaw has been found in Devs Palace ERP Online up to 4.0.0. This impacts an unknown function of the file /inventory/item-save. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacte...
CVE-2026-42883
Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the GET /api/libraries/:id/download endpoint validates that the requesting user has access to the library specified in the URL path, but fetches downloadable items solely by attacker-provided IDs without constraining...