65985 matches found
PT-2026-51047
Name of the Vulnerable Software and Affected Versions py7zr version 1.1.0 Description An arbitrary file write issue exists when using the extractall function to extract an archive. The software fails to properly restrict the targets of symbolic links, allowing crafted malicious symbolic link chai...
Dell iDRAC Tools < 11.4.1.0 Improper Link Resolution (DSA-2026-239)
According to its self-reported version, the Dell iDRAC Tools installation on the remote host is affected by a link following vulnerability. Dell iDRAC Tools, versions prior to 11.4.1.0, contains an Improper Link Resolution Before File Access 'Link Following' vulnerability. A low privileged attack...
CVE-2026-9692
creationtimestamp| type| source ---|---|--- 2026-06-18 23:05:39+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3molwvis6v62q...
CVE-2026-45696
creationtimestamp| type| source ---|---|--- 2026-06-18 21:53:42+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molsuubd7i2r...
GHSA-G7M4-839X-CH6V spomky-labs/otphp: Unbounded digits parameter in a provisioning URI triggers an uncaught DivisionByZeroError in OTP generation
Summary The digits parameter parsed from a provisioning URI is validated only with a lower bound $value 0 and has no upper bound src/OTP.php:353-357. OTP generation computes $code % 10 $this-getDigits src/OTP.php:283. When digits is large enough that 10 digits overflows PHP's integer range and th...
CVE-2026-12407
creationtimestamp| type| source ---|---|--- 2026-06-18 20:37:54+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3molonccrzh25...
CVE-2025-15661 libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c
libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSHFXPNAME response...
CVE-2026-25865
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll ControlRunDLL input.dll. Attacker...
EUVD-2026-37940
Punto Switcher through 4.5.0.583 contains an unquoted search path element vulnerability that allows local attackers to execute arbitrary code by exploiting the application's call to WinExec without a fully qualified path for RunDll32.exe when invoking shell32.dll ControlRunDLL input.dll. Attacker...
CVE-2026-25865
CVE-2026-25865 affects Punto Switcher 4.5.0.583. The vulnerability is an unquoted search path element invoked via WinExec when calling RunDll32.exe for shell32.dll Control_RunDLL input.dll, enabling local arbitrary code execution if an attacker places a malicious executable earlier in the search ...
CVE-2025-32437
creationtimestamp| type| source ---|---|--- 2026-06-18 18:36:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molhuccpkl2s...
CVE-2025-53114
creationtimestamp| type| source ---|---|--- 2026-06-18 18:31:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molhldqehf2o...
CVE-2025-32392
creationtimestamp| type| source ---|---|--- 2026-06-18 17:56:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3molfnd4he22i...
GHSA-WM69-2PC3-RMMF
creationtimestamp| type| source ---|---|--- 2026-06-18 17:41:53+00:00| seen| https://gist.github.com/alon710/828a99d5b9580f4196005661c9b07d2d...
CVE-2026-46580
creationtimestamp| type| source ---|---|--- 2026-06-18 17:23:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moldrmjype2w...
CVE-2026-44688
creationtimestamp| type| source ---|---|--- 2026-06-18 17:18:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moldio2t3o2x...
CVE-2026-12565
creationtimestamp| type| source ---|---|--- 2026-06-18 17:11:50+00:00| seen| https://gist.github.com/alon710/8812bad8b22fe18c159a9af87742e425...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the writer field's link and email marks. An attacker can execute arbitrary JavaScript code in the context of the authenticated user's browser session by injecting a malicious link and tricking the user into...