235814 matches found
CVE-2026-48750
CVE-2026-48750 is a critical (CVSS 9.9) arbitrary file write vulnerability in Incus (system container and VM manager) prior to version 7.2.0 . The record-output parameter of the /instances/$name/exec endpoint follows a symlink at exec-output inside a crafted image, allowing an attacker to write a...
CVE-2026-48750 Incus has an arbitrary file write on host via `exec-output` symlink in crafted image
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...
CVE-2026-48750
Incus is a system container and virtual machine manager. Prior to version 7.2.0, the record-output parameter of the /instances/$name/exec endpoint stores the output of the command in the exec-output directory of the instance. If exec-output is a symlink, file named execUUID.stdout and...
EUVD-2026-63976
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...
CVE-2026-48749 Incus has an arbitrary file read+write on host via rootfs/ symlink in malicious image
Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 fixes the issue...
ROOT-APP-NPM-CVE-2021-23358 CVE-2021-23358 in underscore - Patched by Root
Root has patched CVE-2021-23358 in the underscore package for Root:npm. Multiple fixed versions available...
CVE-2026-76233
A flaw was found in Renovate. This command injection vulnerability exists within the gleam manager, where the 'depName' parameter is not properly sanitized when appended to 'gleam deps update' commands. An attacker with repository write access can exploit this by crafting malicious 'gleam.toml'...
CVE-2026-16576
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...
WordPress WP Project Manager Pro plugin <= 4.0.1 - SQL Injection vulnerability
SQL Injection vulnerability discovered by dutafi in WordPress Plugin WP Project Manager Pro versions = 4.0.1...
CVE-2026-16576 Dokan < 5.0.14 - Shop Manager+ Arbitrary Plugin Installation/Activation via REST API
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not correctly check user capabilities on some of its admin REST API routes, checking only for a WooCommerce management capability instead of the Dokan: AI Powered WooCommerce Multivendor...
CVE-2026-16576
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 contains an improper access control flaw in its admin REST API routes. The affected endpoints check only for a WooCommerce management capability rather than the required Dokan-installation capability...
CVE-2026-77682
A code injection vulnerability exists in Epiphany when the user invokes form autofill from the context menu on a page containing a malicious HTML form. In embed/web-process-extension/resources/js/ephyautofill.js, getSelector builds a CSS selector by directly interpolating an element's id attribut...
CVE-2026-74979
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Add-ons Manager component...
SUSE CVE-2026-65611
nnn does not sanitize the path variable. An attacker can create a directory on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim enters that directory in nnn and uses the batch copy or move workflow, the...
SUSE CVE-2026-74979
Mitigation bypass in the Add-ons Manager component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1...
EUVD-2026-63625
Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network...
Linux Distros Unpatched Vulnerability : CVE-2026-64846
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can...
Linux Distros Unpatched Vulnerability : CVE-2026-19685
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NetworkManager did not apply the privateuser restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix fo...
PT-2026-79419
Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...