135525 matches found
CVE-2026-98012
A flaw was found in the Linux kernel's Stochastic Fairness Queueing SFQ network packet scheduling subsystem. A local attacker with network administration privileges, including within an unprivileged user namespace, can supply an improperly bounded quantum parameter alongside a crafted packet size...
CVE-2026-101111
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library Free 6.4.6 - The public book-detail page template, site/views/viewbook/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind echo...
CVE-2026-101109
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...
CVE-2026-100753
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...
CVE-2026-101111
The Joomla Extension - ordasoft.com - Book Library (Free) version
EUVD-2026-88439
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library Free 6.4.6 - The public book-detail page template, site/views/viewbook/tmpl/default.php, echoes the raw title request parameter directly into a double-quoted HTML attribute with no escaping function of any kind echo...
CVE-2026-101109 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...
CVE-2026-101109 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...
CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...
EUVD-2026-88435
Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...
CVE-2026-100753
The Joomla Extension - ordasoft.com - Real Estate Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.7.9 . The issue exists on the public property-detail page's "leave a review" form, where the title field repopulates from the request without any escaping ...
CVE-2026-45562 FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold MoH module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreeP...
CVE-2026-45562
The FreePBX Music on Hold (MoH) module is vulnerable to Authenticated Remote Code Execution in versions prior to 16.0.4 and 17.0.6 . The root cause is a lack of sanitization for a POST parameter that defines a custom Asterisk application . This unsanitized data is stored in the database and subse...
GO-2026-6518 Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses
Perses's project query parameter authorization bypass exposes cross-project resources in github.com/perses/perses...
GO-2026-6528 Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses
Perses's unvalidated project parameter enables filesystem path traversal in github.com/perses/perses...
CVE-2026-93348
A flaw was found in Unsloth Zoo, which can lead to arbitrary code execution when loading a machine learning model. The vulnerability exists due to improper input sanitization of the model type parameter within configuration files during compilation. An attacker can exploit this issue by supplying...
Security Bulletin: IBM DataPower Gateway affected by multiple CVEs in http-proxy-middleware
Summary IBM DataPower Gateway has addressed multiple vulnerabilities in http-proxy-middleware in versions 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0,...
CVE-2024-29269-EXPLOIT
CVE-2024-29269 - Telesquare TLR-2005KSH リモートコード実行 RCE Telesquare TLR-2005Ksh バージョン1.0.0および1.1.4において、攻撃者が Cmd パラメータを悪用して任意のシステムコマンドを実行できる可能性がある問題が特定されました。この脆弱性により、権限のない個人が影響を受けるシステム上でコマンドを実行し、不正アクセスやその他の悪意のある活動につながる可能性があります。 概念実証 PoC エクスプロイト 教育目的のみとして、脆弱性を実証するための概念実証 PoC...
CVE-2026-86330
An OS command injection flaw exists in the set_hostname_internal function of NooBaa's cluster_internal_api , a component used for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation . The root cause is the direct passing of the hostname parameter to a shell command without proper...
