116888 matches found
Cellular Modem Component Android Privilege Bypass
The vulnerability of the Cellular Modem component in the Android operating system of Pixel phones is related to improper authorization. Exploiting this vulnerability allows a remote attacker to bypass existing security measures and gain increased privileges...
CVE-2026-20352
A vulnerability in the RADIUS feature of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to improper handling of certain RADIUS requests. An attacker could exploit this...
CVE-2026-20309
Cisco Identity Services Engine (ISE) contains a reflected cross-site scripting (XSS) vulnerability in its web-based management interface. The root cause is improper validation of user-supplied input , allowing an unauthenticated, remote attacker to craft a malicious link that, when clicked by a u...
CVE-2026-45767
A flaw was found in Suricata, a network Intrusion Detection System IDS, Intrusion Prevention System IPS, and Network Security Monitoring engine. A highly privileged remote attacker could exploit this vulnerability by crafting a malicious rule. When this rule is loaded or reloaded, it could allow...
CVE-2026-20343
A vulnerability in a critical API of Cisco Secure Firewall Management Center (FMC) Software arises because the API lacks authentication . An unauthenticated, remote attacker can exploit it by repeatedly invoking the API, potentially downloading sensitive files that should be restricted and consum...
CVE-2026-86359
Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...
Cisco Secure Firewall Management Center Software Vulnerabilities
Multiple vulnerabilities in Cisco Secure Firewall Management Center FMC Software could allow a remote attacker to gain root access, download sensitive files, perform a SQL injection attack, or cause a denial of service DoS condition. For more information about these vulnerabilities, see the Detai...
Cisco Secure Firewall Management Center Software Vulnerabilities
Multiple vulnerabilities in Cisco Secure Firewall Management Center FMC Software could allow a remote attacker to gain root access and perform session forgery or session impersonation. For more information about these vulnerabilities, see the Details "details" section of this advisory. Cisco has...
SUSE CVE-2026-91739
Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...
SUSE CVE-2026-91741
Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
bind9: bind: BIND 9: DNS wildcard record existence can be masked by an attacker via inapplicable NSEC records
A flaw was found in BIND 9. A remote attacker could exploit this by providing an inapplicable NSEC Next Secure record to a named resolver. This could allow the attacker to mask the existence of a victim's wildcard DNS Domain Name System record, potentially leading to a misrepresentation of DNS...
python: Python/Expat: Denial of Service via crafted XML document
A flaw was found in the python and expat components. Insufficient entropy in the hash-flooding protection mechanism of xml.parsers.expat and xml.etree.ElementTree allows a remote attacker to craft a malicious XML document. This crafted document can trigger a hash flooding attack, leading to a...
python: Python: FTP connection redirection via ftpcp() function bypass
A flaw was found in the ftplib.py module of Python. This vulnerability allows a remote attacker to bypass a previous security fix by manipulating the ftpcp function. By supplying a malicious IP address and port, an attacker can redirect FTP connections to an arbitrary host. This could lead to the...
CVE-2026-27553 Information Disclosure via Schema Path Manipulation
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...
CVE-2026-27552 Unauthorized IODD File Upload due to Improper Authorization
A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...
CVE-2026-27551
CVE-2026-27551 is a command injection vulnerability in the /index.php/ajax/parameterManage endpoint. A low-privileged remote attacker with valid user credentials can execute arbitrary commands with root privileges on the affected device. The CNA-assigned CVSS 3.1 score is 8.8 (HIGH) with a vector...
EUVD-2026-80231
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-40856: Missing Authentication for Critical Function
WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wncmaccheck.cgi endpoint, which is accessible without authentication. It allows a remote attacker to retrieve sensitive configuration data, including the administrator web password, WiFi...
CVE-2026-65388: URL Redirection to Untrusted Site
A remote attacker who controls a container registry may be able to direct a client's token request to a host of the attacker's choice, and disclose the victim's registry credentials to that host. This vulnerability is addressed in containerization version 0.41.0...