258155 matches found
EUVD-2026-51099
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
EUVD-2026-51104
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...
EUVD-2026-51097
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code...
CVE-2026-59310
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code...
CVE-2026-54368
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...
CVE-2026-54363
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
CVE-2026-54368 CentreStack < 17.4 SQL Injection via x-glad-filter Header
CentreStack before 17.4 contains a SQL injection vulnerability in GladDBFiles.SearchEx and SearchExUnder that allows authenticated attackers to execute arbitrary SQL statements by supplying a crafted x-glad-filter request header through the jsondir API endpoint. Attackers can exploit unsanitized...
CVE-2026-54368
CVE-2026-54368 (CentreStack) : CentreStack versions before 17.4 are vulnerable to an SQL injection in GladDBFiles.SearchEx() and SearchExUnder(). An authenticated attacker can supply a crafted x-glad-filter header to the jsondir API endpoint, causing unsanitized interpolation of the Field paramet...
CVE-2026-54363 CentreStack < 17.5 Hardcoded Key Token Forgery RCE
CentreStack before 17.5 contains a hardcoded cryptographic key vulnerability that allows unauthenticated attackers to forge arbitrary encrypted tokens by exploiting a static SysNumber value used as entropy for AccessTicket.Encrypt and AccessTicket.Decrypt across all installations. Attackers can u...
CVE-2026-59310 vCenter directory-traversal vulnerability
VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code...
CVE-2026-59310
VMware vCenter Server is affected by CVE-2026-59310: a directory traversal in the Syslog server that allows arbitrary code execution if an attacker has network access. CVSSv3.1 base score 9.8 (critical, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Remediation is via patched versions listed in Broadcom’s...
The vulnerability of the pg_dump utility in the PostgreSQL database management system allows a hacker to execute arbitrary code.
The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of security measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.9.0 - Unauthenticated Remote Code Execution vulnerability
Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Admin and Site Enhancements ASE Pro versions = 8.9.0...
CVE-2026-64193
A flaw was found in Net::DNS. A remote attacker can exploit a vulnerability in the handling of EDNS Extension Mechanisms for DNS EXTENDED ERROR options, leading to arbitrary code execution. The affected component processes the EXTRA-TEXT field of an EDNS EXTENDED-ERROR option without properly...
Critical VMware vCenter Vulnerabilities Allow Authentication Bypass and Remote Code Execution (CVE-2026-59309, CVE-2026-59310)
Overview On July 29, 2026, Broadcom published security advisory VMSA-2026-0006 addressing multiple vulnerabilities in several VMWare products. Included in the advisory are two critical remotely exploitable vulnerabilities affecting VMware vCenter Server: CVE-2026-59309 and CVE-2026-59310. Both...
org.apache.camel/camel-vertx-http: Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data
A flaw was found in the camel-vertx-http component of Apache Camel. This vulnerability, a Deserialization of Untrusted Data, could allow a remote attacker to execute arbitrary code. By controlling the backend server or acting as a man-in-the-middle, an attacker could send a specially crafted...
Bitrix Component - Cross-Site Scripting
Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to 1 enumerate attachments on the server and 2 execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim ha...
VMware Aria Operations for Networks - Remote Code Execution
Aria Operations for Networks contains an authenticated deserialization vulnerability. A malicious actor with network access to VMware Aria Operations for Networks and valid 'member' role credentials may be able to perform a deserialization attack resulting in remote code execution. id:...
Microweber <1.2.12 - Integer Overflow
Microweber before 1.2.12 is susceptible to integer overflow. The application allows large characters to insert in the input field 'first & last name,' which can allow an attacker to cause a denial of service via a crafted HTTP request. id: CVE-2022-0968 info: name: Microweber 1.2.12 - Integer...