5430 matches found
EUVD-2026-70314
A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...
EUVD-2026-70299
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
CVE-2026-85089
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
CVE-2026-85089 FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
CVE-2026-85089: Use of Uninitialized Resource
FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c rdpwritelogoninfov2, rdpwritelogoninfoplain, and rdpwritelogoninfoex use StreamSeek instead of StreamZero for reserv...
PT-2026-85012
Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF save task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - fof.xml grants the carts view's tasks a wildcard true ACL, and FOF only enforces CSRF tokens on back-end HTML requests, not on front-end format=raw...
Linux Distros Unpatched Vulnerability : CVE-2026-85089
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions 3.0.0 through 3.30.0 before 3.31.0 transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in...
CVE-2026-84792
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...
EUVD-2026-69904
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...
CVE-2026-84792 Craft CMS before 5.10.11 Broken Access Control via element-indexes
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...
CVE-2026-84792: Missing Authorization
Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized...
Security Bulletin: IBM i is Affected By Denial of Service Vulnerability in Save Restore [CVE-2026-18078]
Summary IBM i is vulnerable to denial of service due to an integer overflow CVE-2026-18078 in Save Restore as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18078 DESCRIPTION: IBM i could allow a remote authenticated attacker to cause a denial of service due ...
PT-2026-84363
Name of the Vulnerable Software and Affected Versions kamailio versions prior to 6.1.1 Description A remote attacker can cause a denial of service through the ims registrar pcscf module. The issue occurs during security-agreement parsing within the parse sec agree function in sec agree.c,...
CVE-2026-78076: Improper Access Control
Joomla Extension - joomshaper.com - Broken Access Control & Missing Authorization in MegaMenu Settings in Helix Ultimate 2.2.10 - The AJAX endpoint save-megamenu-settings failed to enforce item-level and menu-level edit permissions core.edit on commenus.item.id or core.admin. An authenticated use...
PT-2026-84903
Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.0.0 through 3.30.0 Description Uninitialized heap memory is transmitted in the reserved padding fields of the Save Session Info PDU. This occurs because three PDU writers in libfreerdp/core/info.c rdp write logon info v2, rd...
EUVD-2026-42991
Snipe-IT has an authorization bypass on bulk editing users...
CVE-2026-80623
CVE-2026-80623 affects the Linux kernel Coresight ETE (External Trace Extension) subsystem. System register ETMs and ETE state is unlikely to be preserved on CPU power down , yet no device-tree or ACPI binding existed to signal this behavior, so the save_state logic was never correctly configured...