90901 matches found
CVE-2026-96349: Improper Control of Generation of Code
Unauthenticated Remote Code Execution RCE in SiteSkite = 2.1.8 versions...
CVE-2026-102136: Improper Neutralization of CRLF Sequences
In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an internal cluster interface that was written into monitoring configuration on another node without sufficient validation, potentially allowing OS commands to be...
CVE-2026-102110: Missing Authentication for Critical Function
An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition, so during the initial activation window an unauthenticated network attacker could repeatedly re-trigger the privileged activation process. This could disru...
CVE-2026-97292: Improper Neutralization of Input During Web Page Generation
Author Cross Site Scripting XSS in YITH WooCommerce Tab Manager = 2.15.0 versions...
CVE-2026-79625: Concurrent Execution using Shared Resource with Improper Synchronization
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...
CVE-2026-102117: Reliance on Untrusted Inputs in a Security Decision
On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key protecting the submitted data could redirect the underlying system's outbound support connection to a destination of their choosing. That destination could...
Karma Pro 0.12
Karma Pro is an open source code review tool written in Swift that can assist code reviewers with a multitude of useful tools. Karma Pro is a macOS source-code security scanner AST base and Heuristics that statically analyses projects in multiple languages. It's backed by an ML classifier trained...
CVE-2026-100267: Inefficient Regular Expression Complexity
In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters...
CVE-2026-81310: Improper Link Resolution Before File Access
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance...
CVE-2026-97077: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Ad Inserter = 2.8.18 versions...
CVE-2026-97261: Insertion of Sensitive Information Into Sent Data
Unauthenticated Sensitive Data Exposure in Notivo = 1.4.2 versions...
CVE-2026-97289: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.2.6 versions...
CVE-2026-97235: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in ThemeREX Addons 2.45.0 versions...
CVE-2026-100276: Incorrect Authorization
In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action...
CVE-2026-96836: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Parsi Date = 6.3 versions...
PT-2026-102997
Image Scanner Driver for Linux contains a link following vulnerability. An attacker who can log in to a Linux system where the product is installed may overwrite arbitrary files by using a special method in advance...
CVE-2026-102119: Improper Limitation of a Pathname to a Restricted Directory
A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to unintended locations outside the feature's designated directory. This could potentially be leveraged to execute arbitrary code on the underlying system...
CVE-2026-97271: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WPFunnels = 3.13.1 versions...
CVE-2026-100255: Improper Validation of Unsafe Equivalence in Input
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset...