91061 matches found
CVE-2026-15639: Improper Neutralization of Input During Web Page Generation
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker...
CVE-2026-27563: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...
CVE-2026-20326: Missing Authentication for Critical Function
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...
CVE-2026-87116: Server-Side Request Forgery (SSRF)
Tanium addressed a server-side request forgery vulnerability in Threat Response...
CVE-2026-91843: Stack-based Buffer Overflow
A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges...
CVE-2026-92132: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...
CVE-2026-20361: Improper Neutralization of Special Elements used in an SQL Command
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...
CVE-2026-51990: Improper Control of Generation of Code
An issue in Sogou Sogou Input Method 16.3.0.3498 fixed in 16.3.0.3498 allows a remote attacker to execute arbitrary code via the bizhelper.exe component...
CVE-2026-86106: Missing Authentication for Critical Function
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled...
CVE-2026-89083: Improper Control of Generation of Code
HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software...
CVE-2026-89084: Improper Limitation of a Pathname to a Restricted Directory
HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software...
CVE-2026-86865: Improper Neutralization of Special Elements used in an SQL Command
Tanium addressed a SQL injection vulnerability in Asset...
CVE-2026-19248: Uncontrolled Recursion
QDomDocument XML parsing is vulnerable to a remotely-triggerable denial-of-service crash when processing untrusted input...
CVE-2026-27552: Incorrect Authorization
A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...
CVE-2026-68536: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue...
CVE-2026-76646: Uncontrolled Resource Consumption
A remote attacker could cause excessive resource consumption by supplying specially crafted request parameters, potentially resulting in a denial of service condition. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, ...
CVE-2026-87026: Missing Authorization
Tanium addressed an improper access controls vulnerability in Threat Response...
CVE-2026-92815: Server-Side Request Forgery (SSRF)
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...
CVE-2026-73468: Always-Incorrect Control Flow Implementation
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period...