91133 matches found
CVE-2026-76440: Relative Path Traversal
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple...
CVE-2023-24285: sgt-puzzles -- security update
Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed...
CVE-2026-82767: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability exists in SGA1000. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2023-45023: Incorrect Authorization
The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component...
CVE-2023-45858: Relative Path Traversal
A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files...
CVE-2026-16186: Improper Neutralization of Input During Web Page Generation
IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability...
CVE-2026-84576: Exposure of Sensitive Information to an Unauthorized Actor
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data...
Credential Exposure Through Environment Variables
This plugin identifies credentials or secrets that are potentially exposed to malicious actors by environment variables on the target host. Attackers who establish a foothold on a target can escalate or move laterally using passwords, access tokens or API keys stored in local environment variable...
Command Path Injection
This plugin identifies PATH environment variables either at the system or user level that could be leveraged by a local attacker for path based command injection. Path command injection happens when a PATH places user controlled directories, relative paths or world writable directories ahead of...
sakuda
sakuda sakuda is short for 「さくっとDAST」 "DAST, quickly...
CVE-2026-49030: Undefined Security Weakness
pathe through 2.0.3 unconditionally normalizes backslash characters to forward slashes on all platforms, including POSIX systems where backslash is a valid filename character. This causes join, resolve, and normalize to interpret backslash-separated dot notation sequences as directory traversal,...
CVE-2026-29811: Comparison Using Wrong Factors
CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...
CVE-2025-45480: Incorrect Resource Transfer Between Spheres
Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary...
CVE-2026-29810: Detection of Error Condition Without Action
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
CVE-2025-70820: Absolute Path Traversal
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...
CVE-2026-90773: Improper Neutralization of Escape, Meta, or Control Sequences
procs through 0.14.12 fails to sanitize escape sequences in process command lines before displaying them in the Command column. Local attackers can execute processes with malicious ANSI or OSC escape sequences in their command line arguments, which are written unmodified to other users' terminals...
CVE-2026-90490: Deserialization of Untrusted Data
A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be...
CVE-2026-90525: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...
mzap v2.2.1
mzap mzap is a Crystal CLI for multi-target ZAP scanning. It dispatches targets across one or more ZAP API hosts, supports optional wait mode, and can export reports. Features Scan commands: spider, ajaxspider, clientspider ZAP 2.16+, ascan, pscan API definition import for openapi, soap, graphql,...