91343 matches found
CVE-2026-78275: Improper Limitation of a Pathname to a Restricted Directory
Editor Arbitrary File Deletion in Fluent Boards Pro = 2.0.11 versions...
CVE-2026-59304: Access of Resource Using Incompatible Type
Improper caching of the original content type in Spring Cloud Stream Avro. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...
CVE-2026-81625: Out-of-bounds Write
A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test VT on the affected products to trigger a stack buffer overflow and gain full access on the compromised system...
CVE-2026-81272: Missing Authorization
Editor Broken Access Control in FluentPlayer Pro = 1.3.2 versions...
CVE-2026-81673: Improper Neutralization of Special Elements used in an SQL Command
The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the idvideo and idambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...
CVE-2026-78261: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Realtyna Organic IDX plugin = 5.4.1 versions...
CVE-2026-75813: Missing Authorization
Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality...
CVE-2026-59300: Insertion of Sensitive Information into Log File
Potential for logging sensitive data in Spring Cloud Function AWS. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7 Spring Cloud Function 3.2.16 and earlier...
CVE-2026-59303: Allocation of Resources Without Limits or Throttling
Dynamic destination cache size is not properly bound in Spring Cloud Stream. Spring Cloud Stream 5.0.0 - 5.0.2 Spring Cloud Stream 4.3.0 - 4.3.3 Spring Cloud Stream 4.2.0 - 4.2.6...
CVE-2026-81677: Improper Neutralization of Special Elements used in an SQL Command
The ‘/ws/apiprensa/getVideo’ endpoint is vulnerable to SQL injection due to improper validation of the GET parameter idambito. An attacker can inject SQL syntax that breaks the underlying structure of the MariaDB query, resulting in syntax errors and the exposure of database error messages via...
CVE-2026-59291: Server-Side Request Forgery (SSRF)
Potential arbitrary file read and SSRF vulnerability in Spring Cloud Function. Spring Cloud Function 5.0.0 - 5.0.3 Spring Cloud Function 4.3.0 - 4.3.4 Spring Cloud Function 4.2.0 - 4.2.7...
CVE-2026-32479: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...
CVE-2026-37065: Files or Directories Accessible to External Parties
Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=...
CVE-2026-78285: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Like Button Rating = 2.6.61 versions...
CVE-2026-81097: Improper Neutralization of Special Elements used in an OS Command
The executeruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach...
CVE-2026-81101: Exposure of Sensitive Information to an Unauthorized Actor
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted...
CVE-2026-32550: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Kadence Shop Kit = 3.0.6 versions...
CVE-2026-5218: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting XSS. This issue affects E-Commerce Pack: before 5.03.01.49...
CVE-2026-81817: Authorization Bypass Through User-Controlled Key
Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The routes generally received both a case identifier and a task identifier, but previously they did not enforce that the task actually belonged to t...