91375 matches found
EUVD-2026-62702
Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...
CVE-2026-68560 Wekan:hell Injection in External Antivirus Scanner Path via asyncExec
Wekan is open source kanban built with Meteor. Prior to 9.75, models/fileValidation.js interpolated the uploaded fileObj.path into the administrator-configured externalCommandLine at its file placeholder and executed the result through asyncExec, which is promisifyexec and invokes /bin/sh -c. On...
CVE-2026-73347: Incorrect Privilege Assignment
Unauthenticated Privilege Escalation in TrueBooker = 1.2.6 versions...
CVE-2026-73391: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Total Donations = 2.0.5 versions...
Linux Distros Unpatched Vulnerability : CVE-2026-18695
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's handling of certain query predicates against time-series collections with a metaField could allow an authenticated user with write...
Oracle Linux 9 : .NET / 10.0 (ELSA-2026-55857)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-55857 advisory. 10.0.111-1.0.1 - Add support for Oracle Linux 10.0.111-1 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235481 Tenable has extract...
CVE-2026-73364: Deserialization of Untrusted Data
Customer PHP Object Injection in Flexible Subscriptions = 1.8.1 versions...
RHEL 8 : gstreamer1-plugins-bad-free (RHSA-2026:56521)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56521 advisory. GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a...
Linux Distros Unpatched Vulnerability : CVE-2026-70906
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in Oracle Java SE component: 2D. Supported versions that are affected are Oracle Java SE: 25.0.4 and 26.0.2. Easily exploitable vulnerability allo...
CVE-2026-73354: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in SimplyRETS Real Estate IDX = 3.2.8 versions...
Joern 4.0.606
Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...
Wapiti Web Application Vulnerability Scanner 3.3.2
Wapiti is a web application vulnerability scanner. It will scan the web pages of a deployed web application and will fuzz the URL parameters and forms to find common web vulnerabilities. This is the source code release...
CVE-2026-73363: Missing Authorization
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce 2.0.8 versions...
CVE-2026-32475: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type vulnerability in Elementor Elementor Pro allows Using Malicious Files. This issue affects Elementor Pro: from n/a through 4.2.1...
CVE-2026-20231: Improper Neutralization of Special Elements in Output Used by a Downstream Component
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Workload engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. ...
CVE-2026-76886: Heap-based Buffer Overflow
C12.22 protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...
CVE-2026-76917: Heap-based Buffer Overflow
Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service...