92236 matches found
CVE-2026-30894: Improper Neutralization of Input During Web Page Generation
Lack of output escaping leads to a XSS vector in the content history component...
CVE-2026-25900: Improper Neutralization of Input During Web Page Generation
Lack of output escaping leads to a XSS vector in the feed modules...
CVE-2026-24638: Missing Authorization
Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RepairBuddy: from n/a through 4.1121...
CVE-2026-24590: Missing Authorization
Missing Authorization vulnerability in VideoWhisper.Com Paid Videochat Turnkey Site allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Paid Videochat Turnkey Site: from n/a through 7.3.23...
CVE-2026-39655: Missing Authorization
Missing Authorization vulnerability in TeconceTheme Mayosis Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Mayosis Core: from n/a through 5.4.7...
CVE-2026-44468: Incorrect Default Permissions
The affected product creates a directory with insecure default permissions during administrative installation. This allows a low-privileged local attacker to modify a temporary file defining the components to be installed, enabling local privilege escalation by forcing the deployment of arbitrary...
CVE-2026-35222: Improper Neutralization of Special Elements used in an SQL Command
Improperly validated order clauses lead to a SQL injection vulnerability in comtags...
CVE-2026-39661: Improper Control of Filename for Include/Require Statement in PHP Program
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Magentech SW Core allows PHP Local File Inclusion. This issue affects SW Core: from n/a through 1.7.18...
CVE-2026-48901: Use of Cache Containing Sensitive Information
The InputFilter::getInstance method omitted a security sensitive parameter from the instance cache key...
CVE-2026-44410: Use of a Cryptographic Primitive with a Risky Implementation
This vulnerability stems from a business logic flaw.Attackers can exploit legitimate application functions in unintended and abnormal ways, deviating from the designer's expectations, to carry out malicious attacks...
CVE-2026-48696: Buffer Copy without Checking Size of Input
FastNetMon Community Edition through 1.2.9 has a buffer overflow, a different vulnerability than CVE-2026-48686 and CVE-2026-48689...
FreeBSD : Roundcube Webmail -- Multiple vulnerabilities (b8777bc2-5758-11f1-8607-8447094a420f)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the b8777bc2-5758-11f1-8607-8447094a420f advisory. The Roundcube Webmail project reports: See link for details. No CVE numbers available at the moment...
CVE-2026-25444: Missing Authorization
Missing Authorization vulnerability in Magepeople inc. WpBookingly allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WpBookingly: from n/a through 1.2.9...
CVE-2026-48896: Improper Authentication
Insufficient state checks lead to a vector that allows to bypass 2FA checks...
CVE-2026-8676: Authentication Bypass by Spoofing
An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond...
CVE-2026-9581: Improper Access Control
A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version...
CVE-2026-8046: Incorrect Authorization
The affected products insufficiently verify authorization when deleting user accounts. An authenticated, low-privileged remote user can exploit this vulnerability to delete other users, including those with higher privileges...
CVE-2026-8047: Improper Validation of Specified Quantity in Input
The affected products perform improper length checking when parsing incoming HTTP requests, resulting in a size-limited out-of-bounds write. An unauthenticated remote attacker can exploit this flaw to cause a denial of service via a system crash on the affected device...
CVE-2026-44469: Incorrect Default Permissions
The affected product extracts installation files to a temporary directory with incorrect default permissions during administrative installation. A low-privileged local attacker can exploit a TOCTOU race condition with a practical time window to replace verified files with malicious ones before...