18405 matches found
CVE-2020-37217 Easy2Pilot 7 Cross-Site Request Forgery via admin.php
Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the admin.php?action=adduser endpoint with POST requests...
CVE-2020-37217
CVE-2020-37217 affects Easy2Pilot 7 and describes a Cross-Site Request Forgery vulnerability targeting admin.php?action=add_user. An attacker can trick an authenticated administrator into submitting a crafted POST to create new administrative accounts without consent. The described impact include...
CVE-2026-28873
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4. An app may be able to circumvent App Privacy Report logging...
CVE-2026-41227 BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability
On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
CVE-2026-41227 BIG-IP HTTP/2 Layer 7 Dos Protection vulnerability
On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can result in an increase in memory consumption causing the Traffic Management Microkernel TMM process to terminate. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...
WordPress Redirection for Contact Form 7 plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by JongHwan Shin in WordPress Plugin Redirection for Contact Form 7 versions = 3.2.8...
CVE-2026-6929
The CVE pertains to the JoomSport WordPress plugin (Team & League, Football, Hockey & more). Affected versions are up to and including 5.7.7, with a time-based blind SQL Injection via the sortf parameter caused by insufficient escaping and inadequate preparation of the SQL query. The vulnerabilit...
CVE-2026-28957
An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen...
CVE-2026-8200 Schema validation log messages may not redact user data
When schema validation is enabled on a collection and an update or insert would violate the collection's schema, the local server log message generated may not have all user data redacted. This issue impacts MongoDB Server v7.0 versions prior to 7.0.34, v8.0 versions prior to 8.0.23, v8.2 version...
CVE-2026-8199 Post-auth memory exhaustion via bitwise match expressions
An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss by OOM. This issue impacts MongoDB Server v7.0 versions prior to...
PT-2026-40805
Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.0 Description An unauthenticated Reflected Cross-Site Scripting XSS issue exists in the search feature. A logic flaw in the classes/catalogue.class.php file allows user input to be reflected without sanitization...
PT-2026-40814
Name of the Vulnerable Software and Affected Versions CubeCart versions prior to 6.7.3 Description An administrator with documents edit permission can save raw PHP code into the Invoice Editor. When any administrator clicks Print on an order, the rendered template is written to files/print..php...
PT-2026-40759
Name of the Vulnerable Software and Affected Versions Zoom Workplace for iOS versions prior to 7.0.0 Description A protection mechanism failure allows an authenticated user with physical access to the device to conduct a disclosure of information. Recommendations Update to version 7.0.0 or later...
CVE-2026-36742
CVE-2026-36742 affects Hiseeu C90 v5.7.15. The issue is insecure permissions: the UART bootloader is accessible when the battery is disconnected (hidden/debug mode). This implies physical-access risk allowing unauthorized access during boot. The public documents consistently describe the vulnerab...
Zoom Workplace 安全漏洞
Zoom Workplace is a desktop application developed by the American company Zoom. Versions of Zoom Workplace prior to 7.0.0 contained a security vulnerability. This vulnerability stemmed from a failure in the protection mechanisms, which could allow authenticated users to access sensitive informati...
PT-2026-40761
Name of the Vulnerable Software and Affected Versions Zoom Rooms for Windows versions prior to 7.0.0 Description An untrusted search path in the installer allows an authenticated user with local access to achieve escalation of privilege. Recommendations Update to version 7.0.0 or later...
PT-2026-40661
Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions prior to 17.1.3.1 F5 BIG-IP versions prior to 17.5.1.4 Description On an HTTP/2 virtual server with Layer 7 DoS Protection configured, undisclosed traffic can lead to excessive resource allocation and increased memory...
F5 BIG-IP 安全漏洞
F5 BIG-IP is an application delivery platform developed by F5 Technologies in the United States. It integrates functions such as network traffic management, application security management, and load balancing. There is a security vulnerability in F5 BIG-IP. This vulnerability arises from HTTP/2...