19113 matches found
CVE-2026-34496
CVE-2026-34496 describes a CWE-269 privilege escalation in Johnson Controls victor Web on Windows, affected before version 7.1. The vulnerability allows an attacker to achieve higher privileges via a network attack with high complexity, requiring existing high privileges and no user interaction. ...
CVE-2026-34496 victor Web - Priviledge Escalation
Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233. This issue affects victor Web: before 7.1...
NPM: React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)
NPM: React Router: Open redirect via backslash in and useNavigate CVE-2025-68470 bypass vulnerability discovered by ? in WordPress Npm react-router versions = 6.0.0, 7.18.0...
find-my-way: DDoS with HTTP2
Impact Remotely triggerable DoS in find-my-way when it is used with Node's HTTP/2 server. The short version is that lookup passes req.method into find, and find indexes this.treesmethod. Since this.trees is a normal object, HTTP/2 method values like constructor, toString, or proto can resolve...
CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation
Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...
CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...
CVE-2026-47670 DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection
DbGate is cross-platform database manager. Versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution RCE. Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint...
CVE-2026-14257
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...
UBUNTU-CVE-2026-14257
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...
MINI-7C88-HF44-3HFR
Bulletin has no description...
CVE-2026-14257 brace-expansion DoS via unbounded expansion length causing an out-of-memory process crash
brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand function limits the number of results with a max option default 100,000 but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count und...
CVE-2026-65540
Unauthenticated Cross Site Request Forgery CSRF in Popup for CF7 with Sweet Alert = 1.6.5 versions...
CVE-2026-65532
Shop manager SQL Injection in Persian Woocommerce SMS = 7.2.2 versions...
CVE-2026-65511
Unauthenticated Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65498
Unauthenticated Sensitive Data Exposure in Complianz = 7.5.0 versions...
CVE-2026-65500
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65496
Author Server Side Request Forgery SSRF in Complianz = 7.5.0 versions...
CVE-2026-65487
Unauthenticated Broken Access Control in Photography = 7.7.6 versions...