122561 matches found
PT-2026-83847
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...
CVE-2026-51719
Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83859
Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83893
Name of the Vulnerable Software and Affected Versions TOTOLINK T6 version 4.1.5cu.748 B20211015 Description Incorrect access control in the delUrlFilterRules function allows unauthenticated attackers to remove URL filtering rules. This is achieved by sending a crafted POST request to the...
EUVD-2026-68676
Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
CVE-2026-51719
Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83704
NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...
RHEL 8 : NetworkManager (RHSA-2026:61580)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61580 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...
RHEL 9 : NetworkManager (RHSA-2026:61243)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61243 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...
Linux Distros Unpatched Vulnerability : CVE-2026-82249
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carria...
PT-2026-84020
Name of the Vulnerable Software and Affected Versions elFinder versions prior to 2.1.70 Description URL uploads in php/elFinder.class.php can bypass server-side request forgery SSRF protections when PHP cURL is unavailable. The validate address function validates the IP address, but get remote...
CVE-2026-40465: URL Redirection to Untrusted Site
NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...
CVE-2026-82394: Missing Authorization
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in...
CVE-2026-51719
The TOTOLINK T6 wireless dual-band Mesh router, specifically version 4.1.5cu.748_B20211015 , contains an incorrect access control vulnerability in the delUrlFilterRules function. This flaw allows unauthenticated attackers to remove URL filtering rules by sending a specially crafted POST request t...
CVE-2026-82639
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...
CVE-2026-82639 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...
CVE-2026-82639
NextChat versions 2.15.8 through 2.16.1 are affected by an improper URL validation flaw in the proxy endpoint . The x-base-url header is validated via substring matching rather than proper hostname parsing, so any attacker-supplied URL containing the string api.openai.com passes validation. This ...
CVE-2026-82639 NextChat 2.15.8 through 2.16.1 OpenAI API Key Disclosure
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...
CVE-2026-82639
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...
EUVD-2026-68215
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing...