124171 matches found
EUVD-2026-89534
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...
CVE-2026-102794
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...
PT-2026-103029
The Audio Player Block WordPress plugin before 1.6.3 does not validate the scheme of a user-supplied URL before using it as a link target, allowing users with the Contributor role and above to store malicious JavaScript that executes in the session of any user who later triggers the link such as ...
Rocky Linux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772448200)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772448200 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameter...
AlmaLinux 9.6 [TuxCare] Security Update: grafana / grafana-selinux Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772448200)
The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772448200 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...
AlmaLinux 9.6 [TuxCare] Security Update: skopeo / skopeo-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772620440)
The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772620440 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...
AlmaLinux 9.6 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772576264)
The AlmaLinux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772576264 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters ...
Rocky Linux 9.6 [TuxCare] Security Update: skopeo / skopeo-tests Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772620440)
The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772620440 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameter...
AlmaLinux 9.2 [TuxCare] Security Update: pki-servlet-4.0-api / pki-servlet-engine (ALMALINUX9.2:CLSA-2026:1768989206)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1768989206 advisory. - Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalize...
CVE-2025-14564: Improper Neutralization of Input During Web Page Generation
The Viable URL Media Uploader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access...
Rocky Linux 9.6 [TuxCare] Security Update: containernetworking-plugins Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1772576264)
The Rocky Linux 9.6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772576264 advisory. - The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameter...
CVE-2026-102090: URL Redirection to Untrusted Site
Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allowing an attacker-controlled document to be loaded and displayed under the trust of the legitimate application domain. This could increase the credibility of...
CVE-2026-100279: Server-Side Request Forgery (SSRF)
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials...
CVE-2026-88791: URL Redirection to Untrusted Site
The Safe Redirect Manager WordPress plugin before 2.3.0 does not properly validate the redirect destination when a wildcard redirect rule to an absolute URL is configured, allowing unauthenticated attackers to redirect visitors to an arbitrary external website via a crafted request path...
CVE-2026-102794: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public an...
PT-2026-103326
šØ CVE-2026-100279 In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials š@cveNotify...
PT-2026-103528
Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.1 Description Content Injection occurs due to insufficient validation of a URL parameter in the PDF viewer. This flaw allows an attacker-controlled document to be loaded and displayed under the trust of the...
PT-2026-103571
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated administrator on a node with an optional, separately licensed gateway role enabled can provide a connector URL that the server retrieves without...
PT-2026-103071
A JupyterLab Desktop vulnerability, CVE-2026-102530 CVSS 9.4, turns a malicious server URL into remote code execution. Update to 4.6.2-1 now. JupyterLab JupyterLabDesktop CVE2026102530 XSS RCE Electron DataScience PatchNow https://t.co/kyV9axdIxU...
PT-2026-114169
Name of the Vulnerable Software and Affected Versions GitPython versions prior to 3.2.0 Description An information disclosure issue exists where malicious repositories can trigger the expansion of environment variables. This occurs within the Repo. clone function when using separate git dir, as i...