137 matches found
EUVD-2026-85152
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software versions up to and including 5.2.63 on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in th...
CVE-2026-83294
Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Platform Security. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the...
Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mysql (UTSA-2026-106208)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-106208 advisory. Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are affected are MySQL...
CVE-2026-66671: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Verdure Core = 1.2 versions...
DEBIAN-CVE-2026-72847
broot renders each file and directory name in its interactive tree view exactly as read from the filesystem. Names are converted with a plain tostringlossy call in src/treebuild/builder.rs and in TreeLine::unprune in src/tree/treeline.rs, and no control-character filtering exists anywhere in the...
Linux Distros Unpatched Vulnerability : CVE-2026-20783
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper conditions check in the firmware for the IntelR NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged...
CVE-2026-48045
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handlequeryordefer retained every truncated TC-bit incoming query, each up to MAXMSGABSOLUTE = 8966 bytes, in self.deferredaddr and armed a per-address timer in self.timersaddr without...
CVE-2026-48045
Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.12, AsyncListener.handlequeryordefer retained every truncated TC-bit incoming query, each up to MAXMSGABSOLUTE = 8966 bytes, in self.deferredaddr and armed a per-address timer in self.timersaddr without...
EUVD-2026-43235
luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders...
CVE-2026-61875
luci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders...
Permissive Cross-domain Policy with Untrusted Domains
Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains through the unauthenticated local API exposed in proxy mode, which accepts cross-origin requests due to a permissive CORS policy and lack of authentication. An attacker can achieve...
PT-2026-56265
Name of the Vulnerable Software and Affected Versions OpenWrt versions prior to 25.12.5 Description An integer underflow occurs in the handle send a function of the Emergency Access Daemon. An unauthenticated attacker on the local network can trigger this by sending a single crafted UDP packet,...
CVE-2026-42382
Unauthenticated Local File Inclusion in Audrey = 1.5 versions...
CVE-2025-58902: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Lighthouse = 1.2.12 versions...
CVE-2026-54845: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in MDTF = 1.3.8 versions...
CVE-2026-39938
Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have unauthenticated LFI through graphtheme and rrdtool IPC serialization hardening. This issue has been resolved in version 1.2.31...
EUVD-2025-210261
Unauthenticated Local File Inclusion in Preservation = 1.10 versions...
EUVD-2025-210201
Unauthenticated Local File Inclusion in Especio = 1.0 versions...