Weak Password Recovery Mechanism for Forgotten Password

Overview Microsoft.AspNetCore.App.Runtime.osx-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password...

CVE-2026-109240

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol RDP server can cause a Denial of Service DoS by sending a specially crafted request with an unvalidated buffer size over the USB redirection channel. This missing bounds check triggers an internal assertion failure that immediately...

ROS-20261013-73-0369

The vulnerability in the kernel-lt is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2026-109663 Frappe ERPNext before 15.113.0 SQL Injection via Unvalidated Endpoint Parameters

Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive informati...

CVE-2026-109639 Frappe ERPNext before 15.102.0 SQL Injection via Unvalidated Endpoint Requests

Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to...

CVE-2026-94451

The Quarkus REST Data Panache component is vulnerable to information disclosure and denial of service (DoS) due to an unvalidated sort parameter . An attacker can exploit this flaw on certain endpoints to gain unauthorized access to information or force the database to perform complex tasks, pote...

PT-2026-110579

Name of the Vulnerable Software and Affected Versions Progress ShareFile Storage Zones Controller versions prior to 5.12.7 Description Processing of queue items can send acknowledgements to an unvalidated callback URL. This behavior, combined with a race condition, allows an attacker to force the...

MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-2012:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2012:01 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block...

MiracleLinux 8 : perl-DBI:1.641 (AXSA:2026-2011:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-2011:01 advisory. perl-DBI: DBI for Perl: Heap out-of-bounds write via unvalidated numeric placeholder CVE-2026-73194 Tenable has extracted the preceding description block...

CVE-2026-108585 argocd-mcp through 0.9.0 Path Traversal via delete_application Tool

argocd-mcp Argo CD MCP Server through 0.9.0 contains a path traversal vulnerability in the deleteapplication tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositorie...

EUVD-2026-96372

argocd-mcp Argo CD MCP Server through 0.9.0 contains a path traversal vulnerability in the deleteapplication tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositorie...

WordPress Payment Processing via MetaMask for WooCommerce: Input Validation Vulnerability

WordPress payments via MetaMask for WooCommerce versions 1.7.2 and earlier have a vulnerability related to input validation errors. This vulnerability stems from unvalidated bypass attempts...

ROS-20261009-73-0369

The vulnerability of the switchtecntbinitshared function in the drivers/ntb/hw/mscc/ntbhwswitchtec.c driver for Linux’s non-visible kernel bridges is related to unvalidated array indexing. Exploiting this vulnerability could allow an attacker to access protected information or cause service...

Golang X Text Package Heap Buffer Overflow DoS

The vulnerability of the Golang X Text package for text processing is related to unvalidated array indexing. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2026-107798 Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter

jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts unvalidated URLs into anchor href attributes. Authenticated attackers can post messages with javascript: links or quote-breaking URLs to...

ROS-20261008-73-0100

The vulnerability in the kernel-lt is related to unvalidated array indexing. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-105818 Vault PKI ACME Issues Certificate With Unvalidated SANs

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

CVE-2026-105818

The Vault PKI secrets engine ACME server is vulnerable to an issue where it fails to restrict certificate identities that ACME challenges do not validate when using the default directory policy . This flaw allows an ACME client to obtain a certificate containing unverified identity claims , poten...