6854 matches found
CVE-2025-41024
Stored Cross-Site Scripting XSS in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The relationship between parameters and assigned identifiers is as follows: 'companyaddress', 'companyemail', 'companyname', 'country',...
CVE-2025-56005
An undocumented and unsafe feature in the PLY Python Lex-Yacc library 3.11 allows Remote Code Execution RCE via the picklefile parameter in the yacc function. This parameter accepts a .pkl file that is deserialized with pickle.load without validation. Because pickle allows execution of embedded...
PT-2026-4336
CVE-2026-23915 - Apache HTTP Server Unvalidated User Input CVE ID : CVE-2026-23915 Published : Jan. 20, 2026, 5:16 a.m. | 1 hour, 29 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
MiracleLinux 9 : squashfs-tools-4.4-10.git1.el9 (AXSA:2024-7853:01)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-7853:01 advisory. squashfs-tools: unvalidated filepaths allow writing outside of destination CVE-2021-40153 squashfs-tools: possible Directory Traversal via symbolic...
The vulnerability of the client for USB devices in the URBDRC RDP-client FreeRDP system allows a perpetrator to execute arbitrary code or cause a service failure.
The vulnerability of the URBDRC RDP-client-freeRDP device lies in unvalidated array indexing. Exploiting this vulnerability could allow an attacker to execute arbitrary code or cause service failures...
MiracleLinux 8 : mod_auth_openidc:2.3 (AXSA:2022-3591:01)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2022-3591:01 advisory. modauthopenidc: open redirect in oidcvalidateredirecturl CVE-2021-32786 modauthopenidc: hardcoded static IV and AAD with a reused key in AES GCM...
MiracleLinux 8 : squashfs-tools-4.3-21.el8 (AXSA:2024-8222:02)
The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-8222:02 advisory. squashfs-tools: unvalidated filepaths allow writing outside of destination CVE-2021-40153 squashfs-tools: possible Directory Traversal via symbolic...
PT-2026-3584
IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface...
CVE-2025-56005
An undocumented and unsafe feature in the PLY Python Lex-Yacc library 3.11 allows Remote Code Execution RCE via the picklefile parameter in the yacc function. This parameter accepts a .pkl file that is deserialized with pickle.load without validation. Because pickle allows execution of embedded...
PT-2026-4335
CVE-2026-23914 - Apache HTTP Server Unvalidated User Input CVE ID : CVE-2026-23914 Published : Jan. 20, 2026, 5:16 a.m. | 1 hour, 29 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
PT-2026-3555
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using private key jwt. The issue allows a client to specify an arbitrary jwks uri,...
PT-2026-4333
CVE-2026-23912 - Citrix NetScaler Unvalidated Redirect CVE ID : CVE-2026-23912 Published : Jan. 20, 2026, 5:16 a.m. | 1 hour, 29 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...
Remote Code Execution (RCE)
UmbracoForms is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient validation of user-supplied WSDL URLs used as data sources, which allows an authenticated attacker to supply a malicious web service definition and execute arbitrary code on the server...
ROS-20260119-7360
A vulnerability in the smusyssetpptable function of the drivers/gpu/drm/amd/pm/swsmu/amdgpusmu.c component of the Linux kernel is related to buffer copying without input data validation. Exploitation of the vulnerability could allow an attacker to gain access to sensitive data, compromise its...
CVE-2025-14894
Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, allowing for RCE through upload of a malicious php file that can then be executed via the /storage/ URL if a commonly performed setup proce...
PT-2026-3351
The Spin Wheel plugin for WordPress is vulnerable to client-side prize manipulation in all versions up to, and including, 2.1.0. This is due to the plugin trusting client-supplied prize selection data without server-side validation or randomization. This makes it possible for unauthenticated...
CVE-2026-22908
Uploading unvalidated container images may allow remote attackers to gain full access to the system, potentially compromising its integrity and confidentiality...
CLSA-2026-1768556132 cups-filters: Fix of CVE-2025-64524
CVE-2025-64524: fix heap buffer overflow and memory corruption via an unvalidated length parameter in CompressData function of the rastertopclx filter...
WordPress plugin Omni Secure Files has a security vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...
GravCMS security vulnerabilities
GravCMS is a content management system developed by the Grav company. Version 1.10.7 of GravCMS has a security vulnerability. This vulnerability stems from unvalidated YAML configurations that can be written into the system, potentially allowing PHP code to be executed through the scheduler...