Directory Traversal

Overview github.com/alist-org/alist/v3/server/handles is a file listing program powered by Gin and Solidjs Affected versions of this package are vulnerable to Directory Traversal via improper validation of user-supplied path components in file operation handlers. An attacker can gain unauthorized...

SAMSUNG Mobile devices 安全漏洞

Samsung Mobile devices are a series of mobile devices produced by South Korea’s Samsung Corporation, including smartphones and tablets. Versions before Samsung Mobile Devices SMR Feb-2026 Release 1 contained security vulnerabilities, which were caused by improper input validation. These...

Cisco Evolved Programmable Network Manager和Cisco Prime Infrastructure 输入验证错误漏洞

Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure are products of Cisco, a US-based company. Cisco Evolved Programmable Network Manager is a network management solution. Cisco Prime Infrastructure is an application software designed to simplify the management of wireless a...

SAMSUNG Mobile devices 安全漏洞

Samsung Mobile devices are a series of mobile devices produced by South Korea’s Samsung Corporation, including smartphones and tablets. Versions prior to Samsung Mobile Devices Release 1 contain security vulnerabilities due to improper input validation, which may allow privileged physical attacke...

YouDataSum CPAS Audit Management System 安全漏洞

YouDataSum CPAS Audit Management System is a data auditing software developed by YouDataSum Corporation. Versions of YouDataSum CPAS Audit Management System prior to v4.9 contained security vulnerabilities. These vulnerabilities were due to insufficient validation of parameter inputs, which could...

PT-2026-5568

BootCommerce 3.2.1 contains persistent input validation vulnerabilities that allow remote attackers to inject malicious script code through guest order checkout input fields. Attackers can exploit unvalidated input parameters to execute arbitrary scripts, potentially leading to session hijacking,...

CVE-2026-0709

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution...

Hikvision Wireless Access Points security vulnerabilities

Hikvision Wireless Access Points are wireless access point devices produced by the Chinese company Hikvision. There are security vulnerabilities in Hikvision Wireless Access Points, and these vulnerabilities stem from insufficient input validation, which may allow authenticated attackers to execu...

CVE-2025-57793

Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application component. Crafted input can be executed as part of backend database queries. The issue is exploitable without authentication, significantly...

Flexense Sync Breeze Enterprise Server and Flexense Disk Pulse Enterprise have vulnerabilities related to input validation.

Flexense Sync Breeze Enterprise Server and Flexense Disk Pulse Enterprise are both products of Flexense Corporation. Flexense Sync Breeze Enterprise Server is a network file synchronization software. Flexense Disk Pulse Enterprise is a real-time file system monitoring software. Both the Flexense...

pnpm security vulnerabilities

PNPM is a package manager developed by the open-source project Pnpm. Versions of Pnpm prior to 10.28.2 had security vulnerabilities. These vulnerabilities stemmed from the lack of path validation when processing the directories.bin field of packages. This allowed malicious npm packages to modify...

CVE-2025-70457

A Remote Code Execution RCE vulnerability exists in Sourcecodester Modern Image Gallery App v1.0 within the gallery/upload.php component. The application fails to properly validate uploaded file contents. Additionally, the application preserves the user-supplied file extension during the save...

CVE-2026-XXXX-Meru-Shell-OpenExternal-RCE

CVE-2026-XXXXX: Arbitrary URL Scheme Execution in Meru Gmail...

Cisco’s various products have security vulnerabilities

Cisco Unity Connection, among others, are products of the American company Cisco. Cisco Unity Connection is a voice messaging platform. Cisco Unified Communications Manager is a call processing component within unified communication systems. Cisco Unified Communications Manager IM & Presence is a...

MiracleLinux 8 : python3-3.6.8-69.el8_10.ML.1 (AXSA:2024-9057:07)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9057:07 advisory. python: Virtual environment venv activation scripts don't quote paths CVE-2024-9287 python: Improper validation of IPv6 and IPvFuture addresses...

ABB B&R Automation Studio

SUMMARY ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that resolves a vulnerability. Successful exploitation of this vulnerability may enable an attacker to masquerade as a trusted party when B&R Automation Studio establishes...

CVE-2026-20047

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to...

Mitel MiContact Center Business has a security vulnerability

Mitel MiContact Center Business is a comprehensive platform offered by the Canadian company Mitel. Versions of Mitel MiContact Center Business 10.2.0.10 and earlier, as well as Mitel CX 1.1.0.1 and earlier versions, have security vulnerabilities. These vulnerabilities stem from insufficient input...

Cisco Identity Services Engine and Cisco ISE Passive Identity Connector security vulnerabilities

Cisco Identity Services Engine Cisco ISE and Cisco ISE Passive Identity Connector are both products of the American company Cisco. Cisco Identity Services Engine is an Identity Services Engine ISE platform. This platform collects real-time information from networks, users, and devices, and develo...

CVE-2026-21272 Dreamweaver Desktop | Improper Input Validation (CWE-20)

Dreamweaver Desktop versions 21.6 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write. An attacker could leverage this vulnerability to manipulate or inject malicious data into files on the system. Exploitation of this issue requir...