174011 matches found
CVE-2026-71964 CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure t...
EUVD-2026-55725
Dokploy is a free, self-hostable Platform as a Service PaaS. From 0.29.3 until 0.29.13, the incomplete fix for CVE-2026-45628 leaves packages/server/src/db/schema/compose.ts branch fields without server-side validation, allowing a direct compose.update request to store a malicious customGitBranch...
CVE-2026-72867
Dokploy (PaaS) vulnerability CVE-2026-72867 affects versions 0.29.3–0.29.13. The incomplete fix for CVE-2026-45628 leaves server-side validation missing in packages/server/src/db/schema/compose.ts branch fields, allowing a direct compose.update request to store a malicious customGitBranch, branch...
CVE-2026-10754
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls...
CVE-2026-10754
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls. The flaw impacts confidentiality and integrity (both HIGH) with network access and low attack complexity, no user interaction requ...
CVE-2026-10754
Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls...
CVE-2026-56619
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...
Eclipse OMR: Eclipse OMR: Denial of service via improper input validation in arraycmp SIMD
A flaw was found in Eclipse OMR. The arraycmp SIMD Single Instruction, Multiple Data implementation for Z and P architectures does not properly validate input by failing to check if the number of bytes to compare is zero. This oversight could allow a remote attacker, with low privileges and user...
openjdk: Enhance Jar handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...
openjdk: Improve certification checking (Oracle CPU 2026-07)
A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...
Eclipse OMR: Eclipse OMR: Denial of service via improper input validation in arraycmp SIMD
A flaw was found in Eclipse OMR. The arraycmp SIMD Single Instruction, Multiple Data implementation for Z and P architectures does not properly validate input by failing to check if the number of bytes to compare is zero. This oversight could allow a remote attacker, with low privileges and user...
openjdk: Improve certification checking (Oracle CPU 2026-07)
A flaw was found in OpenJDK. OpenJDK can apply two different security meanings to the same wildcard dNSName SAN across certificate policy enforcement and hostname verification. During path validation, DNSName.constrains compares .foo.com and secret.foo.com literally and returns NAMESAMETYPE, so...
CVE-2026-71576
A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...
SUSE-SU-2026:3551-1 Security update for perl-Date-Manip
This update for perl-Date-Manip fixes the following issues: - CVE-2026-60074: corrupted dates returned when processing non-ASCII decimal digits that pass the numeric range tests in check bsc1273063. - CVE-2026-60075: CPU exhaustion due to quadratic backtracking in the unanchored time substitution...
CVE-2026-72720
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...
EUVD-2026-55668
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting Reflected XSS due to insufficient validation and output encoding of user-controlled input...
CVE-2026-56619
CVE-2026-56619 affects HCL BigFix Mobile. The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient validation and output encoding of user-controlled input. The CVSS v3.1 base score is 5.4 (Medium) with Network attack, Low attack complexity, Privileges Required: Low...
CVE-2026-72720
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...
EUVD-2026-55637
The webhook URL validator in website/notifications/webhooks.py uses ip.isglobal to reject non-public addresses after DNS resolution. IPv6 transition addresses NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001:0000::/32 are classified as globally routable by IANA, so isglobal returns True even when...
