4889 matches found
Astra Linux – Vulnerability in Chromium
Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Before version 150.0.7871.47, reading content from the Chromecast using Google Chrome allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from the process’s memory through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
The use of after-free in the DOM in Google Chrome before version 148.0.7778.179 allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: Medium...
Astra Linux – Vulnerability in Chromium
Before version 148.0.7778.168, WebAudio in Google Chrome allowed a remote attacker to execute arbitrary code within a sandbox through a crafted HTML page. Chromium security severity: High...
NPM: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
NPM: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...
NPM: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects
NPM: n8n: Improper Authorization Allows Authenticated Users to Assign Workflows to Folders in Other Projects vulnerability discovered by ? in WordPress Npm n8n versions 2.28.0...
NPM: n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation
NPM: n8n: MySQL v1 Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation vulnerability discovered by ? in WordPress Npm n8n versions 1.123.61...
NPM: n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
NPM: n8n: Credential Authorization Bypass via Expression in HTTP Request Node genericAuthType vulnerability discovered by ? in WordPress Npm n8n versions 1.123.67...
NPM: n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
NPM: n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution vulnerability discovered by ? in WordPress Npm n8n versions 2.27.4...
SUSE CVE-2026-16419
Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...
EUVD-2026-47730
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...
CVE-2026-16606 Unauthenticated remote code execution (pre-auth RCE) vulnerability in openFT for Linux and Oracle Solaris
A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution pre-auth RCE on GNU/Linux or Oracle Solaris. The Fsas Technologies PSIRT obtained that intelligence internally and covers the CVE...
Plone products.isurlinportal < 1.2.0 Open Redirect
The version of Plone products.isurlinportal installed on the remote host is prior to 1.2.0. It is, therefore, affected by an open redirect vulnerability. An unauthenticated, remote attacker, can exploit this, via the 'is url in portal', to redirect to an external website after login. Note that...
CVE-2026-16417
Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...
EUVD-2026-46451
libheif is a HEIF and AVIF file format decoder and encoder. Versions prior to 1.22.0 crashes in the public C API heifimagehandlegetimagetiling when a malformed uncompressed HEIF image item has an associated uncC property but no associated ispe property. In debug builds this trips the ispe && uncC...
CVE-2026-47413 praisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The POST /workspaces/workspaceid/members endpoint is gated only by requireworkspacememberworkspaceid default minrole="member" an...
CVE-2026-46681
@nevware21/ts-utils is a comprehensive TypeScript/JavaScript utility library. Prior to version 0.14.0, the copyProps function in lib/src/object/copy.ts uses for...in to iterate over source object properties without an Object.hasOwnProperty check, and does not filter dangerous keys proto,...
SUSE CVE-2026-54538
xrdp is an open source RDP server. In versions 0.10.6 and prior, a n issue was discovered where the software fails to properly validate the totalLength field within the RDP protocol control header during packet reception. An unauthenticated remote attacker can exploit this vulnerability by sendin...
PT-2026-61838
The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration...