1481 matches found
EUVD-2026-26842
A vulnerability has been found in AV Stumpfl Pixera Two Media Server up to 25.1 R2. The affected element is an unknown function of the component Service Port 1338. Such manipulation leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 25.2 R3...
CVE-2026-7703 AV Stumpfl Pixera Two Media Server Websocket API code injection
A flaw has been found in AV Stumpfl Pixera Two Media Server up to 25.2 R2. Impacted is an unknown function of the component Websocket API. This manipulation causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Upgrading to version 25.2 R3 is...
AV Stumpfl Pixera Two Media Server 路径遍历漏洞
The AV Stumpfl Pixera Two Media Server is a professional media server system developed by the Austrian company AV Stumpfl. Versions of the AV Stumpfl Pixera Two Media Server 25.1 R2 and earlier contained a path traversal vulnerability. This vulnerability originated from an unknown function in the...
CVE-2026-40551 Use of Client-Side Authentication in mpGabinet
mpGabinet performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user. This issue affects mpGabinet version 23.12.19...
Fedora 44 : xorg-x11-server (2026-cf9e55a7a0)
The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-cf9e55a7a0 advisory. Update to xserver 21.1.22, CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002, CVE-2026-34003 Tenable has extracted the...
CVE-2026-41492 Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph
Dgraph is an open source distributed GraphQL database. Prior to 25.3.3, Dgraphl exposes the process command line through the unauthenticated /debug/vars endpoint on Alpha. Because the admin token is commonly supplied via the --security "token=..." startup flag, an unauthenticated attacker can...
CVE-2025-70420
A SQL injection vulnerability exists in Genesys Latitude v25.1.0.420 that allows an authenticated attacker to execute arbitrary SQL queries against the backend database. The vulnerability is caused by unsanitized user-supplied input being concatenated directly into SQL statements...
CVE-2026-22008
Vulnerability in Oracle Java SE component: Libraries. The supported version that is affected is Oracle Java SE: 25.0.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...
CVE-2026-34279
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Event Management. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...
PT-2026-46971
Name of the Vulnerable Software and Affected Versions 7-Zip versions 9.11 through 26.00 Description A heap out-of-bounds read of up to 3 bytes exists in the UDF disc image handler's File Identifier Descriptor parser. In the CFileId::Parse function, an alignment-padding loop reads data to reach a...
PT-2026-33981
In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...
PT-2026-46981
Name of the Vulnerable Software and Affected Versions 7-Zip versions 9.21 through 26.00 Description An off-by-one out-of-bounds read exists in the ParseDepedencyExpression function of the UEFI firmware image parser. The issue occurs because the function validates an attacker-controlled opcode byt...
WWBN AVideo 安全漏洞
WWBN AVideo is a video platform building system written in PHP, developed by the WWBN team. Versions of WWBN AVideo prior to 29.0 contained security vulnerabilities. These vulnerabilities stemmed from incomplete XSS repairs in the ParsedownSafeWithLinks class, as well as the lack of coverage for...
CVE-2026-40098
CVE-2026-40098 affects OpenMage LTS (Magento-based) prior to version 20.17.0. The shared wishlist add-to-cart endpoint improperly authorizes via a public sharing_code while loading the target wishlist item by a separate global wishlist_item_id, failing to verify ownership. This enables an attacke...
EUVD-2026-23117
Dgraph: Unauthenticated /debug/pprof/cmdline discloses admin auth token, enabling unauthorized access to protected Alpha admin endpoints...
CVE-2025-15610
The .NET Remoting framework used by OpenText Fax RightFax includes known security vulnerabilities that could be exploited if the service is exposed in environments where the remoting ports are accessible...
Nordic Semiconductor IronSide SE 安全漏洞
Nordic Semiconductor IronSide SE is a security development environment software developed by the Norwegian company Nordic Semiconductor. There are security vulnerabilities in Nordic Semiconductor IronSide SE for nRF54H20 versions up to 23.0.2+17. These vulnerabilities stem from algorithmic...
