2884 matches found
Red Hat Quay 代码问题漏洞
Red Hat Quay is a distributed container image repository provided by the American company Red Hat. It is primarily used for building, distributing, and deploying containers. Red Hat Quay 3 has code-related vulnerabilities. These vulnerabilities arise from the ability to bypass the re-authenticati...
CVE-2026-40283 WeGIA has stored XSS in profile_paciente.php
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting XSS vulnerability allows an authenticated user to inject malicious JavaScript via the "Nome" field in the "Informações Pacientes" page. The payload is stored and executed when the patien...
Malicious code in koa-v3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5868e3008cddae6f0d4f1594e5f22c25d905ca6e32b915c4b527ad2ed77cce7f The package koa-v3 was found to contain malicious code. Source: ghsa-malware 16ed2d5a3189595a73eb117e70d2a31ba6ed920704a2917c7f83aacb8b5f42d1 Any...
CLEANSTART-2026-AK18460 Security fixes for ghsa-72hv-8253-57qq applied in versions: 3.6.4-r4
Security vulnerability affects the apache-zookeeper package. This issue is resolved in later releases. See references for vulnerability details...
PT-2026-33502
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting XSS vulnerability allows an authenticated user to inject malicious JavaScript via the "Nome" field in the "Informações Pacientes" page. The payload is stored and executed when the patien...
BIT-MLFLOW-2025-10279 Privilege Escalation in mlflow/mlflow
In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions 0o777. This vulnerability allows an attacker with write access to the /tmp directory to exploit a race condition and overwrite .py files in the virtual...
CVE-2026-40308 My Calendar: Unauthenticated Information Disclosure (IDOR) via Multisite switch_to_blog
My Calendar is a WordPress plugin for managing calendar events. In versions 3.7.6 and below, the mcajaxmcjsaction AJAX endpoint, registered for unauthenticated users, passes user-supplied arguments through parsestr without validation, allowing injection of arbitrary parameters including a site...
MINI-V3V3-GFRP-HW94
Bulletin has no description...
PT-2026-33314
Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.2.0 Description JWT Tokens used by tasks were exposed in logs. This exposure could allow UI users to act as Dag Authors. Recommendations Upgrade to version 3.2.0...
ai.hyacinth.framework:core-service-admin-server (>=0.5.0 <=0.5.24), am.ik.home:uaa-server (>=1.0.0 <=1.9.0) +3260 more potentially affected by CVE-2026-40477 via org.thymeleaf:thymeleaf (>=m1 <=3.1.3.RELEASE)
org.thymeleaf:thymeleaf MAVEN version =m1, =0.5.0, =1.0.0, =0.9.6, =0.9.6, =1.0.0, =0.0.1, =1.0.0, =1.0, =3.4.0, =5.6.5, =4.1.0, =6.4.7 and more Source cves: CVE-2026-40477 Source advisory: OSV:GHSA-R4V4-5MWR-2FWR...
CVE-2026-31048
An issue in the pickle protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled string message...
CVE-2025-15636
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in emarket-design YouTube Showcase youtube-showcase allows Stored XSS.This issue affects YouTube Showcase: from n/a through = 3.5.1...
[SECURITY] [DLA 4532-1] python3.9 regression and security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4532-1 [email protected] https://www.debian.org/lts/security/ Arnaud Rebillout April 15, 2026 https://wiki.debian.org/LTS -...
SUSE-SU-2026:1356-1 Security update for nfs-utils
This update for nfs-utils fixes the following issue: Security fixes: - CVE-2025-12801: rpc.mountd allows a NFSv3 client to escalate their privileges and access subdirectories and subtrees of an exported directory bsc1259204. Other fixes: - Split from nfs-utils into its own spec and changelog file...
CVE-2026-40740
Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through = 3.9.7...
CVE-2026-31924
Cleartext Transmission of Sensitive Information vulnerability in Apache APISIX. tencent-cloud-cls log export uses plaintext HTTP This issue affects Apache APISIX: from 2.99.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2026-31908
Header injection vulnerability in Apache APISIX. The attacker can take advantage of certain configuration in forward-auth plugin to inject malicious headers. This issue affects Apache APISIX: from 2.12.0 through 3.15.0. Users are recommended to upgrade to version 3.16.0, which fixes the issue...
CVE-2025-51414
In Phpgurukul Online Course Registration v3.1, an arbitrary file upload vulnerability was discovered within the profile picture upload functionality on the /my-profile.php page...
PT-2026-32597
Name of the Vulnerable Software and Affected Versions ShopLentor plugin for WordPress versions up to 3.3.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and missing output escaping on user-supplied shortcode attributes. Authenticated attackers with...
