5228 matches found
PT-2026-25272
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in themelexus Medilazar Core medilazar-core allows PHP Local File Inclusion.This issue affects Medilazar Core: from n/a through 1.4.7...
SFTPGo 路径遍历漏洞
SFTPGo is a fully functional and highly configurable SFTP server developed by the Italian developer Nicola Murino. Versions of SFTPGo prior to 2.7.1 contained a path traversal vulnerability, which was caused by improper validation of dynamic group paths. This vulnerability could lead to path...
CVE-2026-25076
Technical details about CVE-2026-25076 are not publicly provided in the supplied documents; monitor for updates.
CVE-2026-32247 Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
Graphiti is a framework for building and querying temporal context graphs for AI agents. Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.nodelabel...
CVE-2026-31979
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the task...
CVE-2026-31875
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor authentication MFA via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These codes are intended as...
CVE-2025-12704 Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.2 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user to access Virtual Registry data in groups where they are not members due to improper authorization under certain...
CVE-2026-1497 Incorrect privilege assignment in composite databases
Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any...
CVE-2026-3089
Actual Sync Server allows authenticated users to upload files through POST /sync/upload-user-file. In versions prior to 26.3.0, improper validation of the user-controlled x-actual-file-id header means that traversal segments ../ can escape the intended directory and write files outside...
EUVD-2026-11041
Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain limited...
plunk 跨站脚本漏洞
Plunk is an open-source email sending and management platform developed by Plunk. Versions of Plunk prior to 0.7.1 contained a cross-site scripting vulnerability. This vulnerability stemmed from the image upload endpoint accepting SVG files, which could lead to storage-based cross-site scripting...
OpenEMR 跨站脚本漏洞
OpenEMR is a set of open-source medical management systems developed by the OpenEMR community. This system can be used for medical practice management, electronic medical records, prescription writing, and medical billing applications. Versions of OpenEMR prior to 8.0.0.1 contained a cross-site...
PT-2026-24706
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.5 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user with maintainer-role permissions to reveal Datadog API credentials under certain conditions...
Copyparty 跨站脚本漏洞
Copyparty is a portable file server developed by Ed’s individual developer. Versions of Copyparty prior to 1.20.12 contained a cross-site scripting vulnerability. This vulnerability stemmed from improper handling of the.prologue.html file, which could allow attackers to execute arbitrary JavaScri...
JetBrains Hub 安全漏洞
JetBrains Hub is a web-based application developed by the Czech company JetBrains. This program allows for the integration of various JetBrains tools. Versions of JetBrains Hub prior to 2026.1 contained a security vulnerability that could lead to mismatches between login accounts when SSO...
PT-2026-24592
Name of the Vulnerable Software and Affected Versions IFTOP versions prior to IFTOP P4 181 Description IFTOP contains a Reflected Cross-site Scripting issue. Authenticated remote attackers can execute arbitrary JavaScript code in a user's browser through phishing attacks. Recommendations Update t...
CVE-2026-23206 affecting package kernel for versions less than 6.6.126.1-1
CVE-2026-23206 affecting package kernel for versions less than 6.6.126.1-1. A patched version of the package is available...
CVE-2025-40164 affecting package kernel for versions less than 6.6.126.1-1
CVE-2025-40164 affecting package kernel for versions less than 6.6.126.1-1. A patched version of the package is available...