42568 matches found
CVE-2026-15675 code-projects Online Job Portal EditUser.php sql injection
A vulnerability was identified in code-projects Online Job Portal 1.0. The affected element is an unknown function of the file /Admin/EditUser.php. Such manipulation of the argument UserId leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be...
PYSEC-2026-3000 pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
Impact The argon2i32 implementation does not check the nbblocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i32 will write past the end of the buffer and possibly corrupt the heap. Patches Fixed in 4.0.2.8, which now verifies that nbblock...
PYSEC-2026-2334 aiwaves-cn agents is vulnerable to resource consumption in the recall_relevant_memories_to_working_memory function
A weakness has been identified in aiwaves-cn agents up to e8c4e3c2d19739d3dff59e577d1c97090cc15f59. Affected by this issue is the function recallrelevantmemoriestoworkingmemory of the file core/cat/lookingglass/straycat.py of the component cheshirecatcore. This manipulation causes resource...
CVE-2026-15521 makafeli n8n-workflow-builder update_node_from_file server.cjs path traversal
A vulnerability was identified in makafeli n8n-workflow-builder up to 0.11.0. Affected is an unknown function of the file build/server.cjs of the component updatenodefromfile. The manipulation of the argument filePath leads to path traversal. An attack has to be approached locally. The exploit is...
GHSA-FRRJ-87JH-2772 vulnerabilities
Vulnerabilities for packages: kube-vip, cilium-cli...
WordPress Dokan plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Dokan versions = 5.0.6...
GHSA-V598-MR98-5866 vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-MXR8-RXWP-G4GX vulnerabilities
Vulnerabilities for packages: chromium...
GHSA-C6M6-6997-FXFH vulnerabilities
Vulnerabilities for packages: chromium...
CVE-2026-15191
A flaw has been found in mettle sendportal up to 3.0.1. This vulnerability affects unknown code of the file vendor/mettle/sendportal-core/src/Http/Requests/CampaignStoreRequest.php of the component Campaign Creation Endpoint. Executing a manipulation can lead to authorization bypass. The attack c...
PT-2026-56852
Name of the Vulnerable Software and Affected Versions pymonocypher versions prior to 4.0.2.8 Description The argon2i 32 function fails to verify the size of the nb blocks buffer. If the provided buffer is smaller than required by the API contract, the function may write beyond the buffer...
PYSEC-2026-2010 vLLM affected by RCE via auto_map dynamic module loading during model initialization
Summary vLLM loads Hugging Face automap dynamic modules during model resolution without gating on trustremotecode, allowing attacker-controlled Python code in a model repo/path to execute at server startup. --- Impact An attacker who can influence the model repo/path local directory or remote...
FreeBSD : xrdp -- multiple vulnerabilities (a3a34818-79a0-11f1-b295-98b78501ef2a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the a3a34818-79a0-11f1-b295-98b78501ef2a advisory. xrdp projects reports: xrdp v0.10.6.1 fixes 10 vulnerabilities and 1 regression introduced by ...
CVE-2026-53046
creationtimestamp| type| source ---|---|--- 2026-07-06 06:47:24+00:00| seen| https://www.hkcert.org/security-bulletin/debian-linux-kernel-multiple-vulnerabilities20260706...
PT-2026-55983
The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form 7 Form Field in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...
CVE-2026-14777
SourceCodester Onlne Examination & Learning Management System 1.0 has a vulnerability in /announcements.php that allows unrestricted file upload. The issue arises from an unknown functionality path in announcements.php, enabling remote exploitation and has publicly available exploits. The CVE not...
CVE-2026-13840
creationtimestamp| type| source ---|---|--- 2026-07-02 07:20:35+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260702 2026-07-06 07:16:27+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260706...
CVE-2026-43125
creationtimestamp| type| source ---|---|--- 2026-07-02 05:52:07+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20260702 2026-07-02 06:57:29+00:00| seen| https://www.hkcert.org/security-bulletin/redhat-linux-kernel-multiple-vulnerabilities20260702...