594160 matches found
CVE-2026-72920 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...
CVE-2026-72920 SeaweedFS: Unauthenticated filer IAM gRPC service grants S3 administrative control
SeaweedFS is a distributed storage system. Prior to 4.24, the filer registers the SeaweedIdentityAccessManagement gRPC service without mandatory authentication when jwt.filersigning.key is unset, allowing any client that can reach the filer gRPC port to invoke CreateUser, CreateAccessKey,...
CVE-2026-19434
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescaped into class and style attributes when...
GHSA-XH95-F55M-82FW vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-12074 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-QVV7-CG9C-W4X3 vulnerabilities
Vulnerabilities for packages: open-webui...
EUVD-2026-56152
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens bearer credentials used to authenticate against the builder API are stored in the database as cleartext strings. An attacker who gains read access to the database e.g., via SQL injection, backup exposure, or insider access can extra...
CVE-2026-47702 TypeBot API tokens stored in plaintext
TypeBot is a chatbot builder tool. In version 3.16.1, API tokens bearer credentials used to authenticate against the builder API are stored in the database as cleartext strings. An attacker who gains read access to the database e.g., via SQL injection, backup exposure, or insider access can extra...
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component...
firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Disability Access APIs component...
Windows TCP/IP Denial of Service Vulnerability
Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network...
Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability
Improper link resolution before file access 'link following' in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to perform tampering locally...
Microsoft SharePoint Server Spoofing Vulnerability
Server-side request forgery ssrf in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...
Windows Remote Desktop Client Information Disclosure Vulnerability
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network...
Microsoft Office Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally...
Microsoft Office Word Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally...
AMD Zen Information Disclosure Vulnerability
No cwe for this issue in AMD Zen allows an authorized attacker to disclose information locally...
Microsoft Office Word Information Disclosure Vulnerability
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information locally...