607772 matches found
CVE-2026-78212 4MOSAn Security Technology｜4MOSAn Management Center - Arbitrary File Read
4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files...
EUVD-2026-64705
NewSiteServer NSS developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to anyone on behalf of the school...
CVE-2026-19200
Velociraptor 's verify() VQL function suffers from an implementation fault that causes it to use the global artifact repository instead of a scoped one. This allows a user with only the NOTEBOOK_EDIT permission (e.g., an analyst role) to overwrite existing live built-in artifacts without the perm...
CVE-2026-78177 TanStack devtools-vite Development Devtools Event Bus package-manager.ts installPackage os command injection
A vulnerability was found in TanStack devtools-vite 0.7.0. Affected by this issue is the function installPackage of the file packages/devtools-bundler-core/src/package-manager.ts of the component Development Devtools Event Bus. The manipulation of the argument packageName results in os command...
CVE-2026-78204
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...
CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...
CVE-2026-78204
Ghostwriter through version 7.2.6 is missing per-object authorization on its report template lint endpoints . The underlying cause is that RoleBasedAccessControlMixin.test_func only checks request.user.is_active unless a view explicitly overrides it, and neither the lint endpoint nor the stored-l...
EUVD-2026-64679
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored...
CVE-2026-78203
Ghostwriter before 7.1.2 contains a cross-client authorization flaw in the report template swap endpoint . The endpoint fails to validate template ownership, and because template primary keys are sequential, an authenticated attacker can enumerate and attach templates belonging to other clients t...
EUVD-2026-64678
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then...
PT-2026-79818
Name of the Vulnerable Software and Affected Versions 4MOSAn GCB Doctor affected versions not specified Description An OS Command Injection issue exists where unauthenticated remote attackers can execute arbitrary system commands on the server. This is possible through a parameter in an unremoved...
The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit allows a hacker to induce a service failure.
The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit allows a hacker to induce a service failure.
The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
The vulnerability of the WebRender component in Firefox web browsers, Firefox ESR, and the Thunderbird email client allows a hacker to trigger a service failure.
The vulnerability of the WebRender component in Firefox web browsers, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control in isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service failures...
The vulnerability of the IndexedDB component in web browsers such as Firefox, Firefox ESR, and the email client Thunderbird allows a hacker to induce a service failure.
The vulnerability of IndexedDB in web browsers such as Firefox, Firefox ESR, and the email client Thunderbird is related to deficiencies in access control in isolated environments. Exploiting this vulnerability could allow a malicious actor to cause service failures...
The vulnerability of the ceph_handle_authreply() function in the net/ceph/auth.c module of the Linux operating system allows a hacker to gain access to protected information or cause a service failure.
The vulnerability of the cephhandleauthreply function in the net/ceph/auth.c module of the Linux kernel is related to operations that go beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to gain access to protected information or cause service...
The vulnerability of the JAR component in the Firefox web browser allows a hacker to trigger a service failure.
The vulnerability of the JAR component in the Firefox web browser is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
PT-2026-80914
NetworkManager did not apply the private user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise 802.1X connection profile's CA path at an...
PT-2026-79837
Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...
PT-2026-80825
Name of the Vulnerable Software and Affected Versions Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions prior to 1.7.2 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass security restrictions...