250668 matches found
PT-2026-91259
Name of the Vulnerable Software and Affected Versions GIMP affected versions not specified Description A flaw in the Lighting Effects filter occurs when processing a specially crafted lighting preset file. The filter fails to properly validate the number of light sources, leading to an...
CVE-2026-25687: Race Condition within a Thread
A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector ZCC allows a heap corruption, resulting in a denial of service client crash and potentially arbitrary code execution in the context of the ZCC process...
CVE-2026-90949: Out-of-bounds Write
A flaw was found in GIMP's PSP Paint Shop Pro file loader. When processing a compressed selection channel, a heap-based buffer overflow can occur due to a mismatch between the allocated buffer size and the amount of data decompressed. A remote attacker could exploit this vulnerability by crafting...
CVE-2026-82793: Unrestricted Upload of File with Dangerous Type
Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit. If a specially crafted file is uploaded by a remote authenticated attacker, arbitrary code may be executed on the product...
CVE-2026-61701: Deserialization of Untrusted Data
Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink stores serialized action objects in the magiclinks.action database column and deserializes them through src/MagicLink.php and src/Actions/ResponseAction.php...
CVE-2026-84607: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to execute arbitrary code with kernel...
PT-2026-91043
An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload...
CVE-2026-84607: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A sandboxed app may be able to execute arbitrary code with kernel...
CVE-2026-84506: Use After Free
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to execute arbitrary code with kernel privileges...
CVE-2026-12518: Improper Privilege Management
A local privilege escalation vulnerability in the Logitech Logi Options+ updater service on Windows allows a low-privileged local user to execute arbitrary code as SYSTEM...
Amazon Linux 2023 : libtiff, libtiff-devel, libtiff-static (ALAS2023-2026-2156)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2156 advisory. An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the processcommandopts function in tools/tiffcrop.c CVE-2026-52490 Tenable has extracted th...
PT-2026-91835
The backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowed classes restriction. Any code path that could write to a widget. session key with attacker-controlled bytes could trigger PHP object injection the next time the...
PT-2026-117974
Name of the Vulnerable Software and Affected Versions Safari versions prior to 27 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 visionOS versions prior to 27 Description A type confusion issue exists due to improper state management. Processing...
SUSE SLES15 Security Update : libssh2_org (SUSE-SU-2026:4095-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4095-1 advisory. - CVE-2025-15661: out-of-bounds heap read vulnerability in the sftpsymlink function in src/sftp.c bsc1268546. - CVE-2026-7598:...
CVE-2023-50461: Incorrect Authorization
An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...
CVE-2023-32778
ILIAS (a learning management system) is vulnerable to arbitrary code execution via ZIP upload in versions 6.23, 7 before 7.22, and 8.1. The CNA-assigned CVSS v3.1 score is 3.3 (Low) , reflecting a network vector with high attack complexity and high privileges required , with low impact to confide...
EUVD-2023-60650
An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload...
CVE-2023-32778
An issue was discovered in ILIAS 6.23, 7 before 7.22, and 8.1. An attacker can execute arbitrary code via ZIP upload...
CVE-2023-50461
An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...